开源软件构建与测试

_service:tar_scm:krb5.spec Changed

@@ -2,13 +2,13 @@
 %global WITH_DIRSRV 1
 
 Name:     krb5
-Version:  1.19.2
-Release:  2
+Version:  1.20.1
+Release:  1
 Summary:  The Kerberos network authentication protocol
 License:  MIT
 URL:      http://web.mit.edu/kerberos/www/
-Source0:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz
-Source1:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz.asc
+Source0:  https://web.mit.edu/kerberos/dist/krb5/1.20/%{name}-%{version}.tar.gz
+Source1:  https://web.mit.edu/kerberos/dist/krb5/1.20/%{name}-%{version}.tar.gz.asc
 Source2:  kprop.service
 Source3:  kadmin.service
 Source4:  krb5kdc.service
@@ -25,8 +25,6 @@
 Patch3: netlib-and-dns.patch
 Patch4: fix-debuginfo-with-y.tab.c.patch
 Patch5: Remove-3des-support.patch
-Patch6: FIPS-with-PRNG-and-RADIUS-and-MD4.patch
-Patch7: backport-CVE-2021-37750.patch
 
 BuildRequires:  gettext
 BuildRequires:  gcc make automake autoconf pkgconfig pam-devel libselinux-devel byacc
@@ -318,6 +316,9 @@
 %{_mandir}/man8/*
 
 %changelog
+* Wed Feb 1 2023 zhouchenchen123 <zhouchenchen@huawei.com> - 1.20.1-1
+- update to 1.20.1
+
 * Tue Mar 8 2022 yixiangzhike <yixiangzhike007@163.com> - 1.19.2-2
 - Add ExecStartPost option to krb5kdc.service for solving error message when krb5kdc starting

_service:tar_scm:FIPS-with-PRNG-and-RADIUS-and-MD4.patch Deleted

@@ -1,568 +0,0 @@
-From 5978878bcee5ec39e4357f408470d39e9540d2bf Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 9 Nov 2018 15:12:21 -0500
-Subject: PATCH downstream FIPS with PRNG and RADIUS and MD4
-
-NB: Use openssl's PRNG in FIPS mode and taint within krad.
-
-A lot of the FIPS error conditions from OpenSSL are incredibly
-mysterious (at best, things return NULL unexpectedly; at worst,
-internal assertions are tripped; most of the time, you just get
-ENOMEM).  In order to cope with this, we need to have some level of
-awareness of what we can and can't safely call.
-
-This will slow down some calls slightly (FIPS_mode() takes multiple
-locks), but not for any ciphers we care about - which is to say that
-AES is fine.  Shame about SPAKE though.
-
-post6 restores MD4 (and therefore keygen-only RC4).
-
-Last-updated: krb5-1.17
----
- src/lib/crypto/krb/prng.c                     | 11 ++++-
- .../crypto/openssl/enc_provider/camellia.c    |  6 +++
- src/lib/crypto/openssl/enc_provider/rc4.c     | 13 +++++-
- .../crypto/openssl/hash_provider/hash_evp.c   | 12 +++++
- src/lib/crypto/openssl/hmac.c                 |  6 ++-
- src/lib/krad/attr.c                           | 45 ++++++++++++++-----
- src/lib/krad/attrset.c                        |  5 ++-
- src/lib/krad/internal.h                       | 13 +++++-
- src/lib/krad/packet.c                         | 22 ++++-----
- src/lib/krad/remote.c                         | 10 ++++-
- src/lib/krad/t_attr.c                         |  3 +-
- src/lib/krad/t_attrset.c                      |  4 +-
- src/plugins/preauth/spake/spake_client.c      |  6 +++
- src/plugins/preauth/spake/spake_kdc.c         |  6 +++
- 14 files changed, 129 insertions(+), 33 deletions(-)
-
-diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c
-index cb9ca9b98..f0e9984ca 100644
---- a/src/lib/crypto/krb/prng.c
-+++ b/src/lib/crypto/krb/prng.c
-@@ -26,6 +26,8 @@
- 
- #include "crypto_int.h"
- 
-+#include <openssl/rand.h>
-+
- krb5_error_code KRB5_CALLCONV
- krb5_c_random_seed(krb5_context context, krb5_data *data)
- {
-@@ -99,9 +101,16 @@ krb5_boolean
- k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
- {
-     const char *device;
--#if defined(__linux__) && defined(SYS_getrandom)
-     int r;
- 
-+    /* A wild FIPS mode appeared! */
-+    if (FIPS_mode()) {
-+        /* The return codes on this API are not good */
-+        r = RAND_bytes(buf, len);
-+        return r == 1;
-+    }
-+
-+#if defined(__linux__) && defined(SYS_getrandom)
-     while (len > 0) {
-         /*
-          * Pull from the /dev/urandom pool, but require it to have been seeded.
-diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c
-index 2da691329..f79679a0b 100644
---- a/src/lib/crypto/openssl/enc_provider/camellia.c
-+++ b/src/lib/crypto/openssl/enc_provider/camellia.c
-@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
-     unsigned char blockYCAMELLIA_BLOCK_SIZE, blockBCAMELLIA_BLOCK_SIZE;
-     struct iov_cursor cursor;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     if (output->length < CAMELLIA_BLOCK_SIZE)
-         return KRB5_BAD_MSIZE;
- 
-@@ -331,6 +334,9 @@ static krb5_error_code
- krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage,
-                              krb5_data *state)
- {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     state->length = 16;
-     state->data = (void *) malloc(16);
-     if (state->data == NULL)
-diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
-index a65d57b7a..6ccaca94a 100644
---- a/src/lib/crypto/openssl/enc_provider/rc4.c
-+++ b/src/lib/crypto/openssl/enc_provider/rc4.c
-@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
-     EVP_CIPHER_CTX *ctx = NULL;
-     struct arcfour_state *arcstate;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     arcstate = (state != NULL) ? (void *)state->data : NULL;
-     if (arcstate != NULL) {
-         ctx = arcstate->ctx;
-@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
- static void
- k5_arcfour_free_state(krb5_data *state)
- {
--    struct arcfour_state *arcstate = (void *)state->data;
-+    struct arcfour_state *arcstate;
-+
-+    if (FIPS_mode())
-+        return;
-+
-+    arcstate = (void *) state->data;
- 
-     EVP_CIPHER_CTX_free(arcstate->ctx);
-     free(arcstate);
-@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key,
- {
-     struct arcfour_state *arcstate;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     /*
-      * The cipher state here is a saved pointer to a struct arcfour_state
-      * object, rather than a flat byte array as in most enc providers.  The
-diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-index 1e0fb8fc3..feb5eda99 100644
---- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
-+++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-@@ -49,6 +49,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
-     if (ctx == NULL)
-         return ENOMEM;
- 
-+    if (type == EVP_md4()) {
-+        /* See comment below in hash_md4(). */
-+        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-+    }
-+
-     ok = EVP_DigestInit_ex(ctx, type, NULL);
-     for (i = 0; i < num_data; i++) {
-         if (!SIGN_IOV(&datai))
-@@ -64,12 +69,19 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
- static krb5_error_code
- hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
- {
-+    /*
-+     * MD4 is needed in FIPS mode to perform key generation for RC4 keys used
-+     * by IPA.  These keys are only used along a (separately) secured channel
-+     * for legacy reasons when performing trusts to Active Directory.
-+     */
-     return hash_evp(EVP_md4(), data, num_data, output);
- }
- 
- static krb5_error_code
- hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
- {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-     return hash_evp(EVP_md5(), data, num_data, output);
- }
- 
-diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
-index 7dc59dcc0..769a50c00 100644
---- a/src/lib/crypto/openssl/hmac.c
-+++ b/src/lib/crypto/openssl/hmac.c
-@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash)
-         return EVP_sha256();
-     else if (!strncmp(hash->hash_name, "SHA-384",7))
-         return EVP_sha384();
--    else if (!strncmp(hash->hash_name, "MD5", 3))
-+
-+    if (FIPS_mode())
-+        return NULL;
-+
-+    if (!strncmp(hash->hash_name, "MD5", 3))
-         return EVP_md5();
-     else if (!strncmp(hash->hash_name, "MD4", 3))
-         return EVP_md4();
-diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
-index 9c13d9d75..275327e67 100644
---- a/src/lib/krad/attr.c
-+++ b/src/lib/krad/attr.c
-@@ -30,6 +30,7 @@
- #include <k5-int.h>
- #include "internal.h"
- 
-+#include <openssl/crypto.h>
- #include <string.h>
- 
- /* RFC 2865 */
-@@ -38,7 +39,8 @@
- typedef krb5_error_code
- (*attribute_transform_fn)(krb5_context ctx, const char *secret,
-                           const unsigned char *auth, const krb5_data *in,
--                          unsigned char outbufMAX_ATTRSIZE, size_t *outlen);
-+                          unsigned char outbufMAX_ATTRSIZE, size_t *outlen,
-+                          krb5_boolean *is_fips);
- 
- typedef struct {
-     const char *name;
-@@ -51,12 +53,14 @@ typedef struct {
- static krb5_error_code
- user_password_encode(krb5_context ctx, const char *secret,
-                      const unsigned char *auth, const krb5_data *in,
--                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen);
-+                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen,
-+                     krb5_boolean *is_fips);
- 
- static krb5_error_code
- user_password_decode(krb5_context ctx, const char *secret,
-                      const unsigned char *auth, const krb5_data *in,
--                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen);
-+                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen,
-+                     krb5_boolean *ignored);
- 
- static const attribute_record attributesUCHAR_MAX = {
-     {"User-Name", 1, MAX_ATTRSIZE, NULL, NULL},
-@@ -128,7 +132,8 @@ static const attribute_record attributesUCHAR_MAX = {
- static krb5_error_code
- user_password_encode(krb5_context ctx, const char *secret,
-                      const unsigned char *auth, const krb5_data *in,
--                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen)
-+                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen,
-+                     krb5_boolean *is_fips)
- {
-     const unsigned char *indx;
-     krb5_error_code retval;
-@@ -154,8 +159,14 @@ user_password_encode(krb5_context ctx, const char *secret,
-     for (blck = 0, indx = auth; blck * BLOCKSIZE < len; blck++) {
-         memcpy(tmp.data + seclen, indx, BLOCKSIZE);
- 
--        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &tmp,
--                                      &sum);
-+        if (FIPS_mode()) {
-+            /* Skip encryption here.  Taint so that we won't pass it out of
-+             * the machine by accident. */
-+            *is_fips = TRUE;
-+            sum.contents = calloc(1, BLOCKSIZE);
-+        } else
-+            retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &tmp,
-+                                          &sum);
-         if (retval != 0) {
-             zap(tmp.data, tmp.length);
-             zap(outbuf, len);
-@@ -180,7 +191,8 @@ user_password_encode(krb5_context ctx, const char *secret,
- static krb5_error_code
- user_password_decode(krb5_context ctx, const char *secret,
-                      const unsigned char *auth, const krb5_data *in,
--                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen)
-+                     unsigned char outbufMAX_ATTRSIZE, size_t *outlen,
-+                     krb5_boolean *is_fips)
- {
-     const unsigned char *indx;
-     krb5_error_code retval;
-@@ -204,8 +216,14 @@ user_password_decode(krb5_context ctx, const char *secret,
-     for (blck = 0, indx = auth; blck * BLOCKSIZE < in->length; blck++) {
-         memcpy(tmp.data + seclen, indx, BLOCKSIZE);
- 
--        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0,
--                                      &tmp, &sum);
-+        if (FIPS_mode()) {
-+            /* Skip encryption here.  Taint so that we won't pass it out of
-+             * the machine by accident. */
-+            *is_fips = TRUE;
-+            sum.contents = calloc(1, BLOCKSIZE);
-+        } else
-+            retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0,
-+                                          &tmp, &sum);
-         if (retval != 0) {
-             zap(tmp.data, tmp.length);
-             zap(outbuf, in->length);
-@@ -248,7 +266,7 @@ krb5_error_code
- kr_attr_encode(krb5_context ctx, const char *secret,
-                const unsigned char *auth, krad_attr type,
-                const krb5_data *in, unsigned char outbufMAX_ATTRSIZE,
--               size_t *outlen)
-+               size_t *outlen, krb5_boolean *is_fips)
- {
-     krb5_error_code retval;
- 
-@@ -265,7 +283,8 @@ kr_attr_encode(krb5_context ctx, const char *secret,
-         return 0;
-     }
- 
--    return attributestype - 1.encode(ctx, secret, auth, in, outbuf, outlen);
-+    return attributestype - 1.encode(ctx, secret, auth, in, outbuf, outlen,
-+                                       is_fips);
- }
- 
- krb5_error_code
-@@ -274,6 +293,7 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
-                unsigned char outbufMAX_ATTRSIZE, size_t *outlen)
- {
-     krb5_error_code retval;
-+    krb5_boolean ignored;
- 
-     retval = kr_attr_valid(type, in);
-     if (retval != 0)
-@@ -288,7 +308,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
-         return 0;
-     }
- 
--    return attributestype - 1.decode(ctx, secret, auth, in, outbuf, outlen);
-+    return attributestype - 1.decode(ctx, secret, auth, in, outbuf, outlen,
-+                                       &ignored);
- }
- 
- krad_attr
-diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
-index 03c613716..d89982a13 100644
---- a/src/lib/krad/attrset.c
-+++ b/src/lib/krad/attrset.c
-@@ -167,7 +167,8 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy)
- krb5_error_code
- kr_attrset_encode(const krad_attrset *set, const char *secret,
-                   const unsigned char *auth,
--                  unsigned char outbufMAX_ATTRSETSIZE, size_t *outlen)
-+                  unsigned char outbufMAX_ATTRSETSIZE, size_t *outlen,
-+                  krb5_boolean *is_fips)
- {
-     unsigned char bufferMAX_ATTRSIZE;
-     krb5_error_code retval;
-@@ -181,7 +182,7 @@ kr_attrset_encode(const krad_attrset *set, const char *secret,
- 
-     K5_TAILQ_FOREACH(a, &set->list, list) {
-         retval = kr_attr_encode(set->ctx, secret, auth, a->type, &a->attr,
--                                buffer, &attrlen);
-+                                buffer, &attrlen, is_fips);
-         if (retval != 0)
-             return retval;
- 
-diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
-index 996a89372..a53ce31ce 100644
---- a/src/lib/krad/internal.h
-+++ b/src/lib/krad/internal.h
-@@ -49,6 +49,13 @@
- 
- typedef struct krad_remote_st krad_remote;
- 
-+struct krad_packet_st {
-+    char bufferKRAD_PACKET_SIZE_MAX;
-+    krad_attrset *attrset;
-+    krb5_data pkt;
-+    krb5_boolean is_fips;
-+};
-+
- /* Validate constraints of an attribute. */
- krb5_error_code
- kr_attr_valid(krad_attr type, const krb5_data *data);
-@@ -57,7 +64,8 @@ kr_attr_valid(krad_attr type, const krb5_data *data);
- krb5_error_code
- kr_attr_encode(krb5_context ctx, const char *secret, const unsigned char *auth,
-                krad_attr type, const krb5_data *in,
--               unsigned char outbufMAX_ATTRSIZE, size_t *outlen);
-+               unsigned char outbufMAX_ATTRSIZE, size_t *outlen,
-+               krb5_boolean *is_fips);
- 
- /* Decode an attribute. */
- krb5_error_code
-@@ -69,7 +77,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
- krb5_error_code
- kr_attrset_encode(const krad_attrset *set, const char *secret,
-                   const unsigned char *auth,
--                  unsigned char outbufMAX_ATTRSETSIZE, size_t *outlen);
-+                  unsigned char outbufMAX_ATTRSETSIZE, size_t *outlen,
-+                  krb5_boolean *is_fips);
- 
- /* Decode attributes from a buffer. */
- krb5_error_code
-diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
-index c597174b6..794ac84c4 100644
---- a/src/lib/krad/packet.c
-+++ b/src/lib/krad/packet.c
-@@ -32,6 +32,7 @@
- #include <string.h>
- 
- #include <arpa/inet.h>
-+#include <openssl/crypto.h>
- 
- typedef unsigned char uchar;
- 
-@@ -53,12 +54,6 @@ typedef unsigned char uchar;
- #define pkt_auth(p) ((uchar *)offset(&(p)->pkt, OFFSET_AUTH))
- #define pkt_attr(p) ((unsigned char *)offset(&(p)->pkt, OFFSET_ATTR))
- 
--struct krad_packet_st {
--    char bufferKRAD_PACKET_SIZE_MAX;
--    krad_attrset *attrset;
--    krb5_data pkt;
--};
--
- typedef struct {
-     uchar x(UCHAR_MAX + 1) / 8;
- } idmap;
-@@ -187,8 +182,13 @@ auth_generate_response(krb5_context ctx, const char *secret,
-     memcpy(data.data + response->pkt.length, secret, strlen(secret));
- 
-     /* Hash it. */
--    retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &data,
--                                  &hash);
-+    if (FIPS_mode()) {
-+        /* This checksum does very little security-wise anyway, so don't
-+         * taint. */
-+        hash.contents = calloc(1, AUTH_FIELD_SIZE);
-+    } else
-+        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &data,
-+                                      &hash);
-     free(data.data);
-     if (retval != 0)
-         return retval;
-@@ -276,7 +276,7 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
- 
-     /* Encode the attributes. */
-     retval = kr_attrset_encode(set, secret, pkt_auth(pkt), pkt_attr(pkt),
--                               &attrset_len);
-+                               &attrset_len, &pkt->is_fips);
-     if (retval != 0)
-         goto error;
- 
-@@ -314,7 +314,7 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
- 
-     /* Encode the attributes. */
-     retval = kr_attrset_encode(set, secret, pkt_auth(request), pkt_attr(pkt),
--                               &attrset_len);
-+                               &attrset_len, &pkt->is_fips);
-     if (retval != 0)
-         goto error;
- 
-@@ -451,6 +451,8 @@ krad_packet_decode_response(krb5_context ctx, const char *secret,
- const krb5_data *
- krad_packet_encode(const krad_packet *pkt)
- {
-+    if (pkt->is_fips)
-+        return NULL;
-     return &pkt->pkt;
- }
- 
-diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
-index 437f7e91a..0f90443ce 100644
---- a/src/lib/krad/remote.c
-+++ b/src/lib/krad/remote.c
-@@ -263,7 +263,7 @@ on_io_write(krad_remote *rr)
-     request *r;
- 
-     K5_TAILQ_FOREACH(r, &rr->list, list) {
--        tmp = krad_packet_encode(r->request);
-+        tmp = &r->request->pkt;
- 
-         /* If the packet has already been sent, do nothing. */
-         if (r->sent == tmp->length)
-@@ -359,7 +359,7 @@ on_io_read(krad_remote *rr)
-     if (req != NULL) {
-         K5_TAILQ_FOREACH(r, &rr->list, list) {
-             if (r->request == req &&
--                r->sent == krad_packet_encode(req)->length) {
-+                r->sent == req->pkt.length) {
-                 request_finish(r, 0, rsp);
-                 break;
-             }
-@@ -455,6 +455,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
-                                      (krad_packet_iter_cb)iterator, &r, &tmp);
-     if (retval != 0)
-         goto error;
-+    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL &&
-+        rr->info->ai_family != AF_UNIX) {
-+        /* This would expose cleartext passwords, so abort. */
-+        retval = ESOCKTNOSUPPORT;
-+        goto error;
-+    }
- 
-     K5_TAILQ_FOREACH(r, &rr->list, list) {
-         if (r->request == tmp) {
-diff --git a/src/lib/krad/t_attr.c b/src/lib/krad/t_attr.c
-index eb2a780c8..4d285ad9d 100644
---- a/src/lib/krad/t_attr.c
-+++ b/src/lib/krad/t_attr.c
-@@ -50,6 +50,7 @@ main()
-     const char *tmp;
-     krb5_data in;
-     size_t len;
-+    krb5_boolean is_fips = FALSE;
- 
-     noerror(krb5_init_context(&ctx));
- 
-@@ -73,7 +74,7 @@ main()
-     in = string2data((char *)decoded);
-     retval = kr_attr_encode(ctx, secret, auth,
-                             krad_attr_name2num("User-Password"),
--                            &in, outbuf, &len);
-+                            &in, outbuf, &len, &is_fips);
-     insist(retval == 0);
-     insist(len == sizeof(encoded));
-     insist(memcmp(outbuf, encoded, len) == 0);
-diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c
-index 7928335ca..0f9576253 100644
---- a/src/lib/krad/t_attrset.c
-+++ b/src/lib/krad/t_attrset.c
-@@ -49,6 +49,7 @@ main()
-     krb5_context ctx;
-     size_t len = 0, encode_len;
-     krb5_data tmp;
-+    krb5_boolean is_fips = FALSE;
- 
-     noerror(krb5_init_context(&ctx));
-     noerror(krad_attrset_new(ctx, &set));
-@@ -62,7 +63,8 @@ main()
-     noerror(krad_attrset_add(set, krad_attr_name2num("User-Password"), &tmp));
- 
-     /* Encode attrset. */
--    noerror(kr_attrset_encode(set, "foo", auth, buffer, &encode_len));
-+    noerror(kr_attrset_encode(set, "foo", auth, buffer, &encode_len,
-+                              &is_fips));
-     krad_attrset_free(set);
- 
-     /* Manually encode User-Name. */
-diff --git a/src/plugins/preauth/spake/spake_client.c b/src/plugins/preauth/spake/spake_client.c
-index 00734a13b..a3ce22b70 100644
---- a/src/plugins/preauth/spake/spake_client.c
-+++ b/src/plugins/preauth/spake/spake_client.c
-@@ -38,6 +38,8 @@
- #include "groups.h"
- #include <krb5/clpreauth_plugin.h>
- 
-+#include <openssl/crypto.h>
-+
- typedef struct reqstate_st {
-     krb5_pa_spake *msg;         /* set in prep_questions, used in process */
-     krb5_keyblock *initial_key;
-@@ -375,6 +377,10 @@ clpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
- 
-     if (maj_ver != 1)
-         return KRB5_PLUGIN_VER_NOTSUPP;
-+
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     vt = (krb5_clpreauth_vtable)vtable;
-     vt->name = "spake";
-     vt->pa_type_list = pa_types;
-diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c
-index 88c964ce1..c7df0392f 100644
---- a/src/plugins/preauth/spake/spake_kdc.c
-+++ b/src/plugins/preauth/spake/spake_kdc.c
-@@ -41,6 +41,8 @@
- 
- #include <krb5/kdcpreauth_plugin.h>
- 
-+#include <openssl/crypto.h>
-+
- /*
-  * The SPAKE kdcpreauth module uses a secure cookie containing the following
-  * concatenated fields (all integer fields are big-endian):
-@@ -571,6 +573,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
- 
-     if (maj_ver != 1)
-         return KRB5_PLUGIN_VER_NOTSUPP;
-+
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     vt = (krb5_kdcpreauth_vtable)vtable;
-     vt->name = "spake";
-     vt->pa_type_list = pa_types;

_service:tar_scm:Remove-3des-support.patch Changed

@@ -1,4 +1,4 @@
-From fef4e551d3d2dcb55e58cc182304254c36aa8949 Mon Sep 17 00:00:00 2001
+From 7b40250066bbcc529b5348b68199c58fbad82376 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 26 Mar 2019 18:51:10 -0400
 Subject: PATCH downstream Remove 3des support
@@ -8,7 +8,17 @@
 to user other enctypes.  Mark the 3DES enctypes UNSUPPORTED and retain
 their constants.
 
-Last-updated: 1.19-beta1
+Last-updated: 1.20-final
+antorres@redhat.com: remove diffs for:
+     - src/kdamin/testing/proto/kdc.conf.proto
+     - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
+     - src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
+     - src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
+ since they were removed by Remove-TCL-based-libkadm5-API-tests.patch
+jrische@redhat.com: restore supportedCMSTypes (not using 3DES any more):
+    - src/plugins/preauth/pkinit/pkinit_crypto.h
+    - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+    - src/plugins/preauth/pkinit/pkinit_clnt.c
 ---
  doc/admin/advanced/retiring-des.rst           |  11 +
  doc/admin/conf_files/kdc_conf.rst             |   7 +-
@@ -18,35 +28,34 @@
  doc/conf.py                                   |   2 +-
  doc/mitK5features.rst                         |   2 +-
  src/Makefile.in                               |   4 +-
- src/configure.ac                              |   1 -
+ src/configure.ac                              |   4 +-
  src/include/krb5/krb5.hin                     |  10 +-
- src/kadmin/testing/proto/kdc.conf.proto       |   4 +-
  src/kdc/kdc_util.c                            |   4 -
  src/lib/crypto/Makefile.in                    |   8 +-
  src/lib/crypto/builtin/Makefile.in            |   6 +-
  src/lib/crypto/builtin/des/ISSUES             |  13 -
- src/lib/crypto/builtin/des/Makefile.in        |  80 ----
- src/lib/crypto/builtin/des/d3_aead.c          | 133 ------
- src/lib/crypto/builtin/des/d3_kysched.c       |  51 ---
- src/lib/crypto/builtin/des/deps               | 150 -------
+ src/lib/crypto/builtin/des/Makefile.in        |  82 ----
+ src/lib/crypto/builtin/des/d3_aead.c          | 137 ------
+ src/lib/crypto/builtin/des/d3_kysched.c       |  55 ---
+ src/lib/crypto/builtin/des/deps               | 146 -------
  src/lib/crypto/builtin/des/des_int.h          | 285 -------------
- src/lib/crypto/builtin/des/des_keys.c         |  40 --
+ src/lib/crypto/builtin/des/des_keys.c         |  38 --
  src/lib/crypto/builtin/des/destest.c          | 240 -----------
  src/lib/crypto/builtin/des/doc/libdes.doc     | 208 ---------
- src/lib/crypto/builtin/des/f_aead.c           | 173 --------
+ src/lib/crypto/builtin/des/f_aead.c           | 177 --------
  src/lib/crypto/builtin/des/f_cbc.c            | 256 ------------
- src/lib/crypto/builtin/des/f_cksum.c          | 136 ------
- src/lib/crypto/builtin/des/f_parity.c         |  56 ---
- src/lib/crypto/builtin/des/f_sched.c          | 359 ----------------
- src/lib/crypto/builtin/des/f_tables.c         | 370 ----------------
+ src/lib/crypto/builtin/des/f_cksum.c          | 141 -------
+ src/lib/crypto/builtin/des/f_parity.c         |  64 ---
+ src/lib/crypto/builtin/des/f_sched.c          | 363 ----------------
+ src/lib/crypto/builtin/des/f_tables.c         | 375 -----------------
  src/lib/crypto/builtin/des/f_tables.h         | 285 -------------
- src/lib/crypto/builtin/des/key_sched.c        |  62 ---
+ src/lib/crypto/builtin/des/key_sched.c        |  66 ---
  src/lib/crypto/builtin/des/keytest.data       | 171 --------
  src/lib/crypto/builtin/des/t_verify.c         | 395 ------------------
- src/lib/crypto/builtin/des/weak_key.c         |  86 ----
- .../crypto/builtin/enc_provider/Makefile.in   |   6 +-
- src/lib/crypto/builtin/enc_provider/deps      |  13 -
- src/lib/crypto/builtin/enc_provider/des3.c    | 105 -----
+ src/lib/crypto/builtin/des/weak_key.c         |  90 ----
+ .../crypto/builtin/enc_provider/Makefile.in   |   5 +-
+ src/lib/crypto/builtin/enc_provider/deps      |  11 -
+ src/lib/crypto/builtin/enc_provider/des3.c    | 109 -----
  src/lib/crypto/crypto_tests/t_cf2.expected    |   1 -
  src/lib/crypto/crypto_tests/t_cf2.in          |   5 -
  src/lib/crypto/crypto_tests/t_cksums.c        |  10 -
@@ -55,45 +64,40 @@
  src/lib/crypto/crypto_tests/t_encrypt.c       |   1 -
  src/lib/crypto/crypto_tests/t_short.c         |   1 -
  src/lib/crypto/crypto_tests/t_str2key.c       |  52 ---
+ src/lib/crypto/crypto_tests/vectors.c         |   4 -
  src/lib/crypto/krb/Makefile.in                |   3 -
  src/lib/crypto/krb/cksumtypes.c               |   6 -
- src/lib/crypto/krb/crypto_int.h               |  16 -
+ src/lib/crypto/krb/crypto_int.h               |  11 -
  src/lib/crypto/krb/default_state.c            |  10 -
  src/lib/crypto/krb/enctype_util.c             |   3 +
  src/lib/crypto/krb/etypes.c                   |  21 -
  src/lib/crypto/krb/prf_des.c                  |  47 ---
- src/lib/crypto/krb/random_to_key.c            |  45 --
+ src/lib/crypto/krb/random_to_key.c            |  28 --
  src/lib/crypto/libk5crypto.exports            |   1 -
  src/lib/crypto/openssl/Makefile.in            |   8 +-
  src/lib/crypto/openssl/des/Makefile.in        |  20 -
- src/lib/crypto/openssl/des/deps               |  15 -
- src/lib/crypto/openssl/des/des_keys.c         |  40 --
+ src/lib/crypto/openssl/des/deps               |  14 -
+ src/lib/crypto/openssl/des/des_keys.c         |  39 --
  .../crypto/openssl/enc_provider/Makefile.in   |   3 -
  src/lib/crypto/openssl/enc_provider/deps      |  11 -
- src/lib/crypto/openssl/enc_provider/des3.c    | 184 --------
+ src/lib/crypto/openssl/enc_provider/des3.c    | 188 ---------
+ src/lib/crypto/openssl/kdf.c                  |   2 -
  src/lib/gssapi/krb5/accept_sec_context.c      |   1 -
  src/lib/gssapi/krb5/gssapiP_krb5.h            |   6 +-
  src/lib/gssapi/krb5/k5seal.c                  |  35 +-
  src/lib/gssapi/krb5/k5sealiov.c               |  27 +-
- src/lib/gssapi/krb5/k5unseal.c                | 102 ++---
+ src/lib/gssapi/krb5/k5unseal.c                |  88 ++--
  src/lib/gssapi/krb5/k5unsealiov.c             |  38 +-
  src/lib/gssapi/krb5/util_crypt.c              |  11 -
- .../api.current/chpass-principal-v2.exp       |   4 +-
- .../api.current/get-principal-v2.exp          |   4 +-
- .../api.current/randkey-principal-v2.exp      |   4 +-
  src/lib/krb5/krb/init_ctx.c                   |   3 -
  src/lib/krb5/krb/s4u_creds.c                  |   2 -
  src/lib/krb5/krb/t_etypes.c                   |  48 +--
  src/lib/krb5/os/t_trace.c                     |   4 +-
  src/lib/krb5/os/t_trace.ref                   |   2 +-
  src/plugins/preauth/pkinit/pkcs11.h           |   6 +-
- src/plugins/preauth/pkinit/pkinit_clnt.c      |   8 -
- src/plugins/preauth/pkinit/pkinit_crypto.h    |  12 -
- .../preauth/pkinit/pkinit_crypto_openssl.c    |  38 --
- src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  31 --
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  10 +-
+ src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  30 --
  src/plugins/preauth/spake/t_vectors.c         |  25 --
- src/tests/dejagnu/config/default.exp          |  78 ----
- src/tests/dejagnu/krb-standalone/kprop.exp    |   2 +-
  src/tests/gssapi/t_enctypes.py                |  33 +-
  src/tests/gssapi/t_invalid.c                  |  12 -
  src/tests/gssapi/t_pcontok.c                  |  16 +-
@@ -105,7 +109,7 @@
  src/tests/t_salt.py                           |   5 +-
  src/util/k5test.py                            |   7 -
  .../leash/htmlhelp/html/Encryption_Types.htm  |  13 -
- 95 files changed, 160 insertions(+), 4835 deletions(-)
+ 89 files changed, 151 insertions(+), 4713 deletions(-)
  delete mode 100644 src/lib/crypto/builtin/des/ISSUES
  delete mode 100644 src/lib/crypto/builtin/des/Makefile.in
  delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c
@@ -134,7 +138,7 @@
  delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c
 
 diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst
-index 38f76d3f4..d5e3c30c0 100644
+index 38f76d3f45..d5e3c30c04 100644
 --- a/doc/admin/advanced/retiring-des.rst
 +++ b/doc/admin/advanced/retiring-des.rst
 @@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit
@@ -163,10 +167,10 @@
  -------------
  
 diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
-index 1dc958d62..3a72aabef 100644
+index 74a0a2acef..846c58ed82 100644
 --- a/doc/admin/conf_files/kdc_conf.rst
 +++ b/doc/admin/conf_files/kdc_conf.rst
-@@ -848,8 +848,6 @@ Encryption types marked as "weak" and "deprecated" are available for
+@@ -854,8 +854,6 @@ Encryption types marked as "weak" and "deprecated" are available for
  compatibility but not recommended for use.
  
  ==================================================== =========================================================
@@ -175,7 +179,7 @@
  aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1       AES-256 CTS mode with 96-bit SHA-1 HMAC
  aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1       AES-128 CTS mode with 96-bit SHA-1 HMAC
  aes256-cts-hmac-sha384-192 aes256-sha2               AES-256 CTS mode with 192-bit SHA-384 HMAC
-@@ -858,7 +856,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5 (deprecat
+@@ -864,7 +862,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5 (deprecat
  arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp   Exportable RC4 with HMAC/MD5 (weak)
  camellia256-cts-cmac camellia256-cts                 Camellia-256 CTS mode with CMAC
  camellia128-cts-cmac camellia128-cts                 Camellia-128 CTS mode with CMAC
@@ -183,7 +187,7 @@
  aes                                                  The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128
  rc4                                                  The RC4 family: arcfour-hmac
  camellia                                             The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac
-@@ -870,8 +867,8 @@ from the current list by prefixing them with a minus sign ("-").
+@@ -876,8 +873,8 @@ from the current list by prefixing them with a minus sign ("-").
  Types or families can be prefixed with a plus sign ("+") for symmetry;
  it has the same meaning as just listing the type or family.  For
  example, "``DEFAULT -rc4``" would be the default set of encryption
@@ -195,7 +199,7 @@
  
  While **aes128-cts** and **aes256-cts** are supported for all Kerberos
 diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
-index 047185afb..b08d954d9 100644
+index 694922c0d9..c4d5499d3b 100644
 --- a/doc/admin/enctypes.rst
 +++ b/doc/admin/enctypes.rst
 @@ -129,7 +129,7 @@ enctype                    weak?      krb5     Windows
@@ -223,7 +227,7 @@
  
  Migrating away from older encryption types
 diff --git a/doc/admin/troubleshoot.rst b/doc/admin/troubleshoot.rst
-index ade5e1f87..e4dc54f7e 100644
+index ade5e1f87a..e4dc54f7e5 100644
 --- a/doc/admin/troubleshoot.rst
 +++ b/doc/admin/troubleshoot.rst
 @@ -73,11 +73,10 @@ credential verification failed: KDC has no support for encryption type
@@ -243,7 +247,7 @@
  
  .. _err_cert_chain_cert_expired:
 diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst
-index cebb6644c..4d51e795c 100644
+index a0d4f26701..5f34dea5e8 100644
 --- a/doc/appdev/refs/macros/index.rst
 +++ b/doc/appdev/refs/macros/index.rst
 @@ -36,7 +36,6 @@ Public
@@ -255,10 +259,10 @@
     CKSUMTYPE_NIST_SHA.rst
     CKSUMTYPE_RSA_MD4.rst
 diff --git a/doc/conf.py b/doc/conf.py
-index 543202bf4..4fb6aae14 100644
+index fa0eb80f1f..12168fa695 100644
 --- a/doc/conf.py
 +++ b/doc/conf.py
-@@ -271,7 +271,7 @@ else:
+@@ -278,7 +278,7 @@ else:
      rst_epilog += '''
  .. |krb5conf| replace:: ``/etc/krb5.conf``
  .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal``
@@ -268,7 +272,7 @@
  .. |copy| unicode:: U+000A9
  '''
 diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst
-index 4954bb3aa..92ce2a772 100644
+index ca2d6ef117..100c64a1c1 100644
 --- a/doc/mitK5features.rst
 +++ b/doc/mitK5features.rst
 @@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB
@@ -281,7 +285,7 @@
  Interoperability
  ----------------
 diff --git a/src/Makefile.in b/src/Makefile.in
-index 7d2507ef8..c16715ac7 100644
+index 8f14e9bf2c..ba3bb18eec 100644
 --- a/src/Makefile.in
 +++ b/src/Makefile.in
 @@ -130,7 +130,7 @@ WINMAKEFILES=Makefile \
@@ -303,19 +307,26 @@
  ##DOS##	$(WCONFIG) config < $@.in > $@
  ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP)
 diff --git a/src/configure.ac b/src/configure.ac
-index dd2cad3ee..3e1052db7 100644
+index 40545f2bfc..8dc864718d 100644
 --- a/src/configure.ac
 +++ b/src/configure.ac
-@@ -1480,7 +1480,6 @@ V5_AC_OUTPUT_MAKEFILE(.
- 	lib/crypto lib/crypto/krb lib/crypto/$CRYPTO_IMPL
- 	lib/crypto/$CRYPTO_IMPL/enc_provider
- 	lib/crypto/$CRYPTO_IMPL/hash_provider
--	lib/crypto/$CRYPTO_IMPL/des
- 	lib/crypto/$CRYPTO_IMPL/md4 lib/crypto/$CRYPTO_IMPL/md5
-         lib/crypto/$CRYPTO_IMPL/sha1 lib/crypto/$CRYPTO_IMPL/sha2
- 	lib/crypto/$CRYPTO_IMPL/aes lib/crypto/$CRYPTO_IMPL/camellia
+@@ -1489,12 +1489,12 @@ V5_AC_OUTPUT_MAKEFILE(.
+ 	lib lib/kdb
+ 
+ 	lib/crypto lib/crypto/krb lib/crypto/crypto_tests
+-	lib/crypto/builtin lib/crypto/builtin/des
++	lib/crypto/builtin
+ 	lib/crypto/builtin/aes lib/crypto/builtin/camellia
+ 	lib/crypto/builtin/md4 lib/crypto/builtin/md5
+ 	lib/crypto/builtin/sha1 lib/crypto/builtin/sha2
+ 	lib/crypto/builtin/enc_provider lib/crypto/builtin/hash_provider
+-	lib/crypto/openssl lib/crypto/openssl/des
++	lib/crypto/openssl
+ 	lib/crypto/openssl/enc_provider lib/crypto/openssl/hash_provider
+ 
+ 	lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index db80063eb..63e67a2ba 100644
+index 7e1dea2cbf..fb9f2a366c 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
 @@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov {
@@ -341,33 +352,20 @@
  #define ENCTYPE_AES128_CTS_HMAC_SHA1_96     0x0011 /**< RFC 3962 */
  #define ENCTYPE_AES256_CTS_HMAC_SHA1_96     0x0012 /**< RFC 3962 */
  #define ENCTYPE_AES128_CTS_HMAC_SHA256_128  0x0013 /**< RFC 8009 */
-@@ -458,7 +458,7 @@ typedef struct _krb5_crypto_iov {
+@@ -463,7 +463,7 @@ typedef struct _krb5_crypto_iov {
  #define CKSUMTYPE_RSA_MD5       0x0007
  #define CKSUMTYPE_RSA_MD5_DES   0x0008
  #define CKSUMTYPE_NIST_SHA      0x0009
 -#define CKSUMTYPE_HMAC_SHA1_DES3      0x000c
 +#define CKSUMTYPE_HMAC_SHA1_DES3      0x000c /* @deprecated removed */
+ #define CKSUMTYPE_SHA1          0x000e /**< RFC 3961 */
  #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with
                                                  ENCTYPE_AES128_CTS_HMAC_SHA1_96 */
- #define CKSUMTYPE_HMAC_SHA1_96_AES256 0x0010 /**< RFC 3962. Used with
-diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto
-index 8a4b87de1..d7f1d076b 100644
---- a/src/kadmin/testing/proto/kdc.conf.proto
-+++ b/src/kadmin/testing/proto/kdc.conf.proto
-@@ -11,6 +11,6 @@
- 		dict_file = __K5ROOT__/ovsec_adm.dict
- 		kadmind_port = 1751
- 		kpasswd_port = 1752
--		master_key_type = des3-hmac-sha1
--		supported_enctypes = des3-hmac-sha1:normal aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal
-+		master_key_type = aes256-cts
-+		supported_enctypes = aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal
- 	}
 diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index 60f30c4f4..c65375aef 100644
+index 9f2a67d189..b7a9aa4992 100644
 --- a/src/kdc/kdc_util.c
 +++ b/src/kdc/kdc_util.c
-@@ -1017,8 +1017,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
+@@ -1111,8 +1111,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
          name = "rsaEncryption-EnvOID";
      else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV)
          name = "id-RSAES-OAEP-EnvOID";
@@ -376,7 +374,7 @@
      else
          return krb5_enctype_to_name(ktype, FALSE, buf, buflen);
  
-@@ -1605,8 +1603,6 @@ krb5_boolean
+@@ -1704,8 +1702,6 @@ krb5_boolean
  enctype_requires_etype_info_2(krb5_enctype enctype)
  {
      switch(enctype) {
@@ -386,28 +384,25 @@
      case ENCTYPE_ARCFOUR_HMAC_EXP :
          return 0;
 diff --git a/src/lib/crypto/Makefile.in b/src/lib/crypto/Makefile.in
-index c3fcfd7e8..890d54adf 100644
+index 10e8c74cf8..25c4f40cc3 100644
 --- a/src/lib/crypto/Makefile.in
 +++ b/src/lib/crypto/Makefile.in
-@@ -13,7 +13,7 @@ STOBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST				\
- 	$(CRYPTO_IMPL)/hash_provider/OBJS.ST				\
- 	$(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST		\
- 	$(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST		\
--	$(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST		\
-+	$(CRYPTO_IMPL)/aes/OBJS.ST					\
- 	$(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST			\
- 	$(CRYPTO_IMPL)/OBJS.ST
- 
-@@ -21,7 +21,7 @@ SUBDIROBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST			\
- 	$(CRYPTO_IMPL)/hash_provider/OBJS.ST				\
- 	$(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST		\
- 	$(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST		\
--	$(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST		\
-+	$(CRYPTO_IMPL)/aes/OBJS.ST					\
- 	$(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST			\
- 	$(CRYPTO_IMPL)/OBJS.ST
+@@ -10,12 +10,12 @@ LIBMINOR=1
+ RELDIR=crypto
+ 
+ STOBJLISTS=krb/OBJS.ST						\
+-	builtin/OBJS.ST builtin/des/OBJS.ST			\
++	builtin/OBJS.ST						\
+ 	builtin/aes/OBJS.ST builtin/camellia/OBJS.ST		\
+ 	builtin/md4/OBJS.ST builtin/md5/OBJS.ST			\
+ 	builtin/sha1/OBJS.ST builtin/sha2/OBJS.ST		\
+ 	builtin/enc_provider/OBJS.ST builtin/hash_provider/OBJS.ST \
+-	openssl/OBJS.ST openssl/des/OBJS.ST			\
++	openssl/OBJS.ST						\
+ 	openssl/enc_provider/OBJS.ST openssl/hash_provider/OBJS.ST
  
-@@ -34,8 +34,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB)
+ SUBDIROBJLISTS=$(STOBJLISTS)
+@@ -28,8 +28,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB)
  SHLIB_LDFLAGS= $(LDFLAGS) @SHLIB_RPATH_DIRS@
  
  ##DOS##LIBNAME=$(OUTPRE)crypto.lib
@@ -419,7 +414,7 @@
  all-unix: all-liblinks
  install-unix: install-libs
 diff --git a/src/lib/crypto/builtin/Makefile.in b/src/lib/crypto/builtin/Makefile.in
-index baf5d974f..82adf1dec 100644
+index daf19da195..c9e967c807 100644
 --- a/src/lib/crypto/builtin/Makefile.in
 +++ b/src/lib/crypto/builtin/Makefile.in
 @@ -1,6 +1,6 @@
@@ -427,11 +422,11 @@
  BUILDTOP=$(REL)..$(S)..$(S)..
 -SUBDIRS=camellia des aes md4 md5 sha1 sha2 enc_provider hash_provider
 +SUBDIRS=camellia aes md4 md5 sha1 sha2 enc_provider hash_provider
- LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir)
+ LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS)
  
  ##DOS##BUILDTOP = ..\..\..
-@@ -22,7 +22,7 @@ SRCS=\
- 	$(srcdir)/init.c	\
+@@ -25,7 +25,7 @@ SRCS=\
+ 	$(srcdir)/kdf.c		\
  	$(srcdir)/pbkdf2.c	
  
 -STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
@@ -439,7 +434,7 @@
  	md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST	\
  	enc_provider/OBJS.ST 		\
  	hash_provider/OBJS.ST 		\
-@@ -30,7 +30,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
+@@ -33,7 +33,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
  	camellia/OBJS.ST 		\
  	OBJS.ST
  
@@ -450,7 +445,7 @@
  		hash_provider/OBJS.ST 		\
 diff --git a/src/lib/crypto/builtin/des/ISSUES b/src/lib/crypto/builtin/des/ISSUES
 deleted file mode 100644
-index 157891103..000000000
+index 1578911033..0000000000
 --- a/src/lib/crypto/builtin/des/ISSUES
 +++ /dev/null
 @@ -1,13 +0,0 @@
@@ -469,13 +464,13 @@
 -const?
 diff --git a/src/lib/crypto/builtin/des/Makefile.in b/src/lib/crypto/builtin/des/Makefile.in
 deleted file mode 100644
-index 54b329d0f..000000000
+index 397ac87ed4..0000000000
 --- a/src/lib/crypto/builtin/des/Makefile.in
 +++ /dev/null
-@@ -1,80 +0,0 @@
+@@ -1,82 +0,0 @@
 -mydir=lib$(S)crypto$(S)builtin$(S)des
 -BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
--LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)/../../krb
+-LOCALINCLUDES=-I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
 -
 -##DOS##BUILDTOP = ..\..\..\..
 -##DOS##PREFIXDIR = builtin\des
@@ -533,7 +528,9 @@
 -
 -all-unix: all-libobjs
 -
--check-unix: verify destest
+-check-unix: check-unix-@CRYPTO_BUILTIN_TESTS@
+-check-unix-no:
+-check-unix-yes: verify destest
 -	$(RUN_TEST) ./verify -z
 -	$(RUN_TEST) ./verify -m
 -	$(RUN_TEST) ./verify
@@ -555,10 +552,10 @@
 -
 diff --git a/src/lib/crypto/builtin/des/d3_aead.c b/src/lib/crypto/builtin/des/d3_aead.c
 deleted file mode 100644
-index bddf75a47..000000000
+index fb83f73b43..0000000000
 --- a/src/lib/crypto/builtin/des/d3_aead.c
 +++ /dev/null
-@@ -1,133 +0,0 @@
+@@ -1,137 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright (C) 2008 by the Massachusetts Institute of Technology.
@@ -587,6 +584,8 @@
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -void
 -krb5int_des3_cbc_encrypt(krb5_crypto_iov *data, unsigned long num_data,
 -                         const mit_des_key_schedule ks1,
@@ -692,12 +691,14 @@
 -        store_32_be(ocipherr, ivec + 4);
 -    }
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/d3_kysched.c b/src/lib/crypto/builtin/des/d3_kysched.c
 deleted file mode 100644
-index ebd1050b1..000000000
+index 55fb9449b5..0000000000
 --- a/src/lib/crypto/builtin/des/d3_kysched.c
 +++ /dev/null
-@@ -1,51 +0,0 @@
+@@ -1,55 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright 1995 by Richard P. Basch.  All Rights Reserved.
@@ -721,9 +722,11 @@
 - * express or implied warranty.
 - */
 -
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -int
 -mit_des3_key_sched(mit_des3_cblock k, mit_des3_key_schedule schedule)
 -{
@@ -749,20 +752,20 @@
 -    /* if key was good, return 0 */
 -    return 0;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/deps b/src/lib/crypto/builtin/des/deps
 deleted file mode 100644
-index a1db1f36e..000000000
+index 1c1239d696..0000000000
 --- a/src/lib/crypto/builtin/des/deps
 +++ /dev/null
-@@ -1,150 +0,0 @@
+@@ -1,146 +0,0 @@
 -#
 -# Generated makefile dependencies follow.
 -#
 -d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
--  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
 -  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
 -  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
 -  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -774,20 +777,18 @@
 -d3_kysched.so d3_kysched.po $(OUTPRE)d3_kysched.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  d3_kysched.c des_int.h
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h d3_kysched.c des_int.h
 -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
--  $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \
--  $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
 -  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
 -  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
 -  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -798,8 +799,6 @@
 -f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
--  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
 -  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
 -  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
 -  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -810,69 +809,71 @@
 -  des_int.h f_aead.c f_tables.h
 -f_cksum.so f_cksum.po $(OUTPRE)f_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des_int.h f_cksum.c \
--  f_tables.h
--f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
 -  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
 -  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
 -  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
 -  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
 -  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
 -  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h f_parity.c
--f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
+-  des_int.h f_cksum.c f_tables.h
+-f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \
+-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
 -  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
 -  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
 -  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
 -  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
 -  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
 -  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des_int.h f_sched.c
--f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h f_parity.c
+-f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
 -  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
 -  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
 -  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
 -  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
 -  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
 -  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h f_tables.c f_tables.h
+-  des_int.h f_sched.c
+-f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \
+-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h f_tables.c \
+-  f_tables.h
 -key_sched.so key_sched.po $(OUTPRE)key_sched.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h key_sched.c
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h key_sched.c
 -weak_key.so weak_key.po $(OUTPRE)weak_key.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h weak_key.c
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h weak_key.c
 -destest.so destest.po $(OUTPRE)destest.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
@@ -907,7 +908,7 @@
 -  des_int.h t_verify.c
 diff --git a/src/lib/crypto/builtin/des/des_int.h b/src/lib/crypto/builtin/des/des_int.h
 deleted file mode 100644
-index f8dc6b296..000000000
+index f8dc6b296a..0000000000
 --- a/src/lib/crypto/builtin/des/des_int.h
 +++ /dev/null
 @@ -1,285 +0,0 @@
@@ -1198,10 +1199,10 @@
 -#endif  /*DES_INTERNAL_DEFS*/
 diff --git a/src/lib/crypto/builtin/des/des_keys.c b/src/lib/crypto/builtin/des/des_keys.c
 deleted file mode 100644
-index 32b119aad..000000000
+index 027b09d728..0000000000
 --- a/src/lib/crypto/builtin/des/des_keys.c
 +++ /dev/null
-@@ -1,40 +0,0 @@
+@@ -1,38 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/des_keys.c - Key functions used by Kerberos code */
 -/*
@@ -1231,20 +1232,18 @@
 -#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES_KEY_PARITY
+-
 -void
 -k5_des_fixup_key_parity(unsigned char *keybits)
 -{
 -    mit_des_fixup_key_parity(keybits);
 -}
 -
--krb5_boolean
--k5_des_is_weak_key(unsigned char *keybits)
--{
--    return mit_des_is_weak_key(keybits);
--}
+-#endif /* K5_BUILTIN_DES_KEY_PARITY */
 diff --git a/src/lib/crypto/builtin/des/destest.c b/src/lib/crypto/builtin/des/destest.c
 deleted file mode 100644
-index 52114304e..000000000
+index 52114304e3..0000000000
 --- a/src/lib/crypto/builtin/des/destest.c
 +++ /dev/null
 @@ -1,240 +0,0 @@
@@ -1490,7 +1489,7 @@
 -}
 diff --git a/src/lib/crypto/builtin/des/doc/libdes.doc b/src/lib/crypto/builtin/des/doc/libdes.doc
 deleted file mode 100644
-index 6e9431ed2..000000000
+index 6e9431ed2e..0000000000
 --- a/src/lib/crypto/builtin/des/doc/libdes.doc
 +++ /dev/null
 @@ -1,208 +0,0 @@
@@ -1704,10 +1703,10 @@
 -string length desired.
 diff --git a/src/lib/crypto/builtin/des/f_aead.c b/src/lib/crypto/builtin/des/f_aead.c
 deleted file mode 100644
-index 71b8dff4d..000000000
+index f887735820..0000000000
 --- a/src/lib/crypto/builtin/des/f_aead.c
 +++ /dev/null
-@@ -1,173 +0,0 @@
+@@ -1,177 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright (C) 2008 by the Massachusetts Institute of Technology.
@@ -1736,6 +1735,8 @@
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -const mit_des_cblock mit_des_zeroblock /* = all zero */;
 -
 -void
@@ -1881,9 +1882,11 @@
 -    DES_DO_DECRYPT_1 (*left, *right, kp);
 -}
 -#endif
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_cbc.c b/src/lib/crypto/builtin/des/f_cbc.c
 deleted file mode 100644
-index 84d5382f2..000000000
+index 84d5382f22..0000000000
 --- a/src/lib/crypto/builtin/des/f_cbc.c
 +++ /dev/null
 @@ -1,256 +0,0 @@
@@ -2145,10 +2148,10 @@
 -}
 diff --git a/src/lib/crypto/builtin/des/f_cksum.c b/src/lib/crypto/builtin/des/f_cksum.c
 deleted file mode 100644
-index cb482b009..000000000
+index 615a947f4a..0000000000
 --- a/src/lib/crypto/builtin/des/f_cksum.c
 +++ /dev/null
-@@ -1,136 +0,0 @@
+@@ -1,141 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/f_cksum.c */
 -/*
@@ -2180,9 +2183,12 @@
 -/*
 - * des_cbc_cksum.c - compute an 8 byte checksum using DES in CBC mode
 - */
+-#include "crypto_int.h"
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * This routine performs DES cipher-block-chaining checksum operation,
 - * a.k.a.  Message Authentication Code.  It ALWAYS encrypts from input
@@ -2285,12 +2291,14 @@
 -     */
 -    return right & 0xFFFFFFFFUL;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_parity.c b/src/lib/crypto/builtin/des/f_parity.c
 deleted file mode 100644
-index 460b5061b..000000000
+index a658878f6f..0000000000
 --- a/src/lib/crypto/builtin/des/f_parity.c
 +++ /dev/null
-@@ -1,56 +0,0 @@
+@@ -1,64 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * These routines check and fix parity of encryption keys for the DES
@@ -2302,9 +2310,11 @@
 - * Mark Eichin -- Cygnus Support
 - */
 -
--
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES_KEY_PARITY
+-
 -/*
 - * des_fixup_key_parity: Forces odd parity per byte; parity is bits
 - *                       8,16,...64 in des order, implies 0, 8, 16, ...
@@ -2327,6 +2337,10 @@
 -    return;
 -}
 -
+-#endif /* K5_BUILTIN_DES_KEY_PARITY */
+-
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * des_check_key_parity: returns true iff key has the correct des parity.
 - *                       See des_fix_key_parity for the definition of
@@ -2347,12 +2361,14 @@
 -
 -    return(1);
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_sched.c b/src/lib/crypto/builtin/des/f_sched.c
 deleted file mode 100644
-index 666a510fb..000000000
+index bbc88a1c8d..0000000000
 --- a/src/lib/crypto/builtin/des/f_sched.c
 +++ /dev/null
-@@ -1,359 +0,0 @@
+@@ -1,363 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/f_sched.c */
 -/*
@@ -2384,9 +2400,11 @@
 -/*
 - * des_make_sched.c - permute a DES key, returning the resulting key schedule
 - */
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * Permuted choice 1 tables.  These are used to extract bits
 - * from the left and right parts of the key to form Ci and Di.
@@ -2712,12 +2730,14 @@
 -    }
 -    return (0);
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_tables.c b/src/lib/crypto/builtin/des/f_tables.c
 deleted file mode 100644
-index 6308cb0d5..000000000
+index e50ab1fc60..0000000000
 --- a/src/lib/crypto/builtin/des/f_tables.c
 +++ /dev/null
-@@ -1,370 +0,0 @@
+@@ -1,375 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/f_tables.c */
 -/*
@@ -2754,9 +2774,12 @@
 - * Include the header file so something will complain if the
 - * declarations get out of sync
 - */
+-#include "crypto_int.h"
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * These tables may be declared const if you want.  Many compilers
 - * don't support this, though.
@@ -3088,9 +3111,11 @@
 -        0x40000000, 0x40080010, 0x40084010, 0x00084000
 -    },
 -};
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_tables.h b/src/lib/crypto/builtin/des/f_tables.h
 deleted file mode 100644
-index fc91b566c..000000000
+index fc91b566cf..0000000000
 --- a/src/lib/crypto/builtin/des/f_tables.h
 +++ /dev/null
 @@ -1,285 +0,0 @@
@@ -3381,10 +3406,10 @@
 -#endif  /* __DES_TABLES_H__ */
 diff --git a/src/lib/crypto/builtin/des/key_sched.c b/src/lib/crypto/builtin/des/key_sched.c
 deleted file mode 100644
-index 87f02b6a9..000000000
+index d6dedd93c6..0000000000
 --- a/src/lib/crypto/builtin/des/key_sched.c
 +++ /dev/null
-@@ -1,62 +0,0 @@
+@@ -1,66 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/key_sched.c */
 -/*
@@ -3430,9 +3455,11 @@
 - * Originally written 6/85 by Steve Miller, MIT Project Athena.
 - */
 -
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -int
 -mit_des_key_sched(mit_des_cblock k, mit_des_key_schedule schedule)
 -{
@@ -3447,9 +3474,11 @@
 -    /* if key was good, return 0 */
 -    return 0;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/keytest.data b/src/lib/crypto/builtin/des/keytest.data
 deleted file mode 100644
-index 7ff34eedc..000000000
+index 7ff34eedcf..0000000000
 --- a/src/lib/crypto/builtin/des/keytest.data
 +++ /dev/null
 @@ -1,171 +0,0 @@
@@ -3626,7 +3655,7 @@
 -1C587F1C13924FEF 305532286D6F295A 63FAC0D034D9F793
 diff --git a/src/lib/crypto/builtin/des/t_verify.c b/src/lib/crypto/builtin/des/t_verify.c
 deleted file mode 100644
-index 4a19933ca..000000000
+index 4a19933cad..0000000000
 --- a/src/lib/crypto/builtin/des/t_verify.c
 +++ /dev/null
 @@ -1,395 +0,0 @@
@@ -4027,10 +4056,10 @@
 -}
 diff --git a/src/lib/crypto/builtin/des/weak_key.c b/src/lib/crypto/builtin/des/weak_key.c
 deleted file mode 100644
-index eb41b267d..000000000
+index f8304a3638..0000000000
 --- a/src/lib/crypto/builtin/des/weak_key.c
 +++ /dev/null
-@@ -1,86 +0,0 @@
+@@ -1,90 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/weak_key.c */
 -/*
@@ -4066,9 +4095,11 @@
 - * Originally written 8/85 by Steve Miller, MIT Project Athena.
 - */
 -
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * The following are the weak DES keys:
 - */
@@ -4117,20 +4148,21 @@
 -
 -    return 0;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/enc_provider/Makefile.in b/src/lib/crypto/builtin/enc_provider/Makefile.in
-index 3459e1d0e..af6276b96 100644
+index 6ad7cbd4e0..655966b255 100644
 --- a/src/lib/crypto/builtin/enc_provider/Makefile.in
 +++ b/src/lib/crypto/builtin/enc_provider/Makefile.in
-@@ -1,7 +1,6 @@
+@@ -1,6 +1,6 @@
  mydir=lib$(S)crypto$(S)builtin$(S)enc_provider
  BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
--LOCALINCLUDES = -I$(srcdir)/../des 	\
--		-I$(srcdir)/../aes 	\
-+LOCALINCLUDES = -I$(srcdir)/../aes 	\
- 		-I$(srcdir)/../camellia \
- 		-I$(srcdir)/../../krb 	\
- 		-I$(srcdir)/..
-@@ -11,19 +10,16 @@ LOCALINCLUDES = -I$(srcdir)/../des 	\
+-LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \
++LOCALINCLUDES = -I$(srcdir)/../aes -I$(srcdir)/../camellia \
+ 		-I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
+ 
+ ##DOS##BUILDTOP = ..\..\..\..
+@@ -8,19 +8,16 @@ LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \
  ##DOS##OBJFILE = ..\..\$(OUTPRE)enc_provider.lst
  
  STLIBOBJS= \
@@ -4151,19 +4183,17 @@
  	$(srcdir)/camellia.c	\
  	$(srcdir)/rc4.c
 diff --git a/src/lib/crypto/builtin/enc_provider/deps b/src/lib/crypto/builtin/enc_provider/deps
-index ea4ffecd8..061289a91 100644
+index a3414a38ec..dc29d9fce8 100644
 --- a/src/lib/crypto/builtin/enc_provider/deps
 +++ b/src/lib/crypto/builtin/enc_provider/deps
-@@ -1,19 +1,6 @@
+@@ -1,17 +1,6 @@
  #
  # Generated makefile dependencies follow.
  #
 -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
--  $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \
--  $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+-  $(srcdir)/../des/des_int.h $(top_srcdir)/include/k5-buf.h \
 -  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
 -  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
 -  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -4176,10 +4206,10 @@
    $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
 diff --git a/src/lib/crypto/builtin/enc_provider/des3.c b/src/lib/crypto/builtin/enc_provider/des3.c
 deleted file mode 100644
-index 9b8244223..000000000
+index c2634d5e10..0000000000
 --- a/src/lib/crypto/builtin/enc_provider/des3.c
 +++ /dev/null
-@@ -1,105 +0,0 @@
+@@ -1,109 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright (C) 1998 by the FundsXpress, INC.
@@ -4210,6 +4240,8 @@
 -#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -static krb5_error_code
 -validate_and_schedule(krb5_key key, const krb5_data *ivec,
 -                      const krb5_crypto_iov *data, size_t num_data,
@@ -4285,8 +4317,10 @@
 -    krb5int_des_init_state,
 -    krb5int_default_free_state
 -};
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/crypto_tests/t_cf2.expected b/src/lib/crypto/crypto_tests/t_cf2.expected
-index f8251a16c..bc6aa50c8 100644
+index f8251a16cb..bc6aa50c84 100644
 --- a/src/lib/crypto/crypto_tests/t_cf2.expected
 +++ b/src/lib/crypto/crypto_tests/t_cf2.expected
 @@ -1,6 +1,5 @@
@@ -4297,7 +4331,7 @@
  edd02a39d2dbde31611c16e610be062c
  67f6ea530aea85a37dcbb23349ea52dcc61ca8493ff557252327fd8304341584
 diff --git a/src/lib/crypto/crypto_tests/t_cf2.in b/src/lib/crypto/crypto_tests/t_cf2.in
-index 73e2f8fbc..c4d23b506 100644
+index 73e2f8fbc9..c4d23b506b 100644
 --- a/src/lib/crypto/crypto_tests/t_cf2.in
 +++ b/src/lib/crypto/crypto_tests/t_cf2.in
 @@ -8,11 +8,6 @@ key1
@@ -4313,7 +4347,7 @@
  key1
  key2
 diff --git a/src/lib/crypto/crypto_tests/t_cksums.c b/src/lib/crypto/crypto_tests/t_cksums.c
-index 8297fcbf5..3063d12ec 100644
+index 557340ec5e..9f9a177ef0 100644
 --- a/src/lib/crypto/crypto_tests/t_cksums.c
 +++ b/src/lib/crypto/crypto_tests/t_cksums.c
 @@ -59,16 +59,6 @@ struct test {
@@ -4334,7 +4368,7 @@
          { KV5M_DATA, 37, "eight nine ten eleven twelve thirteen" },
          CKSUMTYPE_HMAC_SHA1_96_AES128, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 3,
 diff --git a/src/lib/crypto/crypto_tests/t_decrypt.c b/src/lib/crypto/crypto_tests/t_decrypt.c
-index a40a85500..716f2c337 100644
+index a40a855007..716f2c337a 100644
 --- a/src/lib/crypto/crypto_tests/t_decrypt.c
 +++ b/src/lib/crypto/crypto_tests/t_decrypt.c
 @@ -39,62 +39,6 @@ struct test {
@@ -4409,7 +4443,7 @@
      ENCTYPE_ARCFOUR_HMAC_EXP,
      ENCTYPE_AES128_CTS_HMAC_SHA1_96,
 diff --git a/src/lib/crypto/crypto_tests/t_derive.c b/src/lib/crypto/crypto_tests/t_derive.c
-index afbf7477f..93ce30da2 100644
+index afbf7477f6..93ce30da20 100644
 --- a/src/lib/crypto/crypto_tests/t_derive.c
 +++ b/src/lib/crypto/crypto_tests/t_derive.c
 @@ -38,41 +38,6 @@ struct test {
@@ -4463,7 +4497,7 @@
      case ENCTYPE_AES256_CTS_HMAC_SHA1_96:    return &krb5int_enc_aes256;
      case ENCTYPE_CAMELLIA128_CTS_CMAC:       return &krb5int_enc_camellia128;
 diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c
-index bd9b94691..290a72e1e 100644
+index bd9b94691c..290a72e1e0 100644
 --- a/src/lib/crypto/crypto_tests/t_encrypt.c
 +++ b/src/lib/crypto/crypto_tests/t_encrypt.c
 @@ -37,7 +37,6 @@
@@ -4475,7 +4509,7 @@
      ENCTYPE_ARCFOUR_HMAC_EXP,
      ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c
-index d4c2b97df..4466b7115 100644
+index d4c2b97dfd..4466b71158 100644
 --- a/src/lib/crypto/crypto_tests/t_short.c
 +++ b/src/lib/crypto/crypto_tests/t_short.c
 @@ -34,7 +34,6 @@
@@ -4487,7 +4521,7 @@
      ENCTYPE_ARCFOUR_HMAC_EXP,
      ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 diff --git a/src/lib/crypto/crypto_tests/t_str2key.c b/src/lib/crypto/crypto_tests/t_str2key.c
-index cdb1acc6d..ef4c4a7d3 100644
+index cdb1acc6d0..ef4c4a7d3b 100644
 --- a/src/lib/crypto/crypto_tests/t_str2key.c
 +++ b/src/lib/crypto/crypto_tests/t_str2key.c
 @@ -35,58 +35,6 @@ struct test {
@@ -4549,11 +4583,33 @@
      /* Test vectors from RFC 3962 appendix B. */
      {
          ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+diff --git a/src/lib/crypto/crypto_tests/vectors.c b/src/lib/crypto/crypto_tests/vectors.c
+index bcf5c9106f..eb107dbcd2 100644
+--- a/src/lib/crypto/crypto_tests/vectors.c
++++ b/src/lib/crypto/crypto_tests/vectors.c
+@@ -190,8 +190,6 @@ test_s2k (krb5_enctype enctype)
+     }
+ }
+ 
+-static void test_des3_s2k () { test_s2k (ENCTYPE_DES3_CBC_SHA1); }
+-
+ static void
+ keyToData (krb5_keyblock *k, krb5_data *d)
+ {
+@@ -208,8 +206,6 @@ void check_error (int r, int line) {
+ }
+ #define CHECK check_error(r, __LINE__)
+ 
+-extern struct krb5_enc_provider krb5int_enc_des3;
+-struct krb5_enc_provider *enc = &krb5int_enc_des3;
+ extern struct krb5_enc_provider krb5int_enc_aes128, krb5int_enc_aes256;
+ 
+ void DK (krb5_keyblock *out, krb5_keyblock *in, const krb5_data *usage) {
 diff --git a/src/lib/crypto/krb/Makefile.in b/src/lib/crypto/krb/Makefile.in
-index b74e6f7cc..2b0c4163d 100644
+index cb2e40a3a5..f66698bd53 100644
 --- a/src/lib/crypto/krb/Makefile.in
 +++ b/src/lib/crypto/krb/Makefile.in
-@@ -50,7 +50,6 @@ STLIBOBJS=\
+@@ -47,7 +47,6 @@ STLIBOBJS=\
  	prf.o			\
  	prf_aes2.o		\
  	prf_cmac.o		\
@@ -4561,7 +4617,7 @@
  	prf_dk.o		\
  	prf_rc4.o		\
  	prng.o			\
-@@ -109,7 +108,6 @@ OBJS=\
+@@ -103,7 +102,6 @@ OBJS=\
  	$(OUTPRE)prf.$(OBJEXT)			\
  	$(OUTPRE)prf_aes2.$(OBJEXT)		\
  	$(OUTPRE)prf_cmac.$(OBJEXT)		\
@@ -4569,7 +4625,7 @@
  	$(OUTPRE)prf_dk.$(OBJEXT)		\
  	$(OUTPRE)prf_rc4.$(OBJEXT)		\
  	$(OUTPRE)prng.$(OBJEXT)			\
-@@ -168,7 +166,6 @@ SRCS=\
+@@ -159,7 +157,6 @@ SRCS=\
  	$(srcdir)/prf.c			\
  	$(srcdir)/prf_aes2.c		\
  	$(srcdir)/prf_cmac.c		\
@@ -4578,10 +4634,10 @@
  	$(srcdir)/prf_rc4.c		\
  	$(srcdir)/prng.c 		\
 diff --git a/src/lib/crypto/krb/cksumtypes.c b/src/lib/crypto/krb/cksumtypes.c
-index ecc2e08c9..f5fbe8a2a 100644
+index f7ba322f24..25a3ffd2d2 100644
 --- a/src/lib/crypto/krb/cksumtypes.c
 +++ b/src/lib/crypto/krb/cksumtypes.c
-@@ -46,12 +46,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list = {
+@@ -52,12 +52,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list = {
        krb5int_unkeyed_checksum, NULL,
        20, 20, CKSUM_UNKEYED },
  
@@ -4595,21 +4651,19 @@
        "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" },
        "Microsoft HMAC MD5",
 diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h
-index 19f808749..4bc430c7a 100644
+index 3629616d96..1ee4b30e02 100644
 --- a/src/lib/crypto/krb/crypto_int.h
 +++ b/src/lib/crypto/krb/crypto_int.h
-@@ -276,10 +276,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc,
+@@ -332,8 +332,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc,
  /* Random to key */
  krb5_error_code k5_rand2key_direct(const krb5_data *randombits,
                                     krb5_keyblock *keyblock);
--krb5_error_code k5_rand2key_des(const krb5_data *randombits,
--                                krb5_keyblock *keyblock);
 -krb5_error_code k5_rand2key_des3(const krb5_data *randombits,
 -                                 krb5_keyblock *keyblock);
  
  /* Pseudo-random function */
  krb5_error_code krb5int_des_prf(const struct krb5_keytypes *ktp,
-@@ -368,11 +364,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage);
+@@ -411,11 +409,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage);
  /* Ensure library initialization has occurred. */
  int krb5int_crypto_init(void);
  
@@ -4621,7 +4675,7 @@
  /* Default state cleanup handler (used by module enc providers). */
  void krb5int_default_free_state(krb5_data *state);
  
-@@ -425,7 +416,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block);
+@@ -468,7 +461,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block);
  /* Modules must implement the k5_sha256() function prototyped in k5-int.h. */
  
  /* Modules must implement the following enc_providers and hash_providers: */
@@ -4629,21 +4683,18 @@
  extern const struct krb5_enc_provider krb5int_enc_arcfour;
  extern const struct krb5_enc_provider krb5int_enc_aes128;
  extern const struct krb5_enc_provider krb5int_enc_aes256;
-@@ -442,12 +432,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384;
+@@ -485,9 +477,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384;
  
  /* Modules must implement the following functions. */
  
 -/* Set the parity bits to the correct values in keybits. */
 -void k5_des_fixup_key_parity(unsigned char *keybits);
 -
--/* Return true if keybits is a weak or semi-weak DES key. */
--krb5_boolean k5_des_is_weak_key(unsigned char *keybits);
--
  /* Compute an HMAC using the provided hash function, key, and data, storing the
   * result into output (caller-allocated). */
  krb5_error_code krb5int_hmac(const struct krb5_hash_provider *hash,
 diff --git a/src/lib/crypto/krb/default_state.c b/src/lib/crypto/krb/default_state.c
-index 0757c8b02..f89dc7902 100644
+index 0757c8b02c..f89dc79023 100644
 --- a/src/lib/crypto/krb/default_state.c
 +++ b/src/lib/crypto/krb/default_state.c
 @@ -32,16 +32,6 @@
@@ -4664,7 +4715,7 @@
  krb5int_default_free_state(krb5_data *state)
  {
 diff --git a/src/lib/crypto/krb/enctype_util.c b/src/lib/crypto/krb/enctype_util.c
-index 1542d4062..a0037912a 100644
+index 1542d40629..a0037912a7 100644
 --- a/src/lib/crypto/krb/enctype_util.c
 +++ b/src/lib/crypto/krb/enctype_util.c
 @@ -45,6 +45,9 @@ struct {
@@ -4678,7 +4729,7 @@
  };
  
 diff --git a/src/lib/crypto/krb/etypes.c b/src/lib/crypto/krb/etypes.c
-index fc278783b..7635393a4 100644
+index fc278783b9..7635393a41 100644
 --- a/src/lib/crypto/krb/etypes.c
 +++ b/src/lib/crypto/krb/etypes.c
 @@ -35,27 +35,6 @@
@@ -4711,7 +4762,7 @@
      { ENCTYPE_ARCFOUR_HMAC,
 diff --git a/src/lib/crypto/krb/prf_des.c b/src/lib/crypto/krb/prf_des.c
 deleted file mode 100644
-index 7a2d719c5..000000000
+index 7a2d719c5f..0000000000
 --- a/src/lib/crypto/krb/prf_des.c
 +++ /dev/null
 @@ -1,47 +0,0 @@
@@ -4763,10 +4814,10 @@
 -    return ktp->enc->encrypt(key, NULL, &iov, 1);
 -}
 diff --git a/src/lib/crypto/krb/random_to_key.c b/src/lib/crypto/krb/random_to_key.c
-index 157462526..863090beb 100644
+index 9394385aa0..863090beb2 100644
 --- a/src/lib/crypto/krb/random_to_key.c
 +++ b/src/lib/crypto/krb/random_to_key.c
-@@ -71,48 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock)
+@@ -71,31 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock)
      memcpy(keyblock->contents, randombits->data, randombits->length);
      return 0;
  }
@@ -4780,23 +4831,6 @@
 -}
 -
 -krb5_error_code
--k5_rand2key_des(const krb5_data *randombits, krb5_keyblock *keyblock)
--{
--    if (randombits->length != 7)
--        return(KRB5_CRYPTO_INTERNAL);
--
--    keyblock->magic = KV5M_KEYBLOCK;
--
--    /* Take the seven bytes, move them around into the top 7 bits of the
--     * 8 key bytes, then compute the parity bits. */
--    memcpy(keyblock->contents, randombits->data, randombits->length);
--    eighth_byte(keyblock->contents);
--    k5_des_fixup_key_parity(keyblock->contents);
--
--    return 0;
--}
--
--krb5_error_code
 -k5_rand2key_des3(const krb5_data *randombits, krb5_keyblock *keyblock)
 -{
 -    int i;
@@ -4816,7 +4850,7 @@
 -    return 0;
 -}
 diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
-index d6cc1b423..f44cb9170 100644
+index 052f4d4b51..d8ffa63304 100644
 --- a/src/lib/crypto/libk5crypto.exports
 +++ b/src/lib/crypto/libk5crypto.exports
 @@ -86,7 +86,6 @@ krb5_k_verify_checksum
@@ -4825,23 +4859,23 @@
  krb5int_aes_decrypt
 -krb5int_enc_des3
  krb5int_arcfour_gsscrypt
- krb5int_camellia_cbc_mac
+ krb5int_camellia_encrypt
  krb5int_cmac_checksum
 diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in
-index aa434b168..234fc0e76 100644
+index 08de047d0a..88f7fd0a09 100644
 --- a/src/lib/crypto/openssl/Makefile.in
 +++ b/src/lib/crypto/openssl/Makefile.in
 @@ -1,6 +1,6 @@
  mydir=lib$(S)crypto$(S)openssl
  BUILDTOP=$(REL)..$(S)..$(S)..
--SUBDIRS=camellia des aes md4 md5  sha1 sha2 enc_provider hash_provider
-+SUBDIRS=camellia aes md4 md5  sha1 sha2 enc_provider hash_provider
- LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir)
+-SUBDIRS=des enc_provider hash_provider
++SUBDIRS=enc_provider hash_provider
+ LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS)
  
  STLIBOBJS=\
 @@ -24,14 +24,14 @@ SRCS=\
- 	$(srcdir)/sha256.c	\
- 	$(srcdir)/stubs.c
+ 	$(srcdir)/pbkdf2.c	\
+ 	$(srcdir)/sha256.c
  
 -STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
 +STOBJLISTS= md4/OBJS.ST 		\
@@ -4867,13 +4901,13 @@
  @libobj_frag@
 diff --git a/src/lib/crypto/openssl/des/Makefile.in b/src/lib/crypto/openssl/des/Makefile.in
 deleted file mode 100644
-index 4392fb8ea..000000000
+index a6cece1dd1..0000000000
 --- a/src/lib/crypto/openssl/des/Makefile.in
 +++ /dev/null
 @@ -1,20 +0,0 @@
 -mydir=lib$(S)crypto$(S)openssl$(S)des
 -BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
--LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/..
+-LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
 -
 -STLIBOBJS= des_keys.o
 -
@@ -4893,31 +4927,30 @@
 -
 diff --git a/src/lib/crypto/openssl/des/deps b/src/lib/crypto/openssl/des/deps
 deleted file mode 100644
-index 21b904f89..000000000
+index 723c268082..0000000000
 --- a/src/lib/crypto/openssl/des/deps
 +++ /dev/null
-@@ -1,15 +0,0 @@
+@@ -1,14 +0,0 @@
 -#
 -# Generated makefile dependencies follow.
 -#
 -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_keys.c
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_keys.c
 diff --git a/src/lib/crypto/openssl/des/des_keys.c b/src/lib/crypto/openssl/des/des_keys.c
 deleted file mode 100644
-index 51d9db216..000000000
+index 83f1cbf22a..0000000000
 --- a/src/lib/crypto/openssl/des/des_keys.c
 +++ /dev/null
-@@ -1,40 +0,0 @@
+@@ -1,39 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/openssl/des/des_keys.c - Key functions used by Kerberos code */
 -/*
@@ -4945,6 +4978,9 @@
 - */
 -
 -#include "crypto_int.h"
+-
+-#ifdef K5_OPENSSL_DES_KEY_PARITY
+-
 -#include <openssl/des.h>
 -
 -void
@@ -4953,17 +4989,13 @@
 -    DES_set_odd_parity((DES_cblock *)keybits);
 -}
 -
--krb5_boolean
--k5_des_is_weak_key(unsigned char *keybits)
--{
--    return DES_is_weak_key((DES_cblock *)keybits);
--}
+-#endif
 diff --git a/src/lib/crypto/openssl/enc_provider/Makefile.in b/src/lib/crypto/openssl/enc_provider/Makefile.in
-index a9069d22d..2b32c3ac4 100644
+index 26827cfed5..f0d37c1213 100644
 --- a/src/lib/crypto/openssl/enc_provider/Makefile.in
 +++ b/src/lib/crypto/openssl/enc_provider/Makefile.in
 @@ -3,19 +3,16 @@ BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
- LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/..
+ LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
  
  STLIBOBJS= \
 -	des3.o 	\
@@ -4983,7 +5015,7 @@
  	$(srcdir)/camellia.c 	\
  	$(srcdir)/rc4.c
 diff --git a/src/lib/crypto/openssl/enc_provider/deps b/src/lib/crypto/openssl/enc_provider/deps
-index 1c28cc842..91ba48234 100644
+index 1c87a526d0..a502990a0c 100644
 --- a/src/lib/crypto/openssl/enc_provider/deps
 +++ b/src/lib/crypto/openssl/enc_provider/deps
 @@ -1,17 +1,6 @@
@@ -4993,23 +5025,23 @@
 -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des3.c
+-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+-  des3.c
  aes.so aes.po $(OUTPRE)aes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
    $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
    $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
 diff --git a/src/lib/crypto/openssl/enc_provider/des3.c b/src/lib/crypto/openssl/enc_provider/des3.c
 deleted file mode 100644
-index 1c439c2cd..000000000
+index 90fcf9acb5..0000000000
 --- a/src/lib/crypto/openssl/enc_provider/des3.c
 +++ /dev/null
-@@ -1,184 +0,0 @@
+@@ -1,188 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/openssl/enc_provider/des3.c */
 -/*
@@ -5062,8 +5094,10 @@
 - */
 -
 -#include "crypto_int.h"
--#include <openssl/evp.h>
 -
+-#ifdef K5_OPENSSL_DES
+-
+-#include <openssl/evp.h>
 -
 -#define DES3_BLOCK_SIZE 8
 -#define DES3_KEY_SIZE 24
@@ -5194,11 +5228,26 @@
 -    krb5int_des_init_state,
 -    krb5int_default_free_state
 -};
+-
+-#endif /* K5_OPENSSL_DES */
+diff --git a/src/lib/crypto/openssl/kdf.c b/src/lib/crypto/openssl/kdf.c
+index 41e845eae0..5a43c3d9eb 100644
+--- a/src/lib/crypto/openssl/kdf.c
++++ b/src/lib/crypto/openssl/kdf.c
+@@ -60,8 +60,6 @@ enc_name(const struct krb5_enc_provider *enc)
+         return "AES-128-CBC";
+     if (enc == &krb5int_enc_aes256)
+         return "AES-256-CBC";
+-    if (enc == &krb5int_enc_des3)
+-        return "DES-EDE3-CBC";
+     return NULL;
+ }
+ 
 diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
-index 75f071c3e..fcf2c2152 100644
+index d4e90793f9..1bc807172b 100644
 --- a/src/lib/gssapi/krb5/accept_sec_context.c
 +++ b/src/lib/gssapi/krb5/accept_sec_context.c
-@@ -1039,7 +1039,6 @@ kg_accept_krb5(minor_status, context_handle,
+@@ -1030,7 +1030,6 @@ kg_accept_krb5(minor_status, context_handle,
              }
  
              switch (negotiated_etype) {
@@ -5207,7 +5256,7 @@
              case ENCTYPE_ARCFOUR_HMAC_EXP:
                  /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer"
 diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
-index a7e0e63ec..3bacdcd35 100644
+index a4446530fc..88d41130a7 100644
 --- a/src/lib/gssapi/krb5/gssapiP_krb5.h
 +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
 @@ -125,14 +125,14 @@ enum sgn_alg {
@@ -5237,7 +5286,7 @@
  };
  
 diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c
-index d1cdce486..7f7146a0a 100644
+index d1cdce486f..7f7146a0a2 100644
 --- a/src/lib/gssapi/krb5/k5seal.c
 +++ b/src/lib/gssapi/krb5/k5seal.c
 @@ -136,19 +136,12 @@ make_seal_token_v1 (krb5_context context,
@@ -5290,7 +5339,7 @@
      krb5_free_checksum_contents(context, &md5cksum);
  
 diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c
-index 9bb2ee109..9147bb2c7 100644
+index 9bb2ee1099..9147bb2c78 100644
 --- a/src/lib/gssapi/krb5/k5sealiov.c
 +++ b/src/lib/gssapi/krb5/k5sealiov.c
 @@ -144,18 +144,11 @@ make_seal_token_v1_iov(krb5_context context,
@@ -5335,7 +5384,7 @@
      /* create the seq_num */
      code = kg_make_seq_num(context, ctx->seq, ctx->initiate ? 0 : 0xFF,
 diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c
-index 9b183bc33..f0cc4a680 100644
+index 9b183bc337..f0cc4a6809 100644
 --- a/src/lib/gssapi/krb5/k5unseal.c
 +++ b/src/lib/gssapi/krb5/k5unseal.c
 @@ -131,28 +131,21 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
@@ -5400,13 +5449,15 @@
 +    if (signalg != SGN_ALG_HMAC_MD5) {
          *minor_status = 0;
          return(GSS_S_DEFECTIVE_TOKEN);
--
++    }
+ 
 -    case SGN_ALG_HMAC_SHA1_DES3_KD:
 -    case SGN_ALG_HMAC_MD5:
 -        /* compute the checksum of the message */
 -
 -        /* 8 = bytes of token body to be checksummed according to spec */
--
++    /* compute the checksum of the message */
+ 
 -        if (! (data_ptr = xmalloc(8 + plainlen))) {
 -            if (sealalg != 0xffff)
 -                xfree(plain);
@@ -5415,67 +5466,58 @@
 -            *minor_status = ENOMEM;
 -            return(GSS_S_FAILURE);
 -        }
--
++    /* 8 = bytes of token body to be checksummed according to spec */
+ 
 -        (void) memcpy(data_ptr, ptr-2, 8);
--
++    if (! (data_ptr = xmalloc(8 + plainlen))) {
++        if (sealalg != 0xffff)
++            xfree(plain);
++        if (toktype == KG_TOK_SEAL_MSG)
++            gssalloc_free(token.value);
++        *minor_status = ENOMEM;
++        return(GSS_S_FAILURE);
++    }
+ 
 -        (void) memcpy(data_ptr+8, plain, plainlen);
--
++    (void) memcpy(data_ptr, ptr-2, 8);
+ 
 -        plaind.length = 8 + plainlen;
 -        plaind.data = data_ptr;
 -        code = krb5_k_make_checksum(context, md5cksum.checksum_type,
 -                                    ctx->seq, sign_usage,
 -                                    &plaind, &md5cksum);
 -        xfree(data_ptr);
--
++    (void) memcpy(data_ptr+8, plain, plainlen);
+ 
 -        if (code) {
 -            if (toktype == KG_TOK_SEAL_MSG)
 -                gssalloc_free(token.value);
 -            *minor_status = code;
 -            return(GSS_S_FAILURE);
 -        }
--
--        code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len);
--        break;
-     }
- 
-+    /* compute the checksum of the message */
-+
-+    /* 8 = bytes of token body to be checksummed according to spec */
-+
-+    if (! (data_ptr = xmalloc(8 + plainlen))) {
-+        if (sealalg != 0xffff)
-+            xfree(plain);
-+        if (toktype == KG_TOK_SEAL_MSG)
-+            gssalloc_free(token.value);
-+        *minor_status = ENOMEM;
-+        return(GSS_S_FAILURE);
-+    }
-+
-+    (void) memcpy(data_ptr, ptr-2, 8);
-+
-+    (void) memcpy(data_ptr+8, plain, plainlen);
-+
 +    plaind.length = 8 + plainlen;
 +    plaind.data = data_ptr;
 +    code = krb5_k_make_checksum(context, md5cksum.checksum_type,
 +                                ctx->seq, sign_usage,
 +                                &plaind, &md5cksum);
 +    xfree(data_ptr);
-+
+ 
+-        code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len);
+-        break;
 +    if (code) {
 +        if (toktype == KG_TOK_SEAL_MSG)
 +            gssalloc_free(token.value);
 +        *minor_status = code;
 +        return(GSS_S_FAILURE);
-+    }
-+
+     }
+ 
 +    code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len);
 +
      krb5_free_checksum_contents(context, &md5cksum);
      if (sealalg != 0xffff)
          xfree(plain);
 diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c
-index 85a9574f3..3ce2a90ce 100644
+index 85a9574f36..3ce2a90ce9 100644
 --- a/src/lib/gssapi/krb5/k5unsealiov.c
 +++ b/src/lib/gssapi/krb5/k5unsealiov.c
 @@ -102,28 +102,21 @@ kg_unseal_v1_iov(krb5_context context,
@@ -5554,7 +5596,7 @@
          code = 0;
          retval = GSS_S_BAD_SIG;
 diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c
-index 84f194988..32150f5e3 100644
+index 84f1949887..32150f5e34 100644
 --- a/src/lib/gssapi/krb5/util_crypt.c
 +++ b/src/lib/gssapi/krb5/util_crypt.c
 @@ -97,17 +97,6 @@ kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey,
@@ -5575,57 +5617,8 @@
      case ENCTYPE_ARCFOUR_HMAC:
      case ENCTYPE_ARCFOUR_HMAC_EXP:
          /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype,
-diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-index 740425c69..6b45f5f72 100644
---- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-@@ -53,10 +53,10 @@ proc test200 {} {
-     }
- 
-     # XXX Perhaps I should actually check the key type returned.
--    if {$num_keys == 5} {
-+    if {$num_keys == 4} {
- 	pass "$test"
-     } else {
--	fail "$test: $num_keys keys, should be 5"
-+	fail "$test: $num_keys keys, should be 4"
-     }
-     if { ! cmd {kadm5_destroy $server_handle}} {
- 	perror "$test: unexpected failure in destroy"
-diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-index 3ea1ba29b..d2c6d1afa 100644
---- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-@@ -143,8 +143,8 @@ proc test101_102 {rpc} {
-     }
- 
-     set failed 0
--    if {$num_keys != 5} {
--	fail "$test: num_keys $num_keys should be 5"
-+    if {$num_keys != 4} {
-+	fail "$test: num_keys $num_keys should be 4"
- 	set failed 1
-     }
-     for {set i 0} {$i < $num_keys} {incr i} {
-diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-index 2925c1c43..2f76c8b43 100644
---- a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-@@ -46,10 +46,10 @@ proc test100 {} {
-     }
- 
-     # XXX Perhaps I should actually check the key type returned.
--    if {$num_keys == 5} {
-+    if {$num_keys == 4} {
- 	pass "$test"
-     } else {
--	fail "$test: $num_keys keys, should be 5"
-+	fail "$test: $num_keys keys, should be 4"
-     }
-     if { ! cmd {kadm5_destroy $server_handle}} {
- 	perror "$test: unexpected failure in destroy"
 diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
-index aa35baa3c..bfa99d9eb 100644
+index 87b486c53f..2b5abcd817 100644
 --- a/src/lib/krb5/krb/init_ctx.c
 +++ b/src/lib/krb5/krb/init_ctx.c
 @@ -59,7 +59,6 @@
@@ -5636,7 +5629,7 @@
      ENCTYPE_ARCFOUR_HMAC,
      ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC,
      0
-@@ -467,8 +466,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey,
+@@ -450,8 +449,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey,
              /* Set all enctypes in the default list. */
              for (i = 0; default_listi; i++)
                  mod_list(default_listi, sel, weak, &list);
@@ -5646,7 +5639,7 @@
              mod_list(ENCTYPE_AES256_CTS_HMAC_SHA1_96, sel, weak, &list);
              mod_list(ENCTYPE_AES128_CTS_HMAC_SHA1_96, sel, weak, &list);
 diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c
-index 44d113e7c..966278578 100644
+index 44d113e7c5..9662785783 100644
 --- a/src/lib/krb5/krb/s4u_creds.c
 +++ b/src/lib/krb5/krb/s4u_creds.c
 @@ -288,8 +288,6 @@ verify_s4u2self_reply(krb5_context context,
@@ -5659,7 +5652,7 @@
      case ENCTYPE_ARCFOUR_HMAC_EXP :
          not_newer = TRUE;
 diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c
-index 90c9f626c..935aca12f 100644
+index 90c9f626c6..935aca12f5 100644
 --- a/src/lib/krb5/krb/t_etypes.c
 +++ b/src/lib/krb5/krb/t_etypes.c
 @@ -50,17 +50,6 @@ static struct {
@@ -5731,7 +5724,7 @@
      { NULL,
        { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 },
 diff --git a/src/lib/krb5/os/t_trace.c b/src/lib/krb5/os/t_trace.c
-index 10ba8d0ac..24064ffcf 100644
+index 10ba8d0ac7..24064ffcfd 100644
 --- a/src/lib/krb5/os/t_trace.c
 +++ b/src/lib/krb5/os/t_trace.c
 @@ -65,8 +65,8 @@ main (int argc, char *argv)
@@ -5746,7 +5739,7 @@
      krb5_keytab keytab;
      krb5_creds creds;
 diff --git a/src/lib/krb5/os/t_trace.ref b/src/lib/krb5/os/t_trace.ref
-index 044a66999..98fb14f3f 100644
+index 044a66999e..98fb14f3f7 100644
 --- a/src/lib/krb5/os/t_trace.ref
 +++ b/src/lib/krb5/os/t_trace.ref
 @@ -41,7 +41,7 @@ int, krb5_principal type: ?
@@ -5759,7 +5752,7 @@
  krb5_ccache, display type:name: FILE:/path/to/ccache
  krb5_keytab, display name: FILE:/etc/krb5.keytab
 diff --git a/src/plugins/preauth/pkinit/pkcs11.h b/src/plugins/preauth/pkinit/pkcs11.h
-index e3d284631..586661bb7 100644
+index e3d2846315..586661bb7e 100644
 --- a/src/plugins/preauth/pkinit/pkcs11.h
 +++ b/src/plugins/preauth/pkinit/pkcs11.h
 @@ -339,9 +339,9 @@ typedef unsigned long ck_key_type_t;
@@ -5775,99 +5768,29 @@
  #define CKK_CAST		(0x16)
  #define CKK_CAST3		(0x17)
  #define CKK_CAST128		(0x18)
-diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
-index 2817cc213..a385da7c3 100644
---- a/src/plugins/preauth/pkinit/pkinit_clnt.c
-+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
-@@ -212,14 +212,6 @@ pkinit_as_req_create(krb5_context context,
-     auth_pack.clientPublicValue = &info;
-     auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids;
- 
--    /* add List of CMS algorithms */
--    retval = create_krb5_supportedCMSTypes(context, plgctx->cryptoctx,
--                                           reqctx->cryptoctx,
--                                           reqctx->idctx, &cmstypes);
--    auth_pack.supportedCMSTypes = cmstypes;
--    if (retval)
--        goto cleanup;
--
-     switch(protocol) {
-     case DH_PROTOCOL:
-         TRACE_PKINIT_CLIENT_REQ_DH(context);
 diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
-index 77d5c61fe..1f9868351 100644
+index 94a1b22fb1..65f6210727 100644
 --- a/src/plugins/preauth/pkinit/pkinit_crypto.h
 +++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
-@@ -380,18 +380,6 @@ krb5_error_code server_process_dh
- 	unsigned int *server_key_len_out);		/* OUT
- 		    receives length of DH secret key */
- 
--/*
-- * this functions takes in crypto specific representation of
-- * supportedCMSTypes and creates a list of
-- * krb5_algorithm_identifier
-- */
--krb5_error_code create_krb5_supportedCMSTypes
+@@ -376,11 +376,11 @@ krb5_error_code server_process_dh
+  * krb5_algorithm_identifier
+  */
+ krb5_error_code create_krb5_supportedCMSTypes
 -	(krb5_context context,				/* IN */
 -	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
 -	pkinit_req_crypto_context req_cryptoctx,	/* IN */
 -	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
 -	krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */
--
++       (krb5_context context,                          /* IN */
++       pkinit_plg_crypto_context plg_cryptoctx,        /* IN */
++       pkinit_req_crypto_context req_cryptoctx,        /* IN */
++       pkinit_identity_crypto_context id_cryptoctx,    /* IN */
++       krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */
+ 
  /*
   * this functions takes in crypto specific representation of
-  * trustedCertifiers and creates a list of
-diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-index e5940a513..e1153344e 100644
---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-@@ -5486,44 +5486,6 @@ cleanup:
-     return retval;
- }
- 
--krb5_error_code
--create_krb5_supportedCMSTypes(krb5_context context,
--                              pkinit_plg_crypto_context plg_cryptoctx,
--                              pkinit_req_crypto_context req_cryptoctx,
--                              pkinit_identity_crypto_context id_cryptoctx,
--                              krb5_algorithm_identifier ***oids)
--{
--
--    krb5_error_code retval = ENOMEM;
--    krb5_algorithm_identifier **loids = NULL;
--    krb5_data des3oid = {0, 8, "\x2A\x86\x48\x86\xF7\x0D\x03\x07" };
--
--    *oids = NULL;
--    loids = malloc(2 * sizeof(krb5_algorithm_identifier *));
--    if (loids == NULL)
--        goto cleanup;
--    loids1 = NULL;
--    loids0 = malloc(sizeof(krb5_algorithm_identifier));
--    if (loids0 == NULL) {
--        free(loids);
--        goto cleanup;
--    }
--    retval = pkinit_copy_krb5_data(&loids0->algorithm, &des3oid);
--    if (retval) {
--        free(loids0);
--        free(loids);
--        goto cleanup;
--    }
--    loids0->parameters.length = 0;
--    loids0->parameters.data = NULL;
--
--    *oids = loids;
--    retval = 0;
--cleanup:
--
--    return retval;
--}
--
- krb5_error_code
- create_krb5_trustedCertifiers(krb5_context context,
-                               pkinit_plg_crypto_context plg_cryptoctx,
 diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
-index 7acbd0d28..cd998a29a 100644
+index 7f38e84910..99c93ac128 100644
 --- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c
 +++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
 @@ -49,7 +49,6 @@ char eighteen_bs9;
@@ -5878,14 +5801,13 @@
  const krb5_data lha_data = DATA_FROM_STRING("lha");
  
  krb5_octet key1_hex =
-@@ -185,36 +184,6 @@ main(int argc, char **argv)
+@@ -187,35 +186,6 @@ main(int argc, char **argv)
          goto cleanup;
      }
  
 -    /* TEST 3: SHA-512/DES3 */
 -    /* set up algorithm id */
--    alg_id.algorithm.data = (char *)krb5_pkinit_sha512_oid;
--    alg_id.algorithm.length = krb5_pkinit_sha512_oid_len;
+-    alg_id.algorithm = sha512_id;
 -
 -    enctype = enctype_des3;
 -
@@ -5895,7 +5817,7 @@
 -                                              u_principal, v_principal,
 -                                              enctype, &as_req, &pk_as_rep,
 -                                              &key_block))) {
--        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d",
+-        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d\n",
 -               retval);
 -        goto cleanup;
 -    }
@@ -5916,7 +5838,7 @@
      /* release all allocated resources, whether good or bad return */
      free(secret.data);
 diff --git a/src/plugins/preauth/spake/t_vectors.c b/src/plugins/preauth/spake/t_vectors.c
-index 2279202d3..96b0307d7 100644
+index 2279202d3a..96b0307d78 100644
 --- a/src/plugins/preauth/spake/t_vectors.c
 +++ b/src/plugins/preauth/spake/t_vectors.c
 @@ -56,31 +56,6 @@ struct test {
@@ -5951,158 +5873,8 @@
      { ENCTYPE_ARCFOUR_HMAC, SPAKE_GROUP_EDWARDS25519,
        /* initial key, w, x, y, T, S, K */
        "8846F7EAEE8FB117AD06BDD830B7586C",
-diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
-index 85bbf478a..302dee74c 100644
---- a/src/tests/dejagnu/config/default.exp
-+++ b/src/tests/dejagnu/config/default.exp
-@@ -15,8 +15,6 @@ set timeout 100
- set stty_init {erase \^h kill \^u}
- set env(TERM) dumb
- 
--set des3_krbtgt 0
--
- if { string length $VALGRIND } {
-     rename spawn valgrind_aux_spawn
-     proc spawn { args } {
-@@ -105,17 +103,9 @@ if { $PRIOCNTL_HACK } {
- # particularly with regards to encryption types.
- 
- set passes {
--    {
--	des3
--	mode=udp
--	des3_krbtgt=1
--	{supported_enctypes=des3-cbc-sha1:normal}
--	{dummy=verbose -log "DES3 TGT, DES3 enctype"}
--    }
-     {
- 	aes-only
- 	mode=udp
--	des3_krbtgt=0
- 	{supported_enctypes=aes256-cts-hmac-sha1-96:normal}
- 	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96}
- 	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96}
-@@ -130,7 +120,6 @@ set passes {
-     {
- 	aes-sha2-only
- 	mode=udp
--	des3_krbtgt=0
- 	{supported_enctypes=aes256-sha2:normal}
- 	{permitted_enctypes(kdc)=aes256-sha2}
- 	{permitted_enctypes(replica)=aes256-sha2}
-@@ -146,7 +135,6 @@ set passes {
-     {
- 	camellia-only
- 	mode=udp
--	des3_krbtgt=0
- 	{supported_enctypes=camellia256-cts:normal}
- 	{permitted_enctypes(kdc)=camellia256-cts}
- 	{permitted_enctypes(replica)=camellia256-cts}
-@@ -159,32 +147,9 @@ set passes {
- 	{master_key_type=camellia256-cts}
- 	{dummy=verbose -log "Camellia-256 enctype"}
-     }
--    {
--	aes-des3
--	mode=udp
--	des3_krbtgt=0
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{master_key_type=aes256-cts-hmac-sha1-96}
--	{dummy=verbose -log "AES + DES3 + DES enctypes"}
--    }
--    {
--	aes-des3tgt
--	mode=udp
--	des3_krbtgt=1
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{master_key_type=aes256-cts-hmac-sha1-96}
--	{dummy=verbose -log "AES enctypes, DES3 TGT"}
--    }
-     {
- 	all-enctypes
- 	mode=udp
--	des3_krbtgt=0
- 	{allow_weak_crypto(kdc)=false}
- 	{allow_weak_crypto(replica)=false}
- 	{allow_weak_crypto(client)=false}
-@@ -946,7 +911,6 @@ proc setup_kerberos_db { standalone } {
-     global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY
-     global tmppwd hostname
-     global spawn_id
--    global des3_krbtgt
-     global multipass_name last_passname_db
- 
-     set failall 0
-@@ -1143,48 +1107,6 @@ proc setup_kerberos_db { standalone } {
- 	}
-     }
- 
--    if $des3_krbtgt {
--	# Set the TGT key to DES3.
--	set test "kadmin.local TGT to DES3"
--	set body {
--	    if $failall {
--		break
--	    }
--	    spawn $KADMIN_LOCAL -r $REALMNAME -e des3-cbc-sha1:normal
--	    verbose "starting $test"
--	    expect_after $def_exp_after
--
--	    expect "kadmin.local: "
--	    send "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r"
--	    # It echos...
--	    expect "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r"
--	    expect {
--		"Key for \"krbtgt/$REALMNAME@$REALMNAME\" randomized." { }
--	    }
--	    expect "kadmin.local: "
--	    send "quit\r"
--	    expect eof
--	    catch expect_after
--	    if !check_exit_status kadmin_local {
--		break
--	    }
--	}
--	set ret catch $body
--	catch "expect eof"
--	catch expect_after
--	if $ret {
--	    set failall 1
--	    if $standalone {
--		fail $test
--	    } else {
--		delete_db
--	    }
--	} else {
--	    if $standalone {
--		pass $test
--	    }
--	}
--    }
-     envstack_pop
- 
-     # create the admin database lock file
-diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/dejagnu/krb-standalone/kprop.exp
-index 661e3fd9a..2b8f60045 100644
---- a/src/tests/dejagnu/krb-standalone/kprop.exp
-+++ b/src/tests/dejagnu/krb-standalone/kprop.exp
-@@ -54,7 +54,7 @@ proc doit { } {
-     global REALMNAME KEY
-     global KADMIN_LOCAL KTUTIL KDB5_UTIL KPROPLOG KPROP kpropd_spawn_id
-     global hostname tmppwd spawn_id timeout
--    global KRBIV supported_enctypes portbase mode ulog des3_krbtgt
-+    global KRBIV supported_enctypes portbase mode ulog
- 
-     # Delete any db, ulog files
-     delete_db
 diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
-index 7494d7fcd..2f95d8996 100755
+index 7494d7fcdb..2f95d89967 100755
 --- a/src/tests/gssapi/t_enctypes.py
 +++ b/src/tests/gssapi/t_enctypes.py
 @@ -1,24 +1,17 @@
@@ -6171,7 +5943,7 @@
  # because the ticket session key and initiator subkey are
  # non-permitted.  (This is unfortunate if the acceptor's restriction
 diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c
-index 9876a11e6..fb8fe5511 100644
+index 9876a11e67..fb8fe55111 100644
 --- a/src/tests/gssapi/t_invalid.c
 +++ b/src/tests/gssapi/t_invalid.c
 @@ -84,18 +84,6 @@ struct test {
@@ -6194,7 +5966,7 @@
          ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC,
          SEAL_ALG_MICROSOFT_RC4, SGN_ALG_HMAC_MD5, 8,
 diff --git a/src/tests/gssapi/t_pcontok.c b/src/tests/gssapi/t_pcontok.c
-index 7368f752f..bf22bd3da 100644
+index 7368f752f0..bf22bd3da1 100644
 --- a/src/tests/gssapi/t_pcontok.c
 +++ b/src/tests/gssapi/t_pcontok.c
 @@ -43,7 +43,6 @@
@@ -6229,7 +6001,7 @@
      tlen = 20 + mech_krb5.length + cksize;
      token = malloc(tlen);
 diff --git a/src/tests/gssapi/t_prf.c b/src/tests/gssapi/t_prf.c
-index f71774cdc..d1857c433 100644
+index f71774cdc9..d1857c433f 100644
 --- a/src/tests/gssapi/t_prf.c
 +++ b/src/tests/gssapi/t_prf.c
 @@ -41,13 +41,6 @@ static struct {
@@ -6247,10 +6019,10 @@
        "3BB3AE288C12B3B9D06B208A4151B3B6",
        "9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28"
 diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py
-index 3fa957ad2..2e01f46bc 100644
+index 97e2474bf8..47ea9e4b47 100644
 --- a/src/tests/t_authdata.py
 +++ b/src/tests/t_authdata.py
-@@ -174,7 +174,7 @@ realm.run(kvno, 'restricted')
+@@ -164,7 +164,7 @@ realm.run(kvno, 'restricted')
  # preferred krbtgt enctype changes.
  mark('#8139 regression test')
  realm.kinit(realm.user_princ, password('user'), '-f')
@@ -6260,7 +6032,7 @@
  realm.run('./forward')
  realm.run(kvno, realm.host_princ)
 diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
-index c982508d8..96e90a69d 100644
+index c982508d8b..96e90a69d2 100644
 --- a/src/tests/t_etype_info.py
 +++ b/src/tests/t_etype_info.py
 @@ -1,6 +1,6 @@
@@ -6309,7 +6081,7 @@
  # Verify that etype-info2 is included in a MORE_PREAUTH_DATA_REQUIRED
  # error if the client does optimistic preauth.
 diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py
-index 2c825a692..f29e0d550 100755
+index 2c825a6922..f29e0d5500 100755
 --- a/src/tests/t_keyrollover.py
 +++ b/src/tests/t_keyrollover.py
 @@ -37,9 +37,9 @@ realm.run(klist, '-e', expected_msg=msg)
@@ -6337,7 +6109,7 @@
  
  realm.stop()
 diff --git a/src/tests/t_mkey.py b/src/tests/t_mkey.py
-index 32f4070bc..da0ed1831 100755
+index 32f4070bcb..da0ed1831e 100755
 --- a/src/tests/t_mkey.py
 +++ b/src/tests/t_mkey.py
 @@ -7,7 +7,6 @@ import struct
@@ -6390,7 +6162,7 @@
  # master key fetch does not segfault.
  mark('#8395 regression test')
 diff --git a/src/tests/t_salt.py b/src/tests/t_salt.py
-index 65084bbf3..55ca89745 100755
+index 65084bbf35..55ca897459 100755
 --- a/src/tests/t_salt.py
 +++ b/src/tests/t_salt.py
 @@ -16,13 +16,12 @@ def test_salt(realm, e1, salt, e2):
@@ -6410,10 +6182,10 @@
  # Test using different salt types in a principal's key list.
  # Parameters from one key in the list must not leak over to later ones.
 diff --git a/src/util/k5test.py b/src/util/k5test.py
-index 6afe4b92c..789b0f4b9 100644
+index 619f1995f8..771f82e3cc 100644
 --- a/src/util/k5test.py
 +++ b/src/util/k5test.py
-@@ -1278,13 +1278,6 @@ _passes = 
+@@ -1344,13 +1344,6 @@ _passes = 
      # No special settings; exercises AES256.
      ('default', None, None, None),
  
@@ -6428,7 +6200,7 @@
      ('arcfour', None,
       {'libdefaults': {'permitted_enctypes': 'rc4'}},
 diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm
-index 1aebdd0b4..c38eefd2b 100644
+index 1aebdd0b4a..c38eefd2bd 100644
 --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm
 +++ b/src/windows/leash/htmlhelp/html/Encryption_Types.htm
 @@ -79,19 +79,6 @@ will have an entry in the Encryption type column. <br>
@@ -6451,3 +6223,6 @@
  <th id="th2"> aes </th>
       <td>The AES Advanced Encryption Standard
  family, like 3DES, is a symmetric block cipher and was designed
+-- 
+2.38.1
+

_service:tar_scm:SELinux-integration.patch Changed

@@ -1,4 +1,4 @@
-From e787771b618a344d45ac515927e914602f48946f Mon Sep 17 00:00:00 2001
+From c6b58ed180ed91b579d322ff5004f68750f1eb4f Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:30:53 -0400
 Subject: PATCH downstream SELinux integration
@@ -36,7 +36,9 @@
 Red Hat #273081), so switching to using them instead of matchpathcon(),
 which we used earlier, is some improvement.
 
-Last-updated: krb5-1.18-beta1
+Last-updated: krb5-1.20.1
+jrische@redhat.com: Replace deprecated security_context_t by char *:
+    - src/util/support/selinux.c
 ---
  src/aclocal.m4                                |  48 +++
  src/build-tools/krb5-config.in                |   3 +-
@@ -61,13 +63,13 @@
  .../kdb/ldap/ldap_util/kdb5_ldap_services.c   |  11 +-
  src/util/profile/prof_file.c                  |   3 +-
  src/util/support/Makefile.in                  |   3 +-
- src/util/support/selinux.c                    | 406 ++++++++++++++++++
- 24 files changed, 573 insertions(+), 21 deletions(-)
+ src/util/support/selinux.c                    | 405 ++++++++++++++++++
+ 24 files changed, 572 insertions(+), 21 deletions(-)
  create mode 100644 src/include/k5-label.h
  create mode 100644 src/util/support/selinux.c
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index ca9fcf664..5afb96e58 100644
+index bf9da35bbc..01283f482e 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
 @@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag)
@@ -78,7 +80,7 @@
  KRB5_LIB_PARAMS
  KRB5_AC_INITFINI
  KRB5_AC_ENABLE_THREADS
-@@ -1745,4 +1746,51 @@ AC_SUBST(PAM_LIBS)
+@@ -1526,4 +1527,51 @@ AC_SUBST(PAM_LIBS)
  AC_SUBST(PAM_MAN)
  AC_SUBST(NON_PAM_MAN)
  )dnl
@@ -131,7 +133,7 @@
 +AC_SUBST(SELINUX_LIBS)
 +)dnl
 diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
-index dead0dddc..fef3e054f 100755
+index dead0dddce..fef3e054fc 100755
 --- a/src/build-tools/krb5-config.in
 +++ b/src/build-tools/krb5-config.in
 @@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@'
@@ -152,7 +154,7 @@
  
      echo $lib_flags
 diff --git a/src/config/pre.in b/src/config/pre.in
-index 3752174c7..0d2068575 100644
+index a0c60c70b3..7eaa2f351c 100644
 --- a/src/config/pre.in
 +++ b/src/config/pre.in
 @@ -177,6 +177,7 @@ LD = $(PURE) @LD@
@@ -163,7 +165,7 @@
  
  INSTALL=@INSTALL@
  INSTALL_STRIP=
-@@ -403,7 +404,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
+@@ -379,7 +380,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
  # HESIOD_LIBS is -lhesiod...
  HESIOD_LIBS	= @HESIOD_LIBS@
  
@@ -173,10 +175,10 @@
  GSS_LIBS	= $(GSS_KRB5_LIB)
  # needs fixing if ever used on macOS!
 diff --git a/src/configure.ac b/src/configure.ac
-index 693f76a81..dd2cad3ee 100644
+index aa970b0447..40545f2bfc 100644
 --- a/src/configure.ac
 +++ b/src/configure.ac
-@@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff)
+@@ -1402,6 +1402,8 @@ AC_PATH_PROG(GROFF, groff)
  
  KRB5_WITH_PAM
  
@@ -186,7 +188,7 @@
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
 diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index cf524252f..efb523689 100644
+index 44dc1eeb3f..c3aecba7d4 100644
 --- a/src/include/k5-int.h
 +++ b/src/include/k5-int.h
 @@ -128,6 +128,7 @@ typedef unsigned char   u_char;
@@ -199,7 +201,7 @@
  #define KRB5_KDB_MAX_RLIFE      (60*60*24*7) /* one week */
 diff --git a/src/include/k5-label.h b/src/include/k5-label.h
 new file mode 100644
-index 000000000..dfaaa847c
+index 0000000000..dfaaa847cb
 --- /dev/null
 +++ b/src/include/k5-label.h
 @@ -0,0 +1,32 @@
@@ -236,7 +238,7 @@
 +#endif
 +#endif
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index 045334a08..db80063eb 100644
+index c0194c3c94..7e1dea2cbf 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
 @@ -87,6 +87,12 @@
@@ -253,7 +255,7 @@
  
  #include <stdlib.h>
 diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
-index 634ba4a8b..cea7939f4 100644
+index a89b5144f6..4d6cc0bdf9 100644
 --- a/src/kadmin/dbutil/dump.c
 +++ b/src/kadmin/dbutil/dump.c
 @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname)
@@ -288,10 +290,10 @@
          com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok);
          goto cleanup;
 diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 3be6dcb07..24d441e16 100644
+index 38b9299066..085afc9220 100644
 --- a/src/kdc/main.c
 +++ b/src/kdc/main.c
-@@ -872,7 +872,7 @@ write_pid_file(const char *path)
+@@ -848,7 +848,7 @@ write_pid_file(const char *path)
      FILE *file;
      unsigned long pid;
  
@@ -301,10 +303,10 @@
          return errno;
      pid = (unsigned long) getpid();
 diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
-index 498ca599a..c6b8efc28 100644
+index f2341d720f..ffdac9f397 100644
 --- a/src/kprop/kpropd.c
 +++ b/src/kprop/kpropd.c
-@@ -487,6 +487,9 @@ doit(int fd)
+@@ -488,6 +488,9 @@ doit(int fd)
      krb5_enctype etype;
      int database_fd;
      char hostINET6_ADDRSTRLEN + 1;
@@ -314,7 +316,7 @@
  
      signal_wrapper(SIGALRM, alarm_handler);
      alarm(params.iprop_resync_timeout);
-@@ -542,9 +545,15 @@ doit(int fd)
+@@ -543,9 +546,15 @@ doit(int fd)
          free(name);
          exit(1);
      }
@@ -331,7 +333,7 @@
                              KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK);
      if (retval) {
 diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
-index c6885edf2..9aec3c05e 100644
+index c6885edf2a..9aec3c05e8 100644
 --- a/src/lib/kadm5/logger.c
 +++ b/src/lib/kadm5/logger.c
 @@ -309,7 +309,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
@@ -353,7 +355,7 @@
                  set_cloexec_file(f);
                  log_control.log_entrieslindex.lfu_filep = f;
 diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c
-index 2659a2501..e9b95fce5 100644
+index 2659a25018..e9b95fce59 100644
 --- a/src/lib/kdb/kdb_log.c
 +++ b/src/lib/kdb/kdb_log.c
 @@ -480,7 +480,7 @@ ulog_map(krb5_context context, const char *logname, uint32_t ulogentries)
@@ -366,7 +368,7 @@
              retval = errno;
              goto cleanup;
 diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c
-index 7b100a0ec..5683a0433 100644
+index 1da40b51d0..f3ab7340a6 100644
 --- a/src/lib/krb5/ccache/cc_dir.c
 +++ b/src/lib/krb5/ccache/cc_dir.c
 @@ -183,10 +183,19 @@ write_primary_file(const char *primary_path, const char *contents)
@@ -416,7 +418,7 @@
                    _("Credential cache directory %s does not exist"),
                    dirname);
 diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
-index e510211fc..f3ea28c8e 100644
+index e510211fc5..f3ea28c8ec 100644
 --- a/src/lib/krb5/keytab/kt_file.c
 +++ b/src/lib/krb5/keytab/kt_file.c
 @@ -735,14 +735,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode)
@@ -437,10 +439,10 @@
                  goto report_errno;
              writevno = 1;
 diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c
-index 7073459f0..e9b99f4ca 100644
+index 3369fc4ba6..95f82cda03 100644
 --- a/src/lib/krb5/os/trace.c
 +++ b/src/lib/krb5/os/trace.c
-@@ -458,7 +458,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename)
+@@ -459,7 +459,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename)
      fd = malloc(sizeof(*fd));
      if (fd == NULL)
          return ENOMEM;
@@ -450,7 +452,7 @@
          free(fd);
          return errno;
 diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c
-index 7db30a33b..2b9d01921 100644
+index 7db30a33b0..2b9d01921d 100644
 --- a/src/plugins/kdb/db2/adb_openclose.c
 +++ b/src/plugins/kdb/db2/adb_openclose.c
 @@ -152,7 +152,7 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename,
@@ -463,7 +465,7 @@
               * maybe someone took away write permission so we could only
               * get shared locks?
 diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
-index 1a476b586..b40bb2240 100644
+index 2c163d91cc..9a344a603e 100644
 --- a/src/plugins/kdb/db2/kdb_db2.c
 +++ b/src/plugins/kdb/db2/kdb_db2.c
 @@ -694,8 +694,8 @@ ctx_create_db(krb5_context context, krb5_db2_context *dbc)
@@ -478,7 +480,7 @@
          retval = errno;
          goto cleanup;
 diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
-index 2977b17f3..d5809a5a9 100644
+index 2977b17f3a..d5809a5a93 100644
 --- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c
 +++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
 @@ -60,6 +60,7 @@ static char sccsid = "@(#)bt_open.c	8.11 (Berkeley) 11/2/95";
@@ -499,7 +501,7 @@
  
  	} else {
 diff --git a/src/plugins/kdb/db2/libdb2/hash/hash.c b/src/plugins/kdb/db2/libdb2/hash/hash.c
-index 862dbb164..686a960c9 100644
+index 862dbb1640..686a960c96 100644
 --- a/src/plugins/kdb/db2/libdb2/hash/hash.c
 +++ b/src/plugins/kdb/db2/libdb2/hash/hash.c
 @@ -51,6 +51,7 @@ static char sccsid = "@(#)hash.c	8.12 (Berkeley) 11/7/95";
@@ -520,7 +522,7 @@
  		(void)fcntl(hashp->fp, F_SETFD, 1);
  	}
 diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_open.c b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
-index d8b26e701..b0daa7c02 100644
+index d8b26e7011..b0daa7c021 100644
 --- a/src/plugins/kdb/db2/libdb2/recno/rec_open.c
 +++ b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
 @@ -51,6 +51,7 @@ static char sccsid = "@(#)rec_open.c	8.12 (Berkeley) 11/18/94";
@@ -542,7 +544,7 @@
  
  	if (fname != NULL && fcntl(rfd, F_SETFD, 1) == -1) {
 diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-index e87688d66..30f7c00ab 100644
+index e87688d666..30f7c00ab5 100644
 --- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
 +++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
 @@ -190,7 +190,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
@@ -579,7 +581,7 @@
          if (newfile == NULL) {
              com_err(me, errno, _("Error creating file %s"), tmp_file);
 diff --git a/src/util/profile/prof_file.c b/src/util/profile/prof_file.c
-index aa951df05..79f9500f6 100644
+index aa951df05f..79f9500f69 100644
 --- a/src/util/profile/prof_file.c
 +++ b/src/util/profile/prof_file.c
 @@ -33,6 +33,7 @@
@@ -600,7 +602,7 @@
          retval = errno;
          if (retval == 0)
 diff --git a/src/util/support/Makefile.in b/src/util/support/Makefile.in
-index 86d5a950a..1052d53a1 100644
+index 86d5a950a6..1052d53a1e 100644
 --- a/src/util/support/Makefile.in
 +++ b/src/util/support/Makefile.in
 @@ -74,6 +74,7 @@ IPC_SYMS= \
@@ -622,10 +624,10 @@
  
 diff --git a/src/util/support/selinux.c b/src/util/support/selinux.c
 new file mode 100644
-index 000000000..6d41f3244
+index 0000000000..807d039da3
 --- /dev/null
 +++ b/src/util/support/selinux.c
-@@ -0,0 +1,406 @@
+@@ -0,0 +1,405 @@
 +/*
 + * Copyright 2007,2008,2009,2011,2012,2013,2016 Red Hat, Inc.  All Rights Reserved.
 + *
@@ -724,17 +726,16 @@
 +    }
 +}
 +
-+static security_context_t
++static char *
 +push_fscreatecon(const char *pathname, mode_t mode)
 +{
-+    security_context_t previous, configuredsc, currentsc, derivedsc;
++    char *previous, *configuredsc, *currentsc, *genpath;
++    const char *derivedsc, *fullpath, *currentuser;
 +    context_t current, derived;
-+    const char *fullpath, *currentuser;
-+    char *genpath;
 +
-+    previous = configuredsc = currentsc = derivedsc = NULL;
++    previous = configuredsc = currentsc = genpath = NULL;
++    derivedsc = NULL;
 +    current = derived = NULL;
-+    genpath = NULL;
 +
 +    fullpath = pathname;
 +
@@ -862,7 +863,7 @@
 +}
 +
 +static void
-+pop_fscreatecon(security_context_t previous)
++pop_fscreatecon(char *previous)
 +{
 +    if (!is_selinux_enabled()) {
 +        return;
@@ -916,7 +917,7 @@
 +{
 +    FILE *fp;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    if ((strcmp(mode, "r") == 0) ||
 +        (strcmp(mode, "rb") == 0)) {
@@ -942,7 +943,7 @@
 +{
 +    int fd;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    k5_once(&labeled_once, label_mutex_init);
 +    k5_mutex_lock(&labeled_mutex);
@@ -963,7 +964,7 @@
 +{
 +    int ret;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    k5_once(&labeled_once, label_mutex_init);
 +    k5_mutex_lock(&labeled_mutex);
@@ -984,7 +985,7 @@
 +{
 +    int ret;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    k5_once(&labeled_once, label_mutex_init);
 +    k5_mutex_lock(&labeled_mutex);
@@ -1005,7 +1006,7 @@
 +{
 +    int fd;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +    mode_t mode;
 +    va_list ap;
 +
@@ -1032,3 +1033,6 @@
 +}
 +
 +#endif /* USE_SELINUX */
+-- 
+2.38.1
+

_service:tar_scm:backport-CVE-2021-37750.patch Deleted

@@ -1,46 +0,0 @@
-From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 3 Aug 2021 01:15:27 -0400
-Subject: PATCH Fix KDC null deref on TGS inner body null server
-
-After the KDC decodes a FAST inner body, it does not check for a null
-server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
-would typically result in an error from krb5_unparse_name(), but with
-the addition of get_local_tgt() it results in a null dereference.  Add
-a null check.
-
-Reported by Joseph Sutton of Catalyst.
-
-CVE-2021-37750:
-
-In MIT krb5 releases 1.14 and later, an authenticated attacker can
-cause a null dereference in the KDC by sending a FAST TGS request with
-no server field.
-
-ticket: 9008 (new)
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
----
- src/kdc/do_tgs_req.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
-index 582e497..32dc65f 100644
---- a/src/kdc/do_tgs_req.c
-+++ b/src/kdc/do_tgs_req.c
-@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
-         status = "FIND_FAST";
-         goto cleanup;
-     }
-+    if (sprinc == NULL) {
-+        status = "NULL_SERVER";
-+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
-+        goto cleanup;
-+    }
- 
-     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
-                             &local_tgt, &local_tgt_storage, &local_tgt_key);
--- 
-1.8.3.1
-

_service:tar_scm:fix-debuginfo-with-y.tab.c.patch Changed

@@ -1,4 +1,4 @@
-From ed161c3f3cb642d025f0fee6d4af6f56bba711e9 Mon Sep 17 00:00:00 2001
+From c7fe7cbd61f7debf052ddcc6cc5f01bb7e4f5385 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:49:25 -0400
 Subject: PATCH downstream fix debuginfo with y.tab.c
@@ -14,7 +14,7 @@
  2 files changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in
-index adfea6e2b..d1327e400 100644
+index adfea6e2b5..d1327e400b 100644
 --- a/src/kadmin/cli/Makefile.in
 +++ b/src/kadmin/cli/Makefile.in
 @@ -37,3 +37,8 @@ clean-unix::
@@ -27,7 +27,7 @@
 +	$(YACC.y) $< 
 +	$(CP) y.tab.c $@
 diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in
-index 8669c2436..a22f23c02 100644
+index 8669c2436c..a22f23c02c 100644
 --- a/src/plugins/kdb/ldap/ldap_util/Makefile.in
 +++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in
 @@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE)
@@ -39,3 +39,6 @@
  
  install:
  	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)
+-- 
+2.38.1
+

_service:tar_scm:ksu-pam-integration.patch Changed

@@ -1,4 +1,4 @@
-From 90ba715be48c2e1b6c7ca53cb1d75f3af2c388d6 Mon Sep 17 00:00:00 2001
+From 37d69135d0be7f46732c401cdbb3abc075bf4117 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:29:58 -0400
 Subject: PATCH downstream ksu pam integration
@@ -30,10 +30,10 @@
  create mode 100644 src/clients/ksu/pam.h
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 024d6370c..ca9fcf664 100644
+index 9920476f91..bf9da35bbc 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
-@@ -1677,3 +1677,72 @@ if test "$with_ldap" = yes; then
+@@ -1458,3 +1458,72 @@ if test "$with_ldap" = yes; then
    OPENLDAP_PLUGIN=yes
  fi
  )dnl
@@ -107,7 +107,7 @@
 +)dnl
 +
 diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
-index 8b4edce4d..9d58f29b5 100644
+index 8b4edce4d8..9d58f29b5d 100644
 --- a/src/clients/ksu/Makefile.in
 +++ b/src/clients/ksu/Makefile.in
 @@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S)..
@@ -145,7 +145,7 @@
  clean:
  	$(RM) ksu
 diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
-index af1286172..931f05404 100644
+index af12861729..931f054041 100644
 --- a/src/clients/ksu/main.c
 +++ b/src/clients/ksu/main.c
 @@ -26,6 +26,7 @@
@@ -303,7 +303,7 @@
      }
 diff --git a/src/clients/ksu/pam.c b/src/clients/ksu/pam.c
 new file mode 100644
-index 000000000..cbfe48704
+index 0000000000..cbfe487047
 --- /dev/null
 +++ b/src/clients/ksu/pam.c
 @@ -0,0 +1,389 @@
@@ -698,7 +698,7 @@
 +#endif
 diff --git a/src/clients/ksu/pam.h b/src/clients/ksu/pam.h
 new file mode 100644
-index 000000000..0ab76569c
+index 0000000000..0ab76569cb
 --- /dev/null
 +++ b/src/clients/ksu/pam.h
 @@ -0,0 +1,57 @@
@@ -760,10 +760,10 @@
 +void appl_pam_cleanup(void);
 +#endif
 diff --git a/src/configure.ac b/src/configure.ac
-index 4eb080784..693f76a81 100644
+index f03028b5fd..aa970b0447 100644
 --- a/src/configure.ac
 +++ b/src/configure.ac
-@@ -1389,6 +1389,8 @@ AC_SUBST(VERTO_VERSION)
+@@ -1400,6 +1400,8 @@ AC_SUBST(VERTO_VERSION)
  
  AC_PATH_PROG(GROFF, groff)
  
@@ -772,3 +772,6 @@
  # Make localedir work in autoconf 2.5x.
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
+-- 
+2.38.1
+

_service:tar_scm:krb5-1.19.2.tar.gz.asc Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/doc/kadm5/api-unit-test.tex Deleted

@@ -1,2680 +0,0 @@
-% This document is included for historical purposes only, and does not
-% apply to krb5 today.
-
-\documentstyletimes,fullpage{article}
-
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%% Make _ actually generate an _, and allow line-breaking after it.
-\let\underscore=\_
-\catcode`_=13
-\def_{\underscore\penalty75\relax}
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
-\newcommand{\test}1{\begin{description}
-\setlength{\itemsep}{0pt}
-#1
-\end{description}
-
-}
-
-\newcommand{\numtest}2{\begin{description}
-\setlength{\itemsep}{0pt}
-\Number{#1}
-#2
-\end{description}
-
-}
-
-\newcommand{\Number}1{\itemNumber: #1}
-\newcommand{\Reason}1{\itemReason: #1}
-\newcommand{\Expected}1{\itemExpected: #1}
-\newcommand{\Conditions}1{\itemConditions: #1}
-\newcommand{\Priority}1{\itemPriority: #1}
-\newcommand{\Status}1{\itemStatus: #1}
-\newcommand{\Vtwonote}1{\itemV2 note: #1}
-\newcommand{\Version}1{\itemVersion: #1}
-\newcommand{\Call}1{}
-%\newcommand{\Call}1{\itemCall: #1}
-%\newcommand{\Number}1{}
-%\newcommand{\Reason}1{}
-%\newcommand{\Expected}1{}
-%\newcommand{\Conditions}1{}
-%\newcommand{\Priority}1{}
-
-\title{KADM5 Admin API\\
-Unit Test Description}
-\author{Jonathan I. Kamens}
-
-\begin{document}
-
-\maketitle
-
-%\tableofcontents
-
-\section{Introduction}
-
-The following is a description of a black-box unit test of the KADM5
-API.  Each API function is listed, followed by the tests that should be
-performed on it.
-
-The tests described here are based on the ``Kerberos Administration
-System KADM5 API Functional Specifications'', revision 1.68.  This
-document was originally written based on the OpenVision API functional
-specifications, version 1.41, dated August 18, 1994, and many
-indications of the original version remain.
-
-All tests which test for success should verify, using some means other
-than the return value of the function being tested, that the requested
-operation was successfully performed.  For example: for init, test
-that other operations can be performed after init; for destroy, test
-that other operations can't be performed after destroy; for modify
-functions, verify that all modifications to the database which should
-have taken place did, and that the new, modified data is in effect;
-for get operations, verify that the data retrieved is the data that
-should actually be in the database.
-
-The tests would be better if they compared the actual contents of the
-database before and after each test, rather than relying on the KADM5
-API to report the results of changes.
-
-Similarly, all tests which test for failure should verify that the
-no component of the requested operation took place.  For example: if
-init fails, other operations should not work.  If a modify fails, all
-data in the database should be the same as it was before the attempt
-to modify, and the old data should still be what is enforced.
-Furthermore, tests which test for failure should verify that the
-failure code returned is correct for the specific failure condition
-tested.
-
-Most of the tests listed below should be run twice -- once locally on
-the server after linking against the server API library, and once
-talking to the server via authenticated Sun RPC after linking against
-the client API library.  Tests which should only be run locally or via
-RPC are labelled with a ``local'' or ``RPC''.
-
-Furthermore, in addition to the tests labelled below, a test should be
-implemented to verify that a client can't perform operations on the
-server through the client API library when it's linked against
-standard Sun RPC instead of OpenV*Secure's authenticated Sun RPC.
-This will require a client with a modified version of ovsec_kadm_init
-which doesn't call auth_gssapi_create.  This client should call this
-modified ovsec_kadm_init and then call some other admin API function,
-specifying arguments to both functions that would work if the
-authenticated Sun RPC had been used, but shouldn't if authentication
-wasn't used.  The test should verify that the API function call after
-the init doesn't succeed.
-
-There is also another test to see if all the API functions handle getting an
-invalid server handle correctly. This is not done as part of the tests that
-are run through the TCL program cause the TCL program has no way of
-invalidating a server handle.  So there is a program that calls init and
-changes the handle magic number, and then attempts to call each API function
-with the corrupted server handle.
-
-A number of tests have been added or changed to correspond with KADM5
-API version 2.  Tests which are only performed against the newer
-version specify the version number in the test description.
-
-\section{ovsec_kadm_init}
-
-\numtest{1}{
-\Reason{An empty string realm is rejected.}
-\Status{Implemented}
-\Vtwonote{The empty string is now passed as the realm field of the
-parameters structure.}
-}
-
-\numtest{2}{
-\Reason{A realm containing invalid characters is rejected.}
-\Status{Implemented}
-\Vtwonote{The invalid character is now passed as the realm field of the
-parameters structure.}
-}
-
-\numtest{2.5}{
-\Reason{A non-existent realm is rejected.}
-\Status{Implemented}
-\Vtwonote{The non-existent realm is now passed as the realm field of the
-parameters structure.}
-}
-
-\numtest{3}{
-\Reason{A bad service name representing an existing principal
-	(different from the client principal) is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{4}{
-\Reason{A bad service name representing a non-existent
-		principal is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{5}{
-\Reason{A bad service name identical to the (existing) client
-		name is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{6}{
-\Reason{A null password causes password prompting.}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Reason{An empty-string causes password prompting}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Reason{An incorrect password which is the password of another
-		user is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Reason{An incorrect password which isn't the password of any
-		user is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Reason{A null client_name is rejected.}
-\Status{Implemented}
-}
-
-% Empty string client name is legal.
-%\numtest{11}{
-%\Reason{An empty-string client_name is rejected.}
-%}
-
-\numtest{12}{
-\Reason{A client_name referring to a non-existent principal in
-		the default realm is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Reason{A client_name referring to a non-existent principal
-		with the local realm specified explicitly is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Reason{A client_name referring to a non-existent principal in
-	a nonexistent realm is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{15}{
-\Reason{A client_name referring to an existing principal in a
-	nonexistent realm is rejected.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{16}{
-\Reason{Valid invocation.}
-\Status{Implemented}
-}
-
-\numtest{17}{
-\Reason{Valid invocation (explicit client realm).}
-\Status{Implemented}
-}
-
-\numtest{18}{
-\Reason{Valid invocation (CHANGEPW_SERVICE).}
-\Status{Implemented}
-}
-
-\numtest{19}{
-\Reason{Valid invocation (explicit service realm).}
-\Status{Implemented}
-\Vtwonote{The explicit realm is now passed as the realm field of the
-configuration parameters.}
-}
-
-\numtest{20}{
-\Reason{Valid invocation (database access allowed after init).}
-\Status{Implemented}
-}
-
-%\numtest{21}{
-%\Reason{Init fails when called twice in a row.}
-%\Status{Implemented}
-%}
-
-\numtest{22}{
-\Reason{A null password causes master-key prompting.}
-\Conditions{local}
-\Status{Implemented}
-\Vtwonote{Obsolete.}
-}
-
-\numtest{22.5}{
-\Reason{A empty string password causes master-key prompting.}
-\Conditions{local}
-\Status{Implemented}
-\Vtwonote{Obsolete.}
-}
-
-%\numtest{23}{
-%\Reason{A non-null password causes reading from the kstash.}
-%\Conditions{local}
-%\Status{Implemented}
-%}
-
-\numtest{24}{
-\Reason{Null service name is ignored in local invocation.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{25}{
-\Reason{Non-null service name is ignored in local invocation.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-%\numtest{26}{
-%\Reason{Can't do ``get'' operation before calling init.}
-%\Status{Implemented}
-%}
-
-%\numtest{27}{
-%\Reason{Can't do ``add'' operation before calling init.}
-%\Status{Implemented}
-%}
-
-%\numtest{28}{
-%\Reason{Can't do ``modify'' operation before calling init.}
-%\Status{Implemented}
-%}
-
-%\numtest{29}{
-%\Reason{Can't do ``delete'' operation before calling init.}
-%\Status{Implemented}
-%}
-
-\numtest{30}{
-\Reason{Can init after failed init attempt.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{31}{
-\Priority{High}
-\Reason{Return BAD_STRUCT_VERSION when the mask bits are set to invalid values}
-\Status{Implemented}
-}
-
-\numtest{32}{
-\Priority{High}
-\Reason{Return BAD_STRUCT_VERSION when the mask bits are not set}
-\Status{Implemented}
-}
-
-\numtest{33}{
-\Priority{High}
-\Reason{Return OLD_STRUCT_VERSION when attempting to use an old/unsupported
-	structure version}
-\Status{Implemented}
-}
-
-\numtest{34}{
-\Priority{High}
-\Reason{Return NEW_STRUCT_VERSION when attempting to use a newer version of
-	of the structure then what is supported}
-\Status{Implemented}
-}
-
-\numtest{35}{
-\Priority{High}
-\Reason{Return BAD_API_VERSION when the mask bits are set to invalid values}
-\Status{Implemented}
-}
-
-\numtest{36}{
-\Priority{High}
-\Reason{Return BAD_API_VERSION when the mask bits are not set}
-\Status{Implemented}
-}
-
-\numtest{37}{
-\Priority{High}
-\Reason{Return OLD_LIB_API_VERSION when using an old/unsuppored
-	api version number}
-\Conditions{RPC}	
-\Status{Implemented}
-}
-
-\numtest{38}{
-\Priority{High}
-\Reason{Return OLD_SERVER_API_VERSION attempting to use an
-	old/unsupported api version number}
-\Conditions{local}	
-\Status{Implemented}
-}
-
-\numtest{39}{
-\Priority{High}
-\Reason{Return NEW_LIB_API_VERSION when using a newer api
-	version number then supported}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{40}{
-\Priority{High}
-\Reason{Return NEW_SERVER_API_VERSION when using a newer api version
-	number then supported}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{41}{
-\Priority{High}
-\Reason{Return BAD_XXX_VERSION when the API and the structure
-	version numbers are reversed}
-\Status{Implemented}
-}
-
-\numtest{42}{
-\Priority{High}
-\Reason{Succeeds when using valid api and struct version numbers and masks}
-\Status{Implemented}
-}
-
-\numtest{43}{
-\Priority{Low}
-\Reason{Returns two different server handle when called twice with same info}
-}
-
-\numtest{44}{
-\Priority{Low}
-\Reason{Returns two different server handles when called twice with
-	different  info}
-}
-
-\numtest{45}{
-\Priority{Bug fix, secure-install/3390}
-\Reason{Returns SECURE_PRINC_MISSING when ADMIN_SERVICE does not
-exist.}
-\Status{Implemented}
-}
-
-\numtest{46}{
-\Priority{Bug fix, secure-install/3390}
-\Reason{Returns SECURE_PRINC_MISSING when CHANGEPW_SERVICE does not
-exist.}
-\Status{Implemented}
-}
-
-\numtest{100}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the profile field of the configuration parameters, if
-set.}
-\Status{Implemented}
-}
-
-\numtest{101}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the kadmind_port field of the configuration parameters,
-if set.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{102}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the admin_server field of the configuration parameters,
-if set with only an admin server name.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{102.5}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the admin_server field of the configuration parameters,
-if set with a host name and port number.}
-\Conditions{RPC}
-}
-
-\numtest{103}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the dbname field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{104}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the admin_dbname field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{105}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the admin_lockfile field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{106}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the mkey_from_kbd field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{107}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the stash_file field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{108}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the mkey_name field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{109}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the max_life field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{110}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the max_rlife field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{111}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the expiration field of the configuration parameters, if
-set.}
-\Status{Implemented}
-\Conditions{local}
-}
-
-\numtest{112}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the flags field of the configuration parameters, if
-set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{113}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Obeys the keysalts and num_keysalts field of the configuration
-parameters, if set.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{114}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Returns KADM5_BAD_SERVER_PARAMS if any client-only parameters
-are specified to server-side init.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{115}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Returns KADM5_BAD_CLIENT_PARAMS if any client-only parameters
-are specified to server-side init.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{116}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Two calls to init with clients having different privileges
-succeeds, and both clients maintain their correct privileges.}
-\Priority{Bug fix}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{117}{
-\Version{KADM5_API_VERSION_2}
-\Reason{The max_life field defaults to value specified in the API
-Functional Specification when kdc.conf is unreadable.}
-\Priority{Bug fix, krb5-admin/18}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{150}{
-\Version{KADM5_API_VERSION_2}
-\Reason{init_with_creds works when given an open ccache with a valid
-credential for ADMIN_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{151}{
-\Version{KADM5_API_VERSION_2}
-\Reason{init_with_creds works when given an open ccache with a valid
-credential for CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{152}{
-\Version{KADM5_API_VERSION_2}
-\Reason{init_with_creds fails with KRB5_FCC_NOFILE (was
-  KADM5_GSS_ERROR) when given an open
-ccache with no credentials.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{153}{
-\Version{KADM5_API_VERSION_2}
-\Reason{init_with_creds fails with KRB5_CC_NOTFOUND (was
-  KADM5_GSS_ERROR) when given an open
-ccache without credentials for ADMIN_SERVICE or CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{154}{
-\Version{KADM5_API_VERSION_2}
-\Reason{If the KRB5_KDC_PROFILE environment variable is set to a filename
-that does not exist, init fails with ENOENT.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\section{ovsec_kadm_destroy}
-
-\numtest{1}{
-\Reason{Valid invocation.}
-\Status{Implemented}
-}
-
-%\numtest{2}{
-%\Reason{Valid invocation (``get'' not allowed after destroy).}
-%\Status{Implemented}
-%}
-
-%\numtest{3}{
-%\Reason{Valid invocation (``add'' not allowed after destroy).}
-%\Status{Implemented}
-%}
-
-%\numtest{4}{
-%\Reason{Valid invocation (``modify'' not allowed after destroy).}
-%\Status{Implemented}
-%}
-
-%\numtest{5}{
-%\Reason{Valid invocation (``delete'' not allowed after destroy).}
-%\Status{Implemented}
-%}
-
-%\numtest{6}{
-%\Reason{Fails if database not initialized.}
-%\Status{Implemented}
-%}
-
-%\numtest{7}{
-%\Reason{Fails if invoked twice in a row.}
-%\Status{Implemented}
-%}
-
-\numtest{8}{
-\Reason{Database can be reinitialized after destroy.}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{client}
-}
-
-\section{ovsec_kadm_create_principal}
-
-%In the tests below, ``getu'' refers to a user who has only ``get'' access,
-%''addu'' refers to a user who has only ``add'' access, ``modifyu'' refers to
-%a user who has only ``modify'' access, and ``deleteu'' refers to a user
-%who has only ``delete'' access. ``amu'' refers to a user with ``add'' and
-%''modify'' access.  ``new_princ'' refers to a principal entry structure
-%filled in as follows:
-%
-%	krb5_parse_name("newuser", \&new_princ.principal);
-%	krb5_timeofday(\&new_princ.princ_expire_time);
-%		new_princ.princ_expire_time += 130;
-%	krb5_timeofday(\&new_princ.last_pwd_change);
-%		new_princ.last_pwd_change += 140;
-%	krb5_timeofday(\&new_princ.pw_expiration);
-%		new_princ.pw_expiration += 150;
-%	new_princ.max_life = 160;
-%	krb5_parse_name("usera", \&new_princ.mod_name);
-%	krb5_timeofday(\&new_princ.mod_date);
-%		new_princ.mod_date += 170;
-%	new_princ.attributes = 0xabcdabcd;
-%	new_princ.kvno = 180;
-%	new_princ.mkvno = 190;
-%	new_princ.policy = null;
-%	new_princ.aux_attributes = 0xdeadbeef;
-%
-%The offsets of 130 through 190 above are used to ensure that the
-%fields are all known to be different from each other, so that
-%accidentally switched fields can be detected.  Some of the fields in
-%this structure may be changed by the tests, but they should clean up
-%after themselves.
-
-%\numtest{1}{
-%\Reason{Fails if database not initialized.}
-%\Status{Implemented}
-%}
-
-\numtest{2}{
-\Reason{Fails on null princ argument.}
-\Status{Implemented}
-}
-
-\numtest{3}{
-\Reason{Fails on null password argument.}
-\Status{Implemented}
-}
-
-\numtest{4}{
-\Reason{Fails on empty-string password argument.}
-\Status{Implemented}
-}
-
-\numtest{5}{
-\Reason{Fails when mask contains undefined bit.}
-\Status{Implemented}
-}
-
-\numtest{6}{
-\Reason{Fails when mask contains LAST_PWD_CHANGE bit.}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Reason{Fails when mask contains MOD_TIME bit.}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Reason{Fails when mask contains MOD_NAME bit.}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Reason{Fails when mask contains MKVNO bit.}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Reason{Fails when mask contains AUX_ATTRIBUTES bit.}
-\Status{Implemented}
-}
-
-\numtest{11}{
-\Reason{Fails when mask contains POLICY_CLR bit.}
-\Status{Implemented}
-}
-
-\numtest{12}{
-\Reason{Fails for caller with no access bits.}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Reason{Fails when caller has ``get'' access and not ``add''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Reason{Fails when caller has ``modify'' access and not ``add''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{15}{
-\Reason{Fails when caller has ``delete'' access and not ``add''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{16}{
-\Reason{Fails when caller connected with CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{17}{
-\Reason{Fails on attempt to create existing principal.}
-\Status{Implemented}
-}
-
-\numtest{18}{
-\Reason{Fails when password is too short.}
-\Status{Implemented}
-}
-
-\numtest{19}{
-\Reason{Fails when password has too few classes.}
-\Status{Implemented}
-}
-
-\numtest{20}{
-\Reason{Fails when password is in dictionary.}
-\Status{Implemented}
-}
-
-\numtest{21}{
-\Reason{Nonexistent policy is rejected.}
-\Status{Implemented}
-}
-
-\numtest{22}{
-\Reason{Fails on invalid principal name.}
-\Status{Implemented}
-}
-
-\numtest{23}{
-\Reason{Valid invocation.}
-\Status{Implemented}
-}
-
-\numtest{24}{
-\Reason{Succeeds when caller has ``add'' access and another one.}
-\Status{Implemented}
-}
-
-%\numtest{25}{
-%\Reason{Fails when password is too short, when override_qual is true.}
-%}
-
-%\numtest{26}{
-%\Reason{Fails when password has too few classes, when
-%		override_qual is true.}
-%}
-
-%\numtest{27}{
-%\Reason{Fails when password is in dictionary, when override_qual is
-%		true.}
-%}
-
-\numtest{28}{
-\Reason{Succeeds when assigning policy.}
-\Status{Implemented}
-}
-
-\numtest{29}{
-\Priority{High}
-\Reason{Allows 0 (never) for princ_expire_time.}
-\Status{Implemented}
-}
-
-\numtest{30}{
-\Reason{Allows 0 (never) for pw_expiration when there's no policy.}
-\Status{Implemented}
-}
-
-\numtest{31}{
-\Reason{Allows 0 (never) for pw_expiration when there's a policy with
-	0 for pw_max_life.}
-\Status{Implemented}
-}
-
-\numtest{32}{
-\Reason{Accepts 0 (never) for pw_expiration when there's a policy with
-	non-zero pw_max_life, and sets pw_expiration to zero.}
-\Status{Implemented}	
-}
-
-\numtest{33}{
-\Reason{Accepts and sets non-zero pw_expiration when no policy.}
-\Status{Implemented}
-}
-
-\numtest{34}{
-\Reason{Accepts and sets non-zero pw_expiration when there's a policy
-	with zero pw_max_life.}
-\Status{Implemented}	
-}
-
-\numtest{35}{
-\Reason{Accepts and sets non-zero pw_expiration when there's a policy
-	with pw_max_life later than the specified pw_expiration.}
-\Status{Implemented}	
-}
-
-\numtest{36}{
-\Reason{Accepts and sets non-zero pw_expiration greater than now_pw_max_life.}
-\Status{Implemented}	
-}
-
-\numtest{37}{
-\Priority{High}
-\Reason{Sets pw_expiration to 0 (never) if there's no policy and no
-	specified pw_expiration.}
-\Status{Implemented}	
-}
-
-\numtest{38}{
-\Priority{High}
-\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the
-	policy has a 0 (never) pw_max_life.}
-\Status{Implemented}	
-}
-
-\numtest{39}{
-\Priority{High}
-\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified
-	and the policy has a non-zero pw_max_life.}
-\Status{Implemented}	
-}
-
-\numtest{40}{
-\Priority{High}
-\Reason{Allows 0 (forever) for max_life.}
-\Status{Implemented}
-}
-
-\numtest{41}{
-\Priority{High}
-\Reason{Doesn't modify or free mod_name on success.}
-}
-
-\numtest{42}{
-\Priority{High}
-\Reason{Doesn't modify or free mod_name on failure.}
-}
-
-\numtest{43}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{44}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-
-\section{ovsec_kadm_delete_principal}
-
-%\numtest{1}{
-%\Reason{Fails if database not initialized.}
-%\Status{Implemented}
-%}
-
-\numtest{2}{
-\Reason{Fails on null principal.}
-\Status{Implemented}
-}
-
-% Empty string principal is legal.
-%\numtest{3}{
-%\Reason{Fails on empty-string principal.}
-%}
-
-% There is not invalid principal names
-%\numtest{4}{
-%\Reason{Fails on invalid principal name.}
-%}
-
-\numtest{5}{
-\Priority{High}
-\Reason{Fails on nonexistent principal.}
-\Status{Implemented}
-}
-
-\numtest{6}{
-\Priority{High}
-\Reason{Fails when caller connected with CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Priority{High}
-\Reason{Fails if caller has ``add'' access and not ``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Priority{High}
-\Reason{Fails if caller has ``modify'' access and not ``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Priority{High}
-\Reason{Fails if caller has ``get'' access and not ``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Priority{High}
-\Reason{Fails if caller has no access bits.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{11}{
-\Priority{High}
-\Reason{Valid invocation.}
-\Status{Implemented}
-}
-
-\numtest{12}{
-\Priority{High}
-\Reason{Valid invocation (on principal with policy).}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-
-\section{ovsec_kadm_modify_principal}
-
-%\numtest{1}{
-%\Reason{Fails if database not initialized.}
-%\Status{Implemented}
-%}
-
-\numtest{2}{
-\Priority{High}
-\Reason{Fails if user connected with CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{3}{
-\Reason{Fails on mask with undefined bit set.}
-\Status{Implemented}
-}
-
-\numtest{4}{
-\Reason{Fails on mask with PRINCIPAL set.}
-\Status{Implemented}
-}
-
-\numtest{5}{
-\Priority{High}
-\Reason{Fails on mask with LAST_PWD_CHANGE set.}
-\Status{Implemented}
-}
-
-\numtest{6}{
-\Reason{Fails on mask with MOD_TIME set.}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Reason{Fails on mask with MOD_NAME set.}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Reason{Fails on mask with MKVNO set.}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Priority{High}
-\Reason{Fails on mask with AUX_ATTRIBUTES set.}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Reason{Fails on nonexistent principal.}
-\Status{Implemented}
-}
-
-\numtest{11}{
-\Priority{High}
-\Reason{Fails for user with no access bits.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{12}{
-\Priority{High}
-\Reason{Fails for user with ``get'' access.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Priority{High}
-\Reason{Fails for user with ``add'' access.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Priority{High}
-\Reason{Fails for user with ``delete'' access.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{15}{
-\Priority{High}
-\Reason{Succeeds for user with ``modify'' access.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{16}{
-\Reason{Succeeds for user with ``modify'' and another access.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{17}{
-\Priority{High}
-\Reason{Fails when nonexistent policy is specified.}
-\Status{Implemented}
-}
-
-\numtest{18}{
-\Priority{High}
-\Reason{Succeeds when existent policy is specified.}
-\Status{Implemented}
-}
-
-\numtest{19}{
-\Reason{Updates policy count when setting policy from none.}
-\Status{Implemented}
-}
-
-\numtest{20}{
-\Reason{Updates policy count when clearing policy from set.}
-\Status{Implemented}
-}
-
-\numtest{21}{
-\Reason{Updates policy count when setting policy from other policy.}
-\Status{Implemented}
-}
-
-\numtest{21.5}{
-\Reason{Policy reference count remains unchanged when policy is
-	changed to itself.}
-\Status{Implemented.}
-}
-
-\numtest{22}{
-\Reason{Allows 0 (never) for pw_expiration when there's no policy.}
-\Status{Implemented}
-}
-
-\numtest{23}{
-\Reason{Allows 0 (never) for pw_expiration when there's a policy with
-	0 for pw_max_life.}
-\Status{Implemented}
-}
-
-\numtest{24}{
-\Reason{Accepts 0 (never) for pw_expiration when there's a policy with
-	non-zero pw_max_life, but actually sets pw_expiration to
-	last_pwd_change + pw_max_life.}
-\Status{Implemented}
-}
-
-\numtest{25}{
-\Reason{Accepts and sets non-zero pw_expiration when no policy.}
-\Status{Implemented}
-}
-
-\numtest{26}{
-\Reason{Accepts and sets non-zero pw_expiration when there's a policy
-	with zero pw_max_life.}
-\Status{Implemented}	
-}
-
-\numtest{27}{
-\Reason{Accepts and sets non-zero pw_expiration when there's a policy
-	with pw_max_life later than the specified pw_expiration.}
-\Status{Implemented}	
-}
-
-\numtest{28}{
-\Reason{Accepts non-zero pw_expiration and limits it to last_pwd_change +
-	pw_max_life when it's later than last_pwd_change + non-zero
-	pw_max_life in policy.}
-\Status{Implemented}	
-}
-
-\numtest{29}{
-\Priority{High}
-\Reason{Sets pw_expiration to 0 (never) when a policy is cleared and
-no pw_expiration is specified.}
-\Status{Implemented}	
-}
-
-\numtest{30}{
-\Priority{High}
-\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the
-	new policy has a 0 (never) pw_max_life.}
-\Status{Implemented}	
-}
-
-\numtest{31}{
-\Priority{High}
-\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified
-	and the new policy has a non-zero pw_max_life.}
-\Status{Implemented}	
-}
-
-\numtest{32}{
-\Priority{High}
-\Reason{Accepts princ_expire_time change.}
-\Status{Implemented}
-}
-
-
-
-\numtest{33}{
-\Priority{High}
-\Reason{Accepts attributes change.}
-\Status{Implemented}
-}
-
-\numtest{33.25}{
-\Priority{High}
-\Reason{Accepts attributes change (KRB5_KDB_REQUIRES_PW_CHANGE).}
-\Status{Implemented}
-}
-
-\numtest{33.5}{
-\Priority{High}
-\Reason{Accepts attributes change (KRB5_DISALLOW_TGT_BASE).}
-\Status{Implemented}
-}
-
-\numtest{33.75}{
-\Priority{High}
-\Reason{Accepts attributes change (KRB5_PW_CHANGE_SERVICE).}
-\Status{Implemented}
-}
-
-\numtest{34}{
-\Priority{High}
-\Reason{Accepts max_life change.}
-\Status{Implemented}
-}
-
-\numtest{35}{
-\Priority{High}
-\Reason{Accepts kvno change.}
-\Status{Implemented}
-}
-
-\numtest{36}{
-\Reason{Behaves correctly when policy is set to the same as it was
-	before.}
-\Status{Implemented}	
-}
-
-\numtest{37}{
-\Reason{Behaves properly when POLICY_CLR is specified and there was no
-	policy before.}
-\Status{Implemented}	
-}
-
-\numtest{38}{
-\Priority{High}
-\Reason{Accepts 0 (never) for princ_expire_time.}
-\Status{Implemented}
-}
-
-\numtest{39}{
-\Priority{High}
-\Reason{Accepts 0 for max_life.}
-\Status{Implemented}
-}
-
-\numtest{40}{
-\Reason{Rejects null principal argument.}
-\Status{Implemented}
-}
-
-\numtest{41}{
-\Priority{High}
-\Reason{Doesn't modify or free mod_name on success.}
-}
-
-\numtest{42}{
-\Priority{High}
-\Reason{Doesn't modify or free mod_name on failure.}
-}
-
-\numtest{43}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{44}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-\numtest{100}{
-\Version{KADM5_API_VERSION_2}
-\Priority{bug-fix}
-\Reason{Accepts max_rlife change.}
-\Status{Implemented}
-}
-
-\numtest{101}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Rejects last_success change.}
-\Status{Implemented}
-}
-
-\numtest{102}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Rejects last_failed change.}
-\Status{Implemented}
-}
-
-\numtest{103}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Rejects fail_auth_count change.}
-\Status{Implemented}
-}
-
-\numtest{103.5}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Rejects key_data change.}
-\Status{Implemented}
-}
-
-\numtest{104}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Accepts tl_data change when all types are greater than 256.}
-\Status{Implemented}
-}
-
-\numtest{105}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Returns KADM5_BAD_TL_TYPE when given tl_data with a type less
-than 256.} 
-\Status{Implemented}
-}
-
-\section{ovsec_kadm_rename_principal}
-
-%\numtest{1}{
-%\Reason{Fails if database not initialized.}
-%\Status{Implemented}
-%}
-
-\numtest{2}{
-\Priority{High}
-\Reason{Fails if user connected with CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{3}{
-\Priority{High}
-\Reason{Fails for user with no access bits.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{4}{
-\Reason{Fails for user with ``modify'' access and not ``add'' or
-``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{5}{
-\Reason{Fails for user with ``get'' access and not ``add'' or
-``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{6}{
-\Reason{Fails for user with ``modify'' and ``add'' but not ``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Reason{Fails for user with ``modify'' and ``delete'' but not ``add''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Reason{Fails for user with ``get'' and ``add'' but not ``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Reason{Fails for user with ``get'' and ``delete'' but not ``add.''}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Reason{Fails for user with ``modify'', ``get'' and ``add'', but not
-	``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{11}{
-\Reason{Fails for user with ``modify'', ``get'' and ``delete'', but
-	not ``add''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{12}{
-\Priority{High}
-\Reason{Fails for user with ``add'' but not ``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Priority{High}
-\Reason{Fails for user with ``delete'' but not ``add''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Priority{High}
-\Reason{Succeeds for user with ``add'' and ``delete'', when that user
-has non-name-based salt.}
-\Status{Implemented}
-}
-
-\numtest{15}{
-\Priority{High}
-\Reason{Fails if target principal name exists.}
-\Status{Implemented}
-}
-
-\numtest{16}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{17}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-\numtest{18}{
-\Priority{bug fix}
-\Reason{Returns NO_RENAME_SALT when asked to rename a principal whose
-salt depends on the principal name.}
-\Status{Implemented}
-}
-
-\section{ovsec_kadm_chpass_principal}
-\label{ovseckadmchpassprincipal}
-
-\subsection{Quality/history enforcement tests}
-
-This section lists a series of tests which will be run a number of
-times, with various parameter settings (e.g., which access bits user
-has, whether user connected with ADMIN_SERVICE or CHANGEPW_SERVICE,
-etc.).  The table following the
-list of tests gives the various parameter settings under which the
-tests should be run, as well which should succeed and which should
-fail for each choice of parameter settings.
-
-\subsubsection{List of tests}
-
-The test number of each of these tests is an offset from the base
-given in the table below.
-
-\numtest{1}{
-\Priority{High}
-\Reason{With history setting of 1, change password to itself.}
-}
-
-\numtest{2}{
-\Reason{With history setting of 2 but no password changes since
-	principal creation, change password to itself.}
-}
-
-\numtest{3}{
-\Reason{With history setting of 2 and one password change since
-	principal creation, change password to itself
-	and directly previous password.}
-}
-
-\numtest{4}{
-\Priority{High}
-\Reason{With a history setting of 3 and no password changes,
-	change password to itself.}
-}
-
-\numtest{5}{
-\Priority{High}
-\Reason{With a history setting of 3 and 1 password change,
-	change password to itself or previous password.}
-}
-
-\numtest{6}{
-\Priority{High}
-\Reason{With a history setting of 3 and 2 password changes,
-	change password to itself and the two previous passwords.}
-}
-
-\numtest{7}{
-\Priority{High}
-\Reason{Change to previously unused password when now -
-	last_pwd_change $<$ pw_min_life.}
-}
-
-\numtest{8}{
-\Priority{High}
-\Reason{Change to previously unused password that doesn't contain enough
-	character classes.}
-}
-
-\numtest{9}{
-\Priority{High}
-\Reason{Change to previously unused password that's too short.}
-}
-
-\numtest{10}{
-\Priority{High}
-\Reason{Change to previously unused password that's in the dictionary.}
-}
-
-\subsubsection{List of parameter settings}
-
-In the table below, ``7 passes'' means that test 7 above passes and
-the rest of the tests fail.
-
-\begin{tabular}{llllll}
-Base & Modify access? & Own password? & Service & Pass/Fail \\ \hline
-0 & No & Yes & ADMIN & all fail \\
-20 & No & Yes & CHANGEPW & all fail \\
-40 & No & No & ADMIN & all fail \\
-60 & No & No & CHANGEPW & all fail \\
-80 & Yes & Yes & ADMIN & 7 passes \\
-100 & Yes & Yes & CHANGEPW & all fail \\
-120 & Yes & No & ADMIN & 7 passes \\
-140 & Yes & No & CHANGEPW & all fail \\
-\end{tabular}
-
-\subsection{Other quality/history tests}
-
-\numtest{161}{
-\Priority{High}
-\Reason{With history of 1, can change password to anything other than
-	itself that doesn't conflict with other quality
-	rules.}
-}
-
-\numtest{162}{
-\Reason{With history of 2 and 2 password changes, can change password
-	to original password.}
-}
-
-\numtest{163}{
-\Priority{High}
-\Reason{With history of 3 and 3 password changes, can change password
-	to original password.}
-}
-
-\numtest{164}{
-\Priority{High}
-\Reason{Can change password when now - last_pwd_change $>$ pw_min_life.}
-}
-
-\numtest{165}{
-\Priority{High}
-\Reason{Can change password when it contains exactly the number of
-	classes required by the policy.}
-}
-
-\numtest{166}{
-\Priority{High}
-\Reason{Can change password when it is exactly the length required by
-	the policy.}
-}
-
-\numtest{167}{
-\Priority{High}
-\Reason{Can change password to a word that isn't in the dictionary.}
-}
-
-
-\subsection{Other tests}
-
-%\numtest{168}{
-%\Reason{Fails if database not initialized.}
-%}
-
-\numtest{169}{
-\Reason{Fails for non-existent principal.}
-}
-
-\numtest{170}{
-\Reason{Fails for null password.}
-}
-
-\numtest{171}{
-\Priority{High}
-\Reason{Fails for empty-string password.}
-}
-
-\numtest{172}{
-\Priority{High}
-\Reason{Pw_expiration is set to now + max_pw_life if policy exists and
-	has non-zero max_pw_life.}
-}
-
-\numtest{173}{
-\Priority{High}
-\Reason{Pw_expiration is set to 0 if policy exists and has zero
-	max_pw_life.}
-}
-
-\numtest{174}{
-\Priority{High}
-\Reason{Pw_expiration is set to 0 if no policy.}
-}
-
-\numtest{175}{
-\Priority{High}
-\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when password is
-	successfully changed.}
-}
-
-\numtest{176}{
-\Priority{High}
-\Reason{Fails for user with no access bits, on other's password.}
-}
-
-\numtest{177}{
-\Priority{High}
-\Reason{Fails for user with ``get'' but not ``modify'' access, on
-	other's password.}
-}
-
-\numtest{178}{
-\Reason{Fails for user with ``delete'' but not ``modify'' access, on
-	other's password.}
-}
-
-\numtest{179}{
-\Reason{Fails for user with ``add'' but not ``modify'' access, on
-	other's password.}
-}
-
-\numtest{180}{
-\Reason{Succeeds for user with ``get'' and ``modify'' access, on
-	other's password.}
-\Status{Implemented}	
-}
-
-\numtest{180.5}{
-\Priority{High}
-\Reason{Succeeds for user with ``modify'' but not ``get'' access, on
-	other's password.}
-\Conditions{RPC}
-\Status{Implemented}	
-}
-\numtest{180.625}{
-\Priority{High}
-\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE on
-	others password}
-\Conditions{RPC}
-\Status{Implemented}
-}
-\numtest{180.75}{
-\Priority{High}
-\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE
-	on other's password which has expired}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-%\numtest{181}{
-%\Reason{Password that would succeed if override_qual were false fails
-%	if override_qual is true.}
-%\Expected{Returns CANNOT_OVERRIDE.}
-%}
-
-\numtest{182}{
-\Priority{High}
-\Reason{Can not change key of ovsec_adm/history principal.}
-\Status{Implemented}
-}
-
-\numtest{183}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{184}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-\numtest{200}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Creates a key for the principal for each unique encryption
-type/salt type in use.}
-\Status{Implemented}
-}
-
-\section{ovsec_kadm_chpass_principal_util}
-
-Rerun all the tests listed for ovsec_kadm_chpass_principal above in
-Section \ref{ovseckadmchpassprincipal}.  Verify that they succeed
-and fail in the same circumstances.  Also verify that in each failure
-case, the error message returned in msg_ret is as specified in the
-functional specification.
-
-Also, run the following additional tests.
-
-\numtest{1}{
-\Reason{Null msg_ret is rejected.}
-}
-
-\numtest{2}{
-\Priority{High}
-\Reason{New password is put into pw_ret, when it's prompted for.}
-}
-
-\numtest{3}{
-\Priority{High}
-Reason{New password is put into pw_ret, when it's supplied by the
-	caller.}
-}
-
-\numtest{4}{
-\Priority{High}
-\Reason{Successful invocation when pw_ret is null.}
-}
-
-
-
-\section{ovsec_kadm_randkey_principal}
-
-\subsection{TOOSOON enforcement tests}
-
-This test should be run a number of times, as indicated in the table
-following it.  The table also indicates the expected result of each
-run of the test.
-
-\test{
-\Reason{Change key when now - last_pwd_change $<$ pw_min_life.}
-}
-
-\subsubsection{List of parameter settings}
-
-\begin{tabular}{llllll}
-Number & Modify Access? & Own Key? & Service & Pass/Fail & Implemented? \\ \hline
-1 & No & Yes & ADMIN & fail & Yes \\
-3 & No & Yes & CHANGEPW & fail & Yes \\
-5 & No & No & ADMIN & fail \\
-7 & No & No & CHANGEPW & fail \\
-9 & Yes & Yes & ADMIN & pass \\
-11 & Yes & Yes & CHANGEPW & fail \\
-13 & Yes & No & ADMIN & pass & Yes \\
-15 & Yes & No & CHANGEPW & fail & Yes \\
-\end{tabular}
-
-\subsection{Other tests}
-
-\numtest{17}{
-\Reason{Fails if database not initialized.}
-}
-
-\numtest{18}{
-\Reason{Fails for non-existent principal.}
-}
-
-\numtest{19}{
-\Reason{Fails for null keyblock pointer.}
-}
-
-\numtest{20}{
-\Priority{High}
-\Reason{Pw_expiration is set to now + max_pw_life if policy exists and
-	has non-zero max_pw_life.}
-}
-
-\numtest{21}{
-\Priority{High}
-\Reason{Pw_expiration is set to 0 if policy exists and has zero
-	max_pw_life.}
-}
-
-\numtest{22}{
-\Priority{High}
-\Reason{Pw_expiration is set to 0 if no policy.}
-}
-
-\numtest{23}{
-\Priority{High}
-\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when key is
-	successfully changed.}
-}
-
-\numtest{24}{
-\Priority{High}
-\Reason{Fails for user with no access bits, on other's password.}
-}
-
-\numtest{25}{
-\Priority{High}
-\Reason{Fails for user with ``get'' but not ``modify'' access, on
-	other's password.}
-\Vtwonote{Change-password instead of modify access.}
-}
-
-\numtest{26}{
-\Reason{Fails for user with ``delete'' but not ``modify'' access, on
-	other's password.}
-\Vtwonote{Change-password instead of modify access.}
-}
-
-\numtest{27}{
-\Reason{Fails for user with ``add'' but not ``modify'' access, on
-	other's password.}
-\Vtwonote{Change-password instead of modify access.}
-}
-
-\numtest{28}{
-\Reason{Succeeds for user with ``get'' and ``modify'' access, on
-	other's password.}
-\Status{Implemented}
-\Vtwonote{Change-password instead of modify access.}
-}
-
-\numtest{28.25}{
-\Priority{High}
-\Reason{Fails for user with get and modify access on others password
-	When conneceted with CHANGEPW_SERVICE}
-\Status{Implemented}
-\Vtwonote{Change-password instead of modify access.}
-}
-
-\numtest{28.5}{
-\Priority{High}
-\Reason{Succeeds for user with ``modify'' but not ``get'' access, on
-	other's password.}
-\Status{Implemented}
-\Vtwonote{Change-password instead of modify access.}
-}
-
-\numtest{29}{
-\Reason{The new key that's assigned is truly random. XXX not sure how
-	to test this.}
-}
-
-\numtest{30}{
-\Reason{Succeeds for own key, no other access bits when connecting with CHANGEPW service}
-\Status{Implemented}
-}
-\numtest{31}{
-\Reason{Succeeds for own key, no other access bits when connecting with ADMIM service}
-\Status{Implemented}
-}
-
-\numtest{32}{
-\Reason{Cannot change ovsec_adm/history key}
-\Status{Implemented}
-}
-
-\numtest{33}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{34}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-\numtest{100}{
-\Version{KADM5_API_VERSION_2}
-\Reason{Returns a key for each unique encryption type specified in the
-keysalts.}
-}
-
-\section{ovsec_kadm_get_principal}
-
-\numtest{1}{
-\Reason{Fails for null ent.}
-\Status{Implemented}
-}
-
-\numtest{2}{
-\Reason{Fails for non-existent principal.}
-\Status{Implemented}
-}
-
-\numtest{3}{
-\Priority{High}
-\Reason{Fails for user with no access bits, retrieving other principal.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{4}{
-\Priority{High}
-\Reason{Fails for user with ``add'' but not ``get'', getting principal
-	other than his own, using ADMIN_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{5}{
-\Reason{Fails for user with ``modify'' but not ``get'', getting
-	principal other than his own, using ADMIN_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{6}{
-\Reason{Fails for user with ``delete'' but not ``get'', getting
-	principal other than his own, using ADMIN_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Reason{Fails for user with ``delete'' but not ``get'', getting
-	principal other than his own, using CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Priority{High}
-\Reason{Fails for user with ``get'', getting principal other than his
-	own, using CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Priority{High}
-\Reason{Succeeds for user without ``get'', retrieving self, using
-	ADMIN_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Reason{Succeeds for user without ``get'', retrieving self, using
-	CHANGEPW_SERVICE.}
-\Status{Implemented}	
-}
-
-\numtest{11}{
-\Reason{Succeeds for user with ``get'', retrieving self, using
-	ADMIN_SERVICE.}
-\Status{Implemented}		
-}
-
-\numtest{12}{
-\Reason{Succeeds for user with ``get'', retrieving self, using
-	CHANGEPW_SERVICE.}
-\Status{Implemented}		
-}
-
-\numtest{13}{
-\Priority{High}
-\Reason{Succeeds for user with ``get'', retrieving other user, using
-	ADMIN_SERVICE.}
-\Status{Implemented}		
-}
-
-\numtest{14}{
-\Reason{Succeeds for user with ``get'' and ``modify'', retrieving
-	other principal, using ADMIN_SERVICE.}
-\Status{Implemented}		
-}
-
-\numtest{15}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{16}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-\numtest{100}{
-\Version{KADM5_API_VERSION_2}
-\Reason{If KADM5_PRINCIPAL_NORMAL_MASK is specified, the key_data and
-tl_data fields are NULL/zero.}
-\Status{Implemented}
-}
-
-\numtest{101}{
-\Version{KADM5_API_VERSION_2}
-\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain
-data but the contents are all NULL.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{102}{
-\Version{KADM5_API_VERSION_2}
-\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain
-data and the contents are all non-NULL.}
-\Conditions{local}
-\Status{Implemented}
-}
-
-\numtest{103}{
-\Version{KADM5_API_VERSION_2}
-\Reason{If KADM5_TL_DATA is specified, the tl_data field contains the
-correct tl_data and no entries whose type is less than 256.}
-\Status{Implemented}
-}
-
-
-\section{ovsec_kadm_create_policy}
-
-\numtest{1}{
-\Reason{Fails for mask with undefined bit set.}
-\Status{Implemented - untested}
-}
-
-\numtest{2}{
-\Priority{High}
-\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{3}{
-\Reason{Fails for mask without POLICY bit set.}
-\Status{Implemented - untested}
-}
-
-\numtest{4}{
-\Reason{Fails for mask with REF_COUNT bit set.}
-\Status{Implemented}
-}
-
-\numtest{5}{
-\Reason{Fails for invalid policy name.}
-\Status{Implemented - untested}
-}
-
-\numtest{6}{
-\Priority{High}
-\Reason{Fails for existing policy name.}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Reason{Fails for null policy name.}
-\Status{Implemented - untested}
-}
-
-\numtest{8}{
-\Priority{High}
-\Reason{Fails for empty-string policy name.}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Priority{High}
-\Reason{Accepts 0 for pw_min_life.}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Priority{High}
-\Reason{Accepts non-zero for pw_min_life.}
-\Status{Implemented}
-}
-
-\numtest{11}{
-\Priority{High}
-\Reason{Accepts 0 for pw_max_life.}
-\Status{Implemented}
-}
-
-\numtest{12}{
-\Priority{High}
-\Reason{Accepts non-zero for pw_max_life.}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Priority{High}
-\Reason{Rejects 0 for pw_min_length.}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Priority{High}
-\Reason{Accepts non-zero for pw_min_length.}
-\Status{Implemented}
-}
-
-\numtest{15}{
-\Priority{High}
-\Reason{Rejects 0 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{16}{
-\Priority{High}
-\Reason{Accepts 1 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{17}{
-\Priority{High}
-\Reason{Accepts 4 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{18}{
-\Priority{High}
-\Reason{Rejects 5 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{19}{
-\Priority{High}
-\Reason{Rejects 0 for pw_history_num.}
-\Status{Implemented}
-}
-
-\numtest{20}{
-\Priority{High}
-\Reason{Accepts 1 for pw_history_num.}
-\Status{Implemented}
-}
-
-\numtest{21}{
-\Priority{High}
-\Reason{Accepts 10 for pw_history_num.}
-\Status{Implemented}
-}
-
-\numtest{21.5}{
-\Reason{Rejects 11 for pw_history_num.}
-\Status{Implemented - untested}
-}
-
-\numtest{22}{
-\Priority{High}
-\Reason{Fails for user with no access bits.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{23}{
-\Priority{High}
-\Reason{Fails for user with ``get'' but not ``add''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{24}{
-\Reason{Fails for user with ``modify'' but not ``add.''}
-\Conditions{RPC}
-\Status{Implemented - untested}
-}
-
-\numtest{25}{
-\Reason{Fails for user with ``delete'' but not ``add.''}
-\Conditions{RPC}
-\Status{Implemented - untested}
-}
-
-\numtest{26}{
-\Priority{High}
-\Reason{Succeeds for user with ``add.''}
-\Status{Implemented}
-}
-
-\numtest{27}{
-\Reason{Succeeds for user with ``get'' and ``add.''}
-\Status{Implemented - untested}
-}
-
-\numtest{28}{
-\Reason{Rejects null policy argument.}
-\Status{Implemented - untested}
-}
-
-\numtest{29}{
-\Reason{Rejects pw_min_life greater than pw_max_life.}
-}
-
-\numtest{30}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{31}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-
-\section{ovsec_kadm_delete_policy}
-
-\numtest{1}{
-\Reason{Fails for null policy name.}
-}
-
-\numtest{2}{
-\Priority{High}
-\Reason{Fails for empty-string policy name.}
-\Status{Implemented}
-}
-
-\numtest{3}{
-\Reason{Fails for non-existent policy name.}
-}
-
-\numtest{4}{
-\Reason{Fails for bad policy name.}
-}
-
-\numtest{5}{
-\Priority{High}
-\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{6}{
-\Priority{High}
-\Reason{Fails for user with no access bits.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Priority{High}
-\Reason{Fails for user with ``add'' but not ``delete''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Reason{Fails for user with ``modify'' but not ``delete''.}
-\Conditions{RPC}
-}
-
-\numtest{9}{
-\Reason{Fails for user with ``get'' but not ``delete.''}
-\Conditions{RPC}
-}
-
-\numtest{10}{
-\Priority{High}
-\Reason{Succeeds for user with only ``delete''.}
-\Status{Implemented}
-}
-
-\numtest{11}{
-\Reason{Succeeds for user with ``delete'' and ``add''.}
-}
-
-\numtest{12}{
-\Priority{High}
-\Reason{Fails for policy with non-zero reference count.}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-
-\section{ovsec_kadm_modify_policy}
-
-\numtest{1}{
-\Reason{Fails for mask with undefined bit set.}
-\Conditions{RPC}
-}
-
-\numtest{2}{
-\Priority{High}
-\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
-\Status{Implemented}
-}
-
-\numtest{3}{
-\Reason{Fails for mask with POLICY bit set.}
-}
-
-\numtest{4}{
-\Reason{Fails for mask with REF_COUNT bit set.}
-\Status{Implemented}
-}
-
-\numtest{5}{
-\Reason{Fails for invalid policy name.}
-}
-
-\numtest{6}{
-\Reason{Fails for non-existent policy name.}
-}
-
-\numtest{7}{
-\Reason{Fails for null policy name.}
-}
-
-\numtest{8}{
-\Priority{High}
-\Reason{Fails for empty-string policy name.}
-\Status{Implemented}
-}
-
-\numtest{9}{
-\Priority{High}
-\Reason{Accepts 0 for pw_min_life.}
-\Status{Implemented}
-}
-
-\numtest{10}{
-\Priority{High}
-\Reason{Accepts non-zero for pw_min_life.}
-\Status{Implemented}
-}
-
-\numtest{11}{
-\Priority{High}
-\Reason{Accepts 0 for pw_max_life.}
-\Status{Implemented}
-}
-
-\numtest{12}{
-\Priority{High}
-\Reason{Accepts non-zero for pw_max_life.}
-\Status{Implemented}
-}
-
-\numtest{13}{
-\Priority{High}
-\Reason{Accepts 0 for pw_min_length.}
-\Status{Implemented}
-}
-
-\numtest{14}{
-\Priority{High}
-\Reason{Accepts non-zero for pw_min_length.}
-\Status{Implemented}
-}
-
-\numtest{15}{
-\Priority{High}
-\Reason{Rejects 0 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{16}{
-\Priority{High}
-\Reason{Accepts 1 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{17}{
-\Priority{High}
-\Reason{Accepts 4 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{18}{
-\Priority{High}
-\Reason{Rejects 5 for pw_min_classes.}
-\Status{Implemented}
-}
-
-\numtest{19}{
-\Priority{High}
-\Reason{Rejects 0 for pw_history_num.}
-\Status{Implemented}
-}
-
-\numtest{20}{
-\Priority{High}
-\Reason{Accepts 1 for pw_history_num.}
-\Status{Implemented}
-}
-
-\numtest{21}{
-\Priority{High}
-\Reason{Accepts 10 for pw_history_num.}
-\Status{Implemented}
-}
-
-\numtest{22}{
-\Priority{High}
-\Reason{Fails for user with no access bits.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{23}{
-\Priority{High}
-\Reason{Fails for user with ``get'' but not ``modify''.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{24}{
-\Reason{Fails for user with ``add'' but not ``modify.''}
-\Conditions{RPC}
-}
-
-\numtest{25}{
-\Reason{Fails for user with ``delete'' but not ``modify.''}
-\Conditions{RPC}
-}
-
-\numtest{26}{
-\Priority{High}
-\Reason{Succeeds for user with ``modify.''}
-\Status{Implemented}
-}
-
-\numtest{27}{
-\Reason{Succeeds for user with ``get'' and ``modify.''}
-}
-
-\numtest{28}{
-\Reason{Rejects null policy argument.}
-}
-
-\numtest{29}{
-\Reason{Rejects change which makes pw_min_life greater than
-	pw_max_life.}
-}
-
-\numtest{30}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{31}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-\section{ovsec_kadm_get_policy}
-
-\numtest{1}{
-\Reason{Fails for null policy.}
-}
-
-\numtest{2}{
-\Reason{Fails for invalid policy name.}
-}
-
-\numtest{3}{
-\Priority{High}
-\Reason{Fails for empty-string policy name.}
-\Status{Implemented}
-}
-
-\numtest{4}{
-\Reason{Fails for non-existent policy name.}
-}
-
-\numtest{5}{
-\Reason{Fails for null ent.}
-}
-
-\numtest{6}{
-\Priority{High}
-\Reason{Fails for user with no access bits trying to get other's
-	policy, using ADMIN_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{7}{
-\Priority{High}
-\Reason{Fails for user with ``add'' but not ``get'' trying to get
-	other's policy, using ADMIN_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{8}{
-\Reason{Fails for user with ``modify'' but not ``get'' trying to get
-	other's policy, using ADMIN_SERVICE.}
-\Conditions{RPC}	
-}
-
-\numtest{9}{
-\Reason{Fails for user with ``delete'' but not ``get'' trying to get
-	other's policy, using ADMIN_SERVICE.}
-\Conditions{RPC}	
-}
-
-\numtest{10}{
-\Reason{Fails for user with ``delete'' but not ``get'' trying to get
-	other's policy, using CHANGEPW_SERVICE.}
-\Conditions{RPC}	
-}
-
-\numtest{11}{
-\Priority{High}
-\Reason{Succeeds for user with only ``get'', trying to get own policy,
-	using ADMIN_SERVICE.}
-\Status{Implemented}
-}
-
-\numtest{12}{
-\Priority{High}
-\Reason{Succeeds for user with only ``get'', trying to get own policy,
-	using CHANGEPW_SERVICE.}
-\Status{Implemented}	
-}
-
-\numtest{13}{
-\Reason{Succeeds for user with ``add'' and ``get'', trying to get own
-	policy, using ADMIN_SERVICE.}
-}
-
-\numtest{14}{
-\Reason{Succeeds for user with ``add'' and ``get'', trying to get own
-	policy, using CHANGEPW_SERVICE.}
-}
-
-\numtest{15}{
-\Reason{Succeeds for user without ``get'', trying to get own policy,
-	using ADMIN_SERVICE.}
-}
-
-\numtest{16}{
-\Priority{High}
-\Reason{Succeeds for user without ``get'', trying to get own policy,
-	using CHANGEPW_SERVICE.}
-\Status{Implemented}	
-}
-
-\numtest{17}{
-\Priority{High}
-\Reason{Succeeds for user with ``get'', trying to get other's policy,
-	using ADMIN_SERVICE.}
-\Status{Implemented}	
-}
-
-\numtest{18}{
-\Priority{High}
-\Reason{Fails for user with ``get'', trying to get other's policy,
-	using CHANGEPW_SERVICE.}
-\Conditions{RPC}
-\Status{Implemented}
-}
-
-\numtest{19}{
-\Reason{Succeeds for user with ``modify'' and ``get'', trying to get
-	other's policy, using ADMIN_SERVICE.}
-}
-
-\numtest{20}{
-\Reason{Fails for user with ``modify'' and ``get'', trying to get
-	other's policy, using CHANGEPW_SERVICE.}
-}
-
-\numtest{21}{
-\Priority{High}
-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in}
-\Status{Implemented}
-}
-
-\numtest{22}{
-\Priority{Low}
-\Reason{Connects to correct server when multiple handles exist}
-\Conditions{RPC}
-}
-
-
-\section{ovsec_kadm_free_principal_ent}
-
-In addition to the tests listed here, a memory-leak detector such as
-TestCenter, Purify or dbmalloc should be used to verify that the
-memory freed by this function is really freed.
-
-\numtest{1}{
-\Reason{Null princ succeeds.}
-}
-
-\numtest{2}{
-\Reason{Non-null princ succeeds.}
-}
-
-
-\section{ovsec_kadm_free_policy_ent}
-
-In addition to the tests listed here, a memory-leak detector such as
-TestCenter, Purify or dbmalloc should be used to verify that the
-memory freed by this function is really freed.
-
-\numtest{1}{
-\Reason{Null policy succeeds.}
-}
-
-\numtest{2}{
-\Reason{Non-null policy succeeds.}
-}
-
-
-
-\section{ovsec_kadm_get_privs}
-
-\numtest{1}{
-\Reason{Fails for null pointer argument.}
-}
-
-This test should be run with the 16 possible combinations of access
-bits (since there are 4 access bits, there are $2^4 = 16$ possible
-combinations of them):
-
-\numtest{2}{
-\Priority{High}
-\Reason{Returns correct bit mask for access bits of user.}
-\Conditions{RPC}
-}
-
-This test should be run locally:
-
-\numtest{3}{
-\Priority{High}
-\Reason{Returns 0x0f.}
-\Conditions{local}
-}
-
-\end{document}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/proto Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/proto/kdc.conf.proto Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/proto/krb5.conf.proto Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/proto/ovsec_adm.dict Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/env-setup.shin Deleted

@@ -1,104 +0,0 @@
-#!/bin/sh
-#
-# The KADM5 unit tests were developed to work under gmake.  As a
-# result, they expect to inherit a number of environment variables.
-# Rather than rewrite the tests, we simply use this script as an
-# execution wrapper that sets all the necessary environment variables
-# before running the program specified on its command line.
-#
-# The variable settings all came from OV's config.mk.
-#
-# Usage: env-setup.sh <command line>
-#
-
-TOP=@RBUILD@/kadmin
-STOP=@S_TOP@/kadmin
-export TOP
-export STOP
-# These two may be needed in case $libdir references them.
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@libdir@ ; eval "libdir=$libdir"; export libdir
-
-# The shared library run time setup
-TOPLIBD=@RBUILD@/lib
-PROG_LIBPATH=-L@RBUILD@/lib
-BUILDTOP=@RBUILD@
-# XXX kludge!
-PROG_RPATH=@RBUILD@/lib
-# This converts $(TOPLIBD) to $TOPLIBD
-cat > /tmp/env_setup$$ <<\EOF
-@KRB5_RUN_ENV@
-EOF
-
-foo=`sed -e 's/(//g' -e 's/)//g' -e 's/\\\$\\\$/\$/g' /tmp/env_setup$$`
-eval $foo
-export @KRB5_RUN_VARS@
-
-# This will get put in setup.csh for convenience
-KRB5_RUN_ENV_CSH=`eval echo "$foo" | \
-	sed -e 's/$^=*$=$.*$/setenv \1 \2/g'`
-export KRB5_RUN_ENV_CSH
-rm /tmp/env_setup$$
-
-TESTDIR=$TOP/testing; export TESTDIR
-STESTDIR=$STOP/testing; export STESTDIR
-if  "$K5ROOT" = "" ; then
-	K5ROOT="`cd $TESTDIR; pwd`/krb5-test-root"
-	export K5ROOT
-fi
-
-# If $VERBOSE_TEST is non-null, enter verbose mode.  Set $VERBOSE to
-# true or false so its exit status identifies the mode.
-if test x$VERBOSE_TEST = x; then
-	VERBOSE=false
-else
-	VERBOSE=true
-fi
-export VERBOSE
-
-REALM=SECURE-TEST.OV.COM; export REALM
-
-if test x$EXPECT = x; then
-    EXPECT=@EXPECT@; export EXPECT
-fi
-
-COMPARE_DUMP=$TESTDIR/scripts/compare_dump.pl; export COMPARE_DUMP
-INITDB=$STESTDIR/scripts/init_db; export INITDB
-SIMPLE_DUMP=$TESTDIR/scripts/simple_dump.pl; export SIMPLE_DUMP
-TCLUTIL=$STESTDIR/tcl/util.t; export TCLUTIL
-BSDDB_DUMP=$TESTDIR/util/bsddb_dump; export BSDDB_DUMP
-CLNTTCL=$TESTDIR/util/kadm5_clnt_tcl; export CLNTTCL
-SRVTCL=$TESTDIR/util/kadm5_srv_tcl; export SRVTCL
-
-HOSTNAME=`hostname | tr 'A-Z' 'a-z'`
-export HOSTNAME
-
-KRB5_CONFIG=$K5ROOT/krb5.conf; export KRB5_CONFIG
-KRB5_KDC_PROFILE=$K5ROOT/kdc.conf; export KRB5_KDC_PROFILE
-KRB5_KTNAME=$K5ROOT/ovsec_adm.keytab; export KRB5_KTNAME
-KRB5_CLIENT_KTNAME=$K5ROOT/client_keytab; export KRB5_CLIENT_KTNAME
-KRB5CCNAME=$K5ROOT/krb5cc_unit-test; export KRB5CCNAME
-GSS_MECH_CONFIG=$K5ROOT/mech.conf; export GSS_MECH_CONFIG
-
-# Make sure we don't get confused by translated messages
-# or localized times.
-LC_ALL=C; export LC_ALL
-
-if  "x$PS_ALL" = "x" ; then
-	if ps auxww >/dev/null 2>&1; then
-		PS_ALL="ps auxww"
-		PS_PID="ps uwwp"
-	elif ps -ef >/dev/null 2>&1; then
-		PS_ALL="ps -ef"
-		PS_PID="ps -fp"
-	else
-		PS_ALL="ps auxww"
-		PS_PID="ps uwwp"
-		echo "WARNING!  Cannot auto-detect ps type, assuming BSD."
-	fi
-
-	export PS_ALL PS_PID
-fi
-
-exec ${1+"$@"}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/init_db Deleted

@@ -1,229 +0,0 @@
-#!/bin/sh
-
-if $VERBOSE; then
-	REDIRECT=
-else
-	REDIRECT='>/dev/null'
-fi
-
-# Requires that $K5ROOT, /etc/krb.conf, and .k5.$REALM be world-writeable.
-
-if  "$TOP" = "" ; then
-	echo "init_db: Environment variable \$TOP must point to top of build tree" 1>&2
-	exit 1
-fi
-
-if  "$STOP" = "" ; then
-	echo "init_db: Environment variable \$STOP must point to top of source tree" 1>&2
-	exit 1
-fi
-
-if  "$libdir" = "" ; then
-	echo "init_db: Environment variable \$libdir must point to library install directory" 1>&2
-	exit 1
-fi
-
-IROOT=$TOP/..
-ADMIN=$TOP/dbutil
-BIN=$IROOT/bin
-ETC=$IROOT/etc
-MODDIR=$TOP/../plugins/kdb
-SBIN=$TOP/keytab:$TOP/server
-DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM
-
-. ./runenv.sh
-
-if  ! -d $MODDIR ; then
-	echo "+++" 1>&2
-	echo "+++ Error!  $MODDIR does not exist!" 1>&2
-	echo "+++ The MODDIR variable should point to the directory in which" 1>&2
-	echo "+++ database modules have been installed for testing." 1>&2
-	echo "+++" 1>&2
-	exit 1
-fi
-
-DUMMY=${TESTDIR=$TOP/testing}; export TESTDIR
-DUMMY=${STESTDIR=$STOP/testing}
-DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL
-DUMMY=${TCLUTIL=$STESTDIR/tcl/util.t}; export TCLUTIL
-
-PATH=$ADMIN:$BIN:$ETC:$SBIN:$PATH; export PATH
-
-if  ! -x $SRVTCL ; then
-	echo "+++" 1>&2
-	echo "+++ Error!  $SRVTCL does not exist!" 1>&2
-	echo "+++ It was probably not compiled because TCL was not available.  If you" 1>&2
-	echo "+++ now have TCL installed, cd into that directory, re-run configure" 1>&2 
-	echo "+++ with the --with-tcl option, and then re-run make." 1>&2
-	echo "+++" 1>&2
-
-	exit 1
-fi
-
-rm -rf $K5ROOT/*
-if  -d $K5ROOT ; then
-	true
-else
-	mkdir $K5ROOT
-fi
-
-# touch $K5ROOT/syslog
-# for pid in `$PS_ALL | awk '/syslogd/ && !/awk/  {print $2}'` ; do
-# 	case "$pid" in
-# 		xxx) ;;
-# 		*)
-# 			if $VERBOSE; then $PS_PID$pid | grep -v COMMAND; fi
-# 			kill -1 $pid
-# 			;;
-# 	esac
-# done
-
-sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \
-	-e "s/__HOSTNAME__/$HOSTNAME/g" \
-	-e "s#__MODDIR__#$MODDIR#g" \
-	< $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf
-sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \
-	< $STESTDIR/proto/kdc.conf.proto > $K5ROOT/kdc.conf
-
-eval kdb5_util -r $REALM create -W -P mrroot -s $REDIRECT || exit 1
-
-cp $STESTDIR/proto/ovsec_adm.dict $K5ROOT/ovsec_adm.dict
-
-cat - > /tmp/init_db$$ <<\EOF
-source $env(TCLUTIL)
-set r $env(REALM)
-if {info exists env(USER)} {
-    set whoami $env(USER)
-} else {
-    set whoami exec whoami
-}
-
-set cmds {
-    {kadm5_init $env(SRVTCL) mrroot null \
-	    config_params {KADM5_CONFIG_REALM} $r $KADM5_STRUCT_VERSION \
-	    $KADM5_API_VERSION_3 server_handle}
-
-    {kadm5_create_policy $server_handle "test-pol 0 10000 8 2 3 0 2 90 180" \
-	    {KADM5_POLICY KADM5_PW_MIN_LENGTH KADM5_PW_MIN_CLASSES KADM5_PW_MAX_LIFE KADM5_PW_HISTORY_NUM KADM5_PW_MAX_FAILURE KADM5_PW_FAILURE_COUNT_INTERVAL KADM5_PW_LOCKOUT_DURATION}}
-    {kadm5_create_policy $server_handle "once-a-min 10 0 0 0 0 0 0 0 0" \
-	    {KADM5_POLICY KADM5_PW_MIN_LIFE}}
-    {kadm5_create_policy $server_handle "dict-only 0 0 0 0 0 0 0 0 0" \
-	    {KADM5_POLICY}}
-    {kadm5_create_policy $server_handle simple_policy test-pol-nopw \
-	    {KADM5_POLICY}}
-
-    {kadm5_create_principal $server_handle \
-	    simple_principal testuser@$r {KADM5_PRINCIPAL} notathena}
-    {kadm5_create_principal $server_handle \
-	    simple_principal test1@$r {KADM5_PRINCIPAL} test1}
-    {kadm5_create_principal $server_handle \
-	    simple_principal test2@$r {KADM5_PRINCIPAL} test2}
-    {kadm5_create_principal $server_handle \
-	    simple_principal test3@$r {KADM5_PRINCIPAL} test3}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/get@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/modify@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/delete@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/add@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/none@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/rename@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/mod-add@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/mod-delete@$r {KADM5_PRINCIPAL} \
-	    admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/get-add@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/get-delete@$r {KADM5_PRINCIPAL} \
-	    admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/get-mod@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/no-add@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    simple_principal admin/no-delete@$r {KADM5_PRINCIPAL} admin}
-    {kadm5_create_principal $server_handle \
-	    princ_w_pol pol1@$r test-pol {KADM5_PRINCIPAL \
-	    KADM5_POLICY} pol111111}
-    {kadm5_create_principal $server_handle \
-	    princ_w_pol pol2@$r once-a-min {KADM5_PRINCIPAL \
-	    KADM5_POLICY} pol222222}
-    {kadm5_create_principal $server_handle \
-	    princ_w_pol pol3@$r dict-only {KADM5_PRINCIPAL \
-	    KADM5_POLICY} pol333333}
-    {kadm5_create_principal $server_handle \
-	    princ_w_pol admin/get-pol@$r test-pol-nopw \
-	    {KADM5_PRINCIPAL KADM5_POLICY} StupidAdmin}
-    {kadm5_create_principal $server_handle \
-	    princ_w_pol admin/pol@$r test-pol-nopw {KADM5_PRINCIPAL \
-	    KADM5_POLICY} StupidAdmin}
-
-    {kadm5_create_principal $server_handle \
-	    simple_principal changepw/kerberos \
-            {KADM5_PRINCIPAL} {XXX THIS IS WRONG}}
-
-    {kadm5_create_principal $server_handle \
-	    simple_principal $whoami \
-	    {KADM5_PRINCIPAL} $whoami}
-
-    {kadm5_create_principal $server_handle \
-	    simple_principal testkeys@$r {KADM5_PRINCIPAL} testkeys}
-
-    {kadm5_destroy $server_handle}
-}
-
-foreach cmd $cmds {
-    if {catch $cmd output} {
-	puts stderr "Error!  Command: $cmd\nError: $output"
-	exit 1
-    } else {
-	puts stdout $output
-    }
-}
-EOF
-eval "$SRVTCL < /tmp/init_db$$ $REDIRECT"
-rm /tmp/init_db$$
-
-if  $? -ne 0 ; then
-	echo "Error in $SRVTCL!" 1>&2
-	exit 1
-fi
-
-cat > $K5ROOT/ovsec_adm.acl <<EOF
-admin@$REALM			admcilse
-admin/get@$REALM		il
-admin/modify@$REALM		mc
-admin/delete@$REALM		d
-admin/add@$REALM		a
-admin/get-pol@$REALM		il
-admin/rename@$REALM		adil
-admin/mod-add@$REALM		amc
-admin/mod-delete@$REALM		mcd
-admin/get-add@$REALM		ail
-admin/get-delete@$REALM		ild
-admin/get-mod@$REALM		ilmc
-admin/no-add@$REALM		mcdil
-admin/no-delete@$REALM		amcil
-changepw/kerberos@$REALM	cil
-
-EOF
-
-# Create $K5ROOT/setup.csh to make it easy to run other programs against
-# the test db
-cat > $K5ROOT/setup.csh <<EOF
-setenv KRB5_CONFIG $KRB5_CONFIG
-setenv KRB5_KDC_PROFILE $KRB5_KDC_PROFILE
-setenv KRB5_KTNAME $KRB5_KTNAME
-setenv KRB5_CLIENT_KTNAME $KRB5_CLIENT_KTNAME
-setenv GSS_MECH_CONFIG $GSS_MECH_CONFIG
-$KRB5_RUN_ENV_CSH
-EOF
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/start_servers Deleted

@@ -1,69 +0,0 @@
-#!/bin/sh
-#
-# Usage: start_servers hostname path
-#
-# This script turns a host into a OpenV*Secure primary server for the
-# realm SECURE-TEST.OV.COM.  If no arguments are specified,
-# the local host is affected.  Otherwise, the host hostname is
-# affected; the path argument is the top of the Secure install tree on
-# that host, and if it is not specified the current canonical value of
-# TOP is used.
-
-DUMMY=${TESTDIR=$TOP/testing}
-DUMMY=${STESTDIR=$STOP/testing}
-DUMMY=${START_SERVERS_LOCAL=$STESTDIR/scripts/start_servers_local}
-# This'll be wrong sometimes
-DUMMY=${RSH_CMD=rsh}
-
-local=1
-
-if  $# -gt 0 ; then
-	if  $# != 1 -a $# != 2 ; then
-		echo "Usage: $0 hostname path" 1>&2
-		exit 1
-	fi
-
-	local=0
-	hostname=$1
-	if  $# = 1 ; then
-		rempath=`sh -c "cd $TOP && pwd"`
-	else
-		rempath=$2
-	fi
-fi
-
-if  $local = 0 ; then
-
-	# Fix up the local krb5.conf to point to the remote 
-	sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \
-		-e "s/__HOSTNAME__/$HOSTNAME/g" \
-		-e "s#__MODDIR__#$TOP/../plugins/kdb#g"\
-		-e "s#__PLUGIN_DIR__#$TOP/../plugins#g"\
-		< $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf
-
-# Using /usr/ucb/rsh and getting rid of "-k $REALM" until we get
-# around to fixing the fact that Kerberos rsh doesn't strip out "-k
-# REALM" when falling back.
-
-	START_SERVERS_LOCAL=`echo $START_SERVERS_LOCAL|sed "s%$TOP%$rempath%"`
-	CMD="$RSH_CMD $hostname -n \
-	  \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \
-	    $rempath/testing/scripts/env-setup.sh \
-		$START_SERVERS_LOCAL $rempath'\""
-
-	if $VERBOSE; then
-		echo "+++"
-		echo "+++ Begin execution of start_servers_local on $hostname"
-		echo "+++"
-		echo $CMD
-	fi
-	eval $CMD
-	if $VERBOSE; then
-		echo "+++"
-		echo "+++ End execution of start_servers_local on $hostname"
-		echo "+++"
-	fi
-else
-	$START_SERVERS_LOCAL
-fi
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/start_servers_local Deleted

@@ -1,157 +0,0 @@
-#!/bin/sh
-
-DUMMY=${TESTDIR=$TOP/testing}
-DUMMY=${STESTDIR=$STOP/testing}
-DUMMY=${INITDB=$STESTDIR/scripts/init_db}
-DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL
-DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local}
-DUMMY=${KRB5RCACHEDIR=$TESTDIR} ; export KRB5RCACHEDIR
-
-. ./runenv.sh
-
-if  -d /usr/tmp ; then
-	usrtmp=/usr/tmp
-else
-	usrtmp=/var/tmp
-fi
-
-$STOP_SERVERS_LOCAL -start_servers
-
-if $VERBOSE; then
-	REDIRECT=
-else
-	REDIRECT='>/dev/null'
-fi
-
-while :; do
-	case $1 in
-	-keysalt)
-		shift
-		if  $# -gt 0 ; then
-			keysalts="$keysalts $1"
-		else
-			break
-		fi
-		;;
-	-kdcport)
-		shift
-		if  $# -gt 0 ; then
-			kdcport=$1
-		else
-			break
-		fi
-		;;
-	*)
-		break
-		;;
-	esac
-	shift
-done
-
-if  $# -gt 1 ; then
-	echo "Usage: $0 -kdcport port -keysalts tuple ... top" 1>&2
-	exit 1
-elif  $# = 1 ; then
-	TOP=$1
-	export TOP
-fi
-
-# create a fresh db
-
-$INITDB "$keysalts" || exit 1
-
-# Post-process the config files based on our arguments
-if  "$keysalts" != "" ; then
-	sedcmd="s/$ 	*supported_enctypes =$.*/\1 $keysalts/"
-	sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new
-	mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf
-fi
-if  "$kdcport" != ""  ; then
-	sedcmd="s/$kdc_ports = .*$ 	*/\1, $kdcport/"
-	sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new
-	mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf
-fi
-
-# allow admin to krlogin as root (for cleanup)
-DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM
-
-cat - > /tmp/start_servers_local$$ <<\EOF
-if { catch {
-	source $env(STOP)/testing/tcl/util.t
-	set r $env(REALM)
-	set q $env(HOSTNAME)
-	puts stdout kadm5_init $env(SRVTCL) mrroot null \
-		config_params {KADM5_CONFIG_REALM} $r \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle
-	puts stdout kadm5_create_principal $server_handle \
-		simple_principal host/$q@$r {KADM5_PRINCIPAL} notathena
-	puts stdout kadm5_destroy $server_handle
-} err} {
-	puts stderr "initialization error: $err"
-	exit 1
-}
-exit 0
-EOF
-eval "$SRVTCL < /tmp/start_servers_local$$ $REDIRECT"
-x=$?
-rm /tmp/start_servers_local$$
-if test $x != 0 ; then exit 1 ; fi
-
-# run the servers (from the build tree)
-
-adm_start_file=/tmp/adm_server_start.$$
-kdc_start_file=/tmp/kdc_server_start.$$
-
-rm -f $kdc_start_file
-
-if test "x$USER" = x ; then
-  USER=$LOGNAME ; export USER
-fi
-
-kdc_args="-R dfl:kdc_rcache.$USER"
-
-(trap "" 2; $TOP/../kdc/krb5kdc $kdc_args; touch $kdc_start_file) \
-	< /dev/null > $usrtmp/kdc-log.$USER 2>&1 &
-
-s=1
-max_s=60
-sofar_s=0
-timewait_s=300
-
-ovadm_args=-W
-
-rm -f $adm_start_file
-
-(sleep 1; $TOP/server/kadmind $ovadm_args; \
-	touch $adm_start_file) < /dev/null > $usrtmp/kadm-log.$USER 2>&1 &
-
-# wait until they start
-
-while  $sofar_s -le $max_s ; do
-	if $VERBOSE; then
-		echo "Sleeping for $s seconds to allow servers" \
-			"to start..."
-	fi
-
-	sofar_s=`expr $sofar_s + $s`
-
-	sleep $s
-
-	if  -f $adm_start_file -a -f $kdc_start_file ; then
-		break
-	fi
-done
-
-if  $sofar_s -gt $max_s ; then
-	echo "Admin server or KDC failed to start after $sofar_s" \
-		"seconds." 1>&2
-	if  ! -f $adm_start_file ; then
-	    echo "  No admin server start file $adm_start_file." 1>&2
-	fi
-	if  ! -f $kdc_start_file ; then
-	    echo "  No KDC start file $adm_start_file." 1>&2
-	fi
-	exit 1
-fi
-
-rm -f $kdc_start_file $adm_start_file

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/stop_servers Deleted

@@ -1,60 +0,0 @@
-#!/bin/sh
-#
-# Usage: stop_servers hostname path
-#
-# This script turns a host into a OpenV*Secure primary server for the
-# realm SECURE-TEST.OV.COM.  If no arguments are specified,
-# the local host is affected.  Otherwise, the host hostname is
-# affected; the path argument is the top of the Secure install tree on
-# that host, and if it is not specified the current canonical value of
-# TOP is used.
-
-DUMMY=${TESTDIR=$TOP/testing}
-DUMMY=${STESTDIR=$STOP/testing}
-DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local}
-# This'll be wrong sometimes
-DUMMY=${RSH_CMD=rsh}
-
-local=1
-
-if  $# -gt 0 ; then
-	if  $# != 1 -a $# != 2 ; then
-		echo "Usage: $0 hostname path" 1>&2
-		exit 1
-	fi
-
-	local=0
-	hostname=$1
-	if  $# = 1 ; then
-		rempath=`sh -c "cd $TOP && pwd"`
-	else
-		rempath=$2
-	fi
-fi
-
-if  $local = 0 ; then
-	if $VERBOSE; then
-		echo "+++ Stopping servers on remote host $hostname..."
-	fi
-
-	STOP_SERVERS_LOCAL=`echo $STOP_SERVERS_LOCAL | sed "s%$TOP%$rempath%"`
-	CMD="$RSH_CMD $hostname -n \
-	      \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \
-		$rempath/testing/scripts/env-setup.sh \
-		   $STOP_SERVERS_LOCAL $rempath'\""
-
-	if $VERBOSE; then
-		echo "+++"
-		echo "+++ Begin execution of stop_servers_local on $hostname"
-		echo "+++"
-		echo $CMD
-	fi
-	eval $CMD
-	if $VERBOSE; then
-		echo "+++"
-		echo "+++ End execution of stop_servers_local on $hostname"
-		echo "+++"
-	fi
-else
-	$STOP_SERVERS_LOCAL
-fi

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/scripts/stop_servers_local Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/tcl Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/tcl/util.t Deleted

@@ -1,58 +0,0 @@
-proc simple_principal {name} {
-    return "{$name} 0 0 0 0 {$name} 0 0 0 0 null 0"
-}
-
-proc princ_w_pol {name policy} {
-    return "{$name} 0 0 0 0 {$name} 0 0 0 0 {$policy} 0"
-}
-
-proc simple_policy {name} {
-    return "{$name} 0 0 0 0 0 0 0 0 0"
-}
-
-proc config_params {masks values} {
-    if {llength $masks != llength $values} {
-	error "config_params: length of mask and values differ"
-    }
-
-    set params list $masks 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 {}
-    for {set i 0} {$i < llength $masks} {incr i} {
-	set mask lindex $masks $i
-	set value lindex $values $i
-	switch -glob -- $mask {
-	    "KADM5_CONFIG_REALM" {set params lreplace $params 1 1 $value}
-	    "KADM5_CONFIG_KADMIND_PORT" {
-		set params lreplace $params 2 2 $value}
-	    "KADM5_CONFIG_ADMIN_SERVER" {
-		set params lreplace $params 3 3 $value}
-	    "KADM5_CONFIG_DBNAME" {set params lreplace $params 4 4 $value}
-	    "KADM5_CONFIG_ADBNAME" {set params lreplace $params 5 5 $value}
-	    "KADM5_CONFIG_ADB_LOCKFILE" {
-		set params lreplace $params 6 6 $value}
-	    "KADM5_CONFIG_ACL_FILE" {set params lreplace $params 8 8 $value}
-	    "KADM5_CONFIG_DICT_FILE" {
-		set params lreplace $params 9 9 $value}
-	    "KADM5_CONFIG_MKEY_FROM_KBD" {
-		set params lreplace $params 10 10 $value}
-	    "KADM5_CONFIG_STASH_FILE" {
-		set params lreplace $params 11 11 $value}
-	    "KADM5_CONFIG_MKEY_NAME" {
-		set params lreplace $params 12 12 $value}
-	    "KADM5_CONFIG_ENCTYPE" {set params lreplace $params 13 13 $value}
-	    "KADM5_CONFIG_MAX_LIFE" {
-		set params lreplace $params 14 14 $value}
-	    "KADM5_CONFIG_MAX_RLIFE" {
-		set params lreplace $params 15 15 $value}
-	    "KADM5_CONFIG_EXPIRATION" {
-		set params lreplace $params 16 16 $value}
-	    "KADM5_CONFIG_FLAGS" {set params lreplace $params 17 17 $value}
-	    "KADM5_CONFIG_ENCTYPES" {
-		set params lreplace $params 18 19 llength $value $value}
-	    "*" {error "config_params: unknown mask $mask"}
-	}
-    }
-    return $params
-}
-
-	    
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/Makefile.in Deleted

@@ -1,42 +0,0 @@
-mydir=kadmin$(S)testing$(S)util
-BUILDTOP=$(REL)..$(S)..$(S)..
-LOCALINCLUDES = $(TCL_INCLUDES) -I$(BUILDTOP)/lib/kdb/
-# Force Tcl headers to use stdarg.h, because krb5 does too, and if
-# Tcl uses varargs.h it'll just mess things up.
-DEFINES= -DHAS_STDARG
-KRB5_PTHREAD_LIB=$(THREAD_LINKOPTS) 
-
-PROG_LIBPATH=-L$(TOPLIBD) $(TCL_LIBPATH)
-PROG_RPATH=$(KRB5_LIBDIR)$(TCL_RPATH)
-
-SRCS	=	$(srcdir)/tcl_kadm5.c $(srcdir)/test.c
-OBJS	=	tcl_kadm5.o test.o
-
-CLNTPROG=	kadm5_clnt_tcl
-SRVPROG	=	kadm5_srv_tcl
-
-DO_ALL=@DO_ALL@
-
-all: all-$(DO_ALL)
-
-all-:
-	@echo "+++"
-	@echo "+++ WARNING: Tcl not available.  The kadm5 tests will not be run."
-	@echo "+++"
-	@echo 'Skipped kadm5 tests: Tcl not found' >> $(SKIPTESTS)
-
-all-tcl: $(CLNTPROG) $(SRVPROG)
-
-$(SRVPROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o $(SRVPROG) $(OBJS) $(TCL_MAYBE_RPATH) \
-		$(KADMSRV_LIBS) $(KRB5_PTHREAD_LIB) $(KRB5_BASE_LIBS) $(TCL_LIBS)
-
-$(CLNTPROG): $(OBJS) $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o $(CLNTPROG) $(OBJS) $(TCL_MAYBE_RPATH) \
-		$(KRB5_PTHREAD_LIB) $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) $(TCL_LIBS)
-
-bsddb_dump: bsddb_dump.o
-	$(CC_LINK) -o bsddb_dump bsddb_dump.o $(KADMSRV_LIBS)
-
-clean:
-	$(RM) $(CLNTPROG) $(SRVPROG)

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/bsddb_dump.c Deleted

@@ -1,65 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/*
- * $Id$
- */
-
-#include <sys/file.h>
-#include <fcntl.h>
-#include <db.h>
-#include <stdio.h>
-
-main(int argc, char *argv)
-{
-    char *file;
-    DB *db;
-    DBT dbkey, dbdata;
-    int code, i;
-
-    HASHINFO     info;
-
-    info.hash = NULL;
-    info.bsize = 256;
-    info.ffactor = 8;
-    info.nelem = 25000;
-    info.lorder = 0;
-
-    if (argc != 2) {
-        fprintf(stderr, "usage: argv0 dbfile\n");
-        exit(2);
-    }
-
-    file = argv1;
-
-    if((db = dbopen(file, O_RDWR, 0666, DB_HASH, &info)) == NULL) {
-        perror("Opening db file");
-        exit(1);
-    }
-
-    if ((code = (*db->seq)(db, &dbkey, &dbdata, R_FIRST)) == -1) {
-        perror("starting db iteration");
-        exit(1);
-    }
-
-    while (code == 0) {
-        for (i=0; i<dbkey.size; i++)
-            printf("%02x", (int) ((unsigned char *) dbkey.data)i);
-        printf("\t");
-        for (i=0; i<dbdata.size; i++)
-            printf("%02x", (int) ((unsigned char *) dbdata.data)i);
-        printf("\n");
-
-        code = (*db->seq)(db, &dbkey, &dbdata, R_NEXT);
-    }
-
-    if (code == -1) {
-        perror("during db iteration");
-        exit(1);
-    }
-
-    if ((*db->close)(db) == -1) {
-        perror("closing db");
-        exit(1);
-    }
-
-    exit(0);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/tcl_kadm5.c Deleted

@@ -1,2566 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include "autoconf.h"
-#include <stdio.h>
-#include <string.h>
-#if HAVE_TCL_H
-#include <tcl.h>
-#elif HAVE_TCL_TCL_H
-#include <tcl/tcl.h>
-#endif
-#define USE_KADM5_API_VERSION 2
-#include <kadm5/admin.h>
-#include <com_err.h>
-#include <errno.h>
-#include <stdlib.h>
-#include <adb_err.h>
-#include "tcl_kadm5.h"
-
-struct flagval {
-    char *name;
-    krb5_flags val;
-};
-
-/* XXX This should probably be in the hash table like server_handle */
-static krb5_context context;
-
-static struct flagval krb5_flags_array = {
-    {"KRB5_KDB_DISALLOW_POSTDATED", KRB5_KDB_DISALLOW_POSTDATED},
-    {"KRB5_KDB_DISALLOW_FORWARDABLE", KRB5_KDB_DISALLOW_FORWARDABLE},
-    {"KRB5_KDB_DISALLOW_TGT_BASED", KRB5_KDB_DISALLOW_TGT_BASED},
-    {"KRB5_KDB_DISALLOW_RENEWABLE", KRB5_KDB_DISALLOW_RENEWABLE},
-    {"KRB5_KDB_DISALLOW_PROXIABLE", KRB5_KDB_DISALLOW_PROXIABLE},
-    {"KRB5_KDB_DISALLOW_DUP_SKEY", KRB5_KDB_DISALLOW_DUP_SKEY},
-    {"KRB5_KDB_DISALLOW_ALL_TIX", KRB5_KDB_DISALLOW_ALL_TIX},
-    {"KRB5_KDB_REQUIRES_PRE_AUTH", KRB5_KDB_REQUIRES_PRE_AUTH},
-    {"KRB5_KDB_REQUIRES_HW_AUTH", KRB5_KDB_REQUIRES_HW_AUTH},
-    {"KRB5_KDB_REQUIRES_PWCHANGE", KRB5_KDB_REQUIRES_PWCHANGE},
-    {"KRB5_KDB_DISALLOW_SVR", KRB5_KDB_DISALLOW_SVR},
-    {"KRB5_KDB_PWCHANGE_SERVICE", KRB5_KDB_PWCHANGE_SERVICE}
-};
-
-static struct flagval aux_attributes = {
-    {"KADM5_POLICY",   KADM5_POLICY}
-};
-
-static struct flagval principal_mask_flags = {
-    {"KADM5_PRINCIPAL", KADM5_PRINCIPAL},
-    {"KADM5_PRINC_EXPIRE_TIME", KADM5_PRINC_EXPIRE_TIME},
-    {"KADM5_PW_EXPIRATION", KADM5_PW_EXPIRATION},
-    {"KADM5_LAST_PWD_CHANGE", KADM5_LAST_PWD_CHANGE},
-    {"KADM5_ATTRIBUTES", KADM5_ATTRIBUTES},
-    {"KADM5_MAX_LIFE", KADM5_MAX_LIFE},
-    {"KADM5_MOD_TIME", KADM5_MOD_TIME},
-    {"KADM5_MOD_NAME", KADM5_MOD_NAME},
-    {"KADM5_KVNO", KADM5_KVNO},
-    {"KADM5_MKVNO", KADM5_MKVNO},
-    {"KADM5_AUX_ATTRIBUTES", KADM5_AUX_ATTRIBUTES},
-    {"KADM5_POLICY", KADM5_POLICY},
-    {"KADM5_POLICY_CLR", KADM5_POLICY_CLR},
-    {"KADM5_MAX_RLIFE", KADM5_MAX_RLIFE},
-    {"KADM5_LAST_SUCCESS", KADM5_LAST_SUCCESS},
-    {"KADM5_LAST_FAILED", KADM5_LAST_FAILED},
-    {"KADM5_FAIL_AUTH_COUNT", KADM5_FAIL_AUTH_COUNT},
-    {"KADM5_KEY_DATA", KADM5_KEY_DATA},
-    {"KADM5_TL_DATA", KADM5_TL_DATA},
-    {"KADM5_PRINCIPAL_NORMAL_MASK", KADM5_PRINCIPAL_NORMAL_MASK}
-};
-
-static struct flagval policy_mask_flags = {
-    {"KADM5_POLICY", KADM5_POLICY},
-    {"KADM5_PW_MAX_LIFE", KADM5_PW_MAX_LIFE},
-    {"KADM5_PW_MIN_LIFE", KADM5_PW_MIN_LIFE},
-    {"KADM5_PW_MIN_LENGTH", KADM5_PW_MIN_LENGTH},
-    {"KADM5_PW_MIN_CLASSES", KADM5_PW_MIN_CLASSES},
-    {"KADM5_PW_HISTORY_NUM", KADM5_PW_HISTORY_NUM},
-    {"KADM5_REF_COUNT", KADM5_REF_COUNT},
-    {"KADM5_PW_MAX_FAILURE", KADM5_PW_MAX_FAILURE},
-    {"KADM5_PW_FAILURE_COUNT_INTERVAL", KADM5_PW_FAILURE_COUNT_INTERVAL},
-    {"KADM5_PW_LOCKOUT_DURATION", KADM5_PW_LOCKOUT_DURATION},
-};
-
-static struct flagval config_mask_flags = {
-    {"KADM5_CONFIG_REALM", KADM5_CONFIG_REALM},
-    {"KADM5_CONFIG_DBNAME", KADM5_CONFIG_DBNAME},
-    {"KADM5_CONFIG_MKEY_NAME", KADM5_CONFIG_MKEY_NAME},
-    {"KADM5_CONFIG_MAX_LIFE", KADM5_CONFIG_MAX_LIFE},
-    {"KADM5_CONFIG_MAX_RLIFE", KADM5_CONFIG_MAX_RLIFE},
-    {"KADM5_CONFIG_EXPIRATION", KADM5_CONFIG_EXPIRATION},
-    {"KADM5_CONFIG_FLAGS", KADM5_CONFIG_FLAGS},
-    {"KADM5_CONFIG_STASH_FILE", KADM5_CONFIG_STASH_FILE},
-    {"KADM5_CONFIG_ENCTYPE", KADM5_CONFIG_ENCTYPE},
-    {"KADM5_CONFIG_ADBNAME", KADM5_CONFIG_ADBNAME},
-    {"KADM5_CONFIG_ADB_LOCKFILE", KADM5_CONFIG_ADB_LOCKFILE},
-    {"KADM5_CONFIG_ACL_FILE", KADM5_CONFIG_ACL_FILE},
-    {"KADM5_CONFIG_KADMIND_PORT", KADM5_CONFIG_KADMIND_PORT},
-    {"KADM5_CONFIG_ENCTYPES", KADM5_CONFIG_ENCTYPES},
-    {"KADM5_CONFIG_ADMIN_SERVER", KADM5_CONFIG_ADMIN_SERVER},
-    {"KADM5_CONFIG_DICT_FILE", KADM5_CONFIG_DICT_FILE},
-    {"KADM5_CONFIG_MKEY_FROM_KBD", KADM5_CONFIG_MKEY_FROM_KBD},
-};
-
-static struct flagval priv_flags = {
-    {"KADM5_PRIV_GET", KADM5_PRIV_GET},
-    {"KADM5_PRIV_ADD", KADM5_PRIV_ADD},
-    {"KADM5_PRIV_MODIFY", KADM5_PRIV_MODIFY},
-    {"KADM5_PRIV_DELETE", KADM5_PRIV_DELETE}
-};
-
-
-static char *arg_error = "wrong # args";
-
-static Tcl_HashTable *struct_table = 0;
-
-static int put_server_handle(Tcl_Interp *interp, void *handle, char **name)
-{
-    int i = 1, newPtr = 0;
-    static char buf20;
-    Tcl_HashEntry *entry;
-
-    if (! struct_table) {
-        if (! (struct_table =
-               malloc(sizeof(*struct_table)))) {
-            fprintf(stderr, "Out of memory!\n");
-            exit(1); /* XXX */
-        }
-        Tcl_InitHashTable(struct_table, TCL_STRING_KEYS);
-    }
-
-    do {
-        sprintf(buf, "kadm5_handle%d", i);
-        entry = Tcl_CreateHashEntry(struct_table, buf, &newPtr);
-        i++;
-    } while (! newPtr);
-
-    Tcl_SetHashValue(entry, handle);
-
-    *name = buf;
-
-    return TCL_OK;
-}
-
-static int get_server_handle(Tcl_Interp *interp, const char *name,
-                             void **handle)
-{
-    Tcl_HashEntry *entry;
-
-    if(!strcasecmp(name, "null"))
-        *handle = 0;
-    else {
-        if (! (struct_table &&
-               (entry = Tcl_FindHashEntry(struct_table, name)))) {
-            Tcl_AppendResult(interp, "unknown server handle ", name, 0);
-            return TCL_ERROR;
-        }
-        *handle = (void *) Tcl_GetHashValue(entry);
-    }
-    return TCL_OK;
-}
-
-static int remove_server_handle(Tcl_Interp *interp, const char *name)
-{
-    Tcl_HashEntry *entry;
-
-    if (! (struct_table &&
-           (entry = Tcl_FindHashEntry(struct_table, name)))) {
-        Tcl_AppendResult(interp, "unknown server handle ", name, 0);
-        return TCL_ERROR;
-    }
-
-    Tcl_SetHashValue(entry, NULL);
-    return TCL_OK;
-}
-
-#define GET_HANDLE(num_args, ignored)                                   \
-    void *server_handle;                                                \
-    const char *whoami = argv0;                                       \
-    argv++, argc--;                                                     \
-    if (argc != num_args + 1) {                                         \
-        Tcl_AppendResult(interp, whoami, ": ", arg_error, 0);           \
-        return TCL_ERROR;                                               \
-    }                                                                   \
-    {                                                                   \
-        int ltcl_ret;                                                   \
-        if ((ltcl_ret = get_server_handle(interp, argv0, &server_handle)) \
-            != TCL_OK) {                                                \
-            return ltcl_ret;                                            \
-        }                                                               \
-    }                                                                   \
-    argv++, argc--;
-
-static Tcl_HashTable *create_flag_table(struct flagval *flags, int size)
-{
-    Tcl_HashTable *table;
-    Tcl_HashEntry *entry;
-    int i;
-
-    if (! (table = (Tcl_HashTable *) malloc(sizeof(Tcl_HashTable)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_InitHashTable(table, TCL_STRING_KEYS);
-
-    for (i = 0; i < size; i++) {
-        int newPtr;
-
-        if (! (entry = Tcl_CreateHashEntry(table, flagsi.name, &newPtr))) {
-            fprintf(stderr, "Out of memory!\n");
-            exit(1); /* XXX */
-        }
-
-        Tcl_SetHashValue(entry, &flagsi.val);
-    }
-
-    return table;
-}
-
-
-static Tcl_DString *unparse_str(char *in_str)
-{
-    Tcl_DString *str;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-
-    if (! in_str) {
-        Tcl_DStringAppend(str, "null", -1);
-    }
-    else {
-        Tcl_DStringAppend(str, in_str, -1);
-    }
-
-    return str;
-}
-
-
-
-static int parse_str(Tcl_Interp *interp, const char *in_str, char **out_str)
-{
-    if (! in_str) {
-        *out_str = 0;
-    }
-    else if (! strcasecmp(in_str, "null")) {
-        *out_str = 0;
-    }
-    else {
-        *out_str = (char *) in_str;
-    }
-    return TCL_OK;
-}
-
-
-static void set_ok(Tcl_Interp *interp, char *string)
-{
-    Tcl_SetResult(interp, "OK", TCL_STATIC);
-    Tcl_AppendElement(interp, "KADM5_OK");
-    Tcl_AppendElement(interp, string);
-}
-
-
-
-static Tcl_DString *unparse_err(kadm5_ret_t code)
-{
-    char *code_string;
-    const char *error_string;
-    Tcl_DString *dstring;
-
-    switch (code) {
-    case KADM5_FAILURE: code_string = "KADM5_FAILURE"; break;
-    case KADM5_AUTH_GET: code_string = "KADM5_AUTH_GET"; break;
-    case KADM5_AUTH_ADD: code_string = "KADM5_AUTH_ADD"; break;
-    case KADM5_AUTH_MODIFY:
-        code_string = "KADM5_AUTH_MODIFY"; break;
-    case KADM5_AUTH_DELETE:
-        code_string = "KADM5_AUTH_DELETE"; break;
-    case KADM5_AUTH_INSUFFICIENT:
-        code_string = "KADM5_AUTH_INSUFFICIENT"; break;
-    case KADM5_BAD_DB: code_string = "KADM5_BAD_DB"; break;
-    case KADM5_DUP: code_string = "KADM5_DUP"; break;
-    case KADM5_RPC_ERROR: code_string = "KADM5_RPC_ERROR"; break;
-    case KADM5_NO_SRV: code_string = "KADM5_NO_SRV"; break;
-    case KADM5_BAD_HIST_KEY:
-        code_string = "KADM5_BAD_HIST_KEY"; break;
-    case KADM5_NOT_INIT: code_string = "KADM5_NOT_INIT"; break;
-    case KADM5_INIT: code_string = "KADM5_INIT"; break;
-    case KADM5_BAD_PASSWORD:
-        code_string = "KADM5_BAD_PASSWORD"; break;
-    case KADM5_UNK_PRINC: code_string = "KADM5_UNK_PRINC"; break;
-    case KADM5_UNK_POLICY: code_string = "KADM5_UNK_POLICY"; break;
-    case KADM5_BAD_MASK: code_string = "KADM5_BAD_MASK"; break;
-    case KADM5_BAD_CLASS: code_string = "KADM5_BAD_CLASS"; break;
-    case KADM5_BAD_LENGTH: code_string = "KADM5_BAD_LENGTH"; break;
-    case KADM5_BAD_POLICY: code_string = "KADM5_BAD_POLICY"; break;
-    case KADM5_BAD_HISTORY: code_string = "KADM5_BAD_HISTORY"; break;
-    case KADM5_BAD_PRINCIPAL:
-        code_string = "KADM5_BAD_PRINCIPAL"; break;
-    case KADM5_BAD_AUX_ATTR:
-        code_string = "KADM5_BAD_AUX_ATTR"; break;
-    case KADM5_PASS_Q_TOOSHORT:
-        code_string = "KADM5_PASS_Q_TOOSHORT"; break;
-    case KADM5_PASS_Q_CLASS:
-        code_string = "KADM5_PASS_Q_CLASS"; break;
-    case KADM5_PASS_Q_DICT:
-        code_string = "KADM5_PASS_Q_DICT"; break;
-    case KADM5_PASS_REUSE: code_string = "KADM5_PASS_REUSE"; break;
-    case KADM5_PASS_TOOSOON:
-        code_string = "KADM5_PASS_TOOSOON"; break;
-    case KADM5_POLICY_REF:
-        code_string = "KADM5_POLICY_REF"; break;
-    case KADM5_PROTECT_PRINCIPAL:
-        code_string = "KADM5_PROTECT_PRINCIPAL"; break;
-    case KADM5_BAD_SERVER_HANDLE:
-        code_string = "KADM5_BAD_SERVER_HANDLE"; break;
-    case KADM5_BAD_STRUCT_VERSION:
-        code_string = "KADM5_BAD_STRUCT_VERSION"; break;
-    case KADM5_OLD_STRUCT_VERSION:
-        code_string = "KADM5_OLD_STRUCT_VERSION"; break;
-    case KADM5_NEW_STRUCT_VERSION:
-        code_string = "KADM5_NEW_STRUCT_VERSION"; break;
-    case KADM5_BAD_API_VERSION:
-        code_string = "KADM5_BAD_API_VERSION"; break;
-    case KADM5_OLD_LIB_API_VERSION:
-        code_string = "KADM5_OLD_LIB_API_VERSION"; break;
-    case KADM5_OLD_SERVER_API_VERSION:
-        code_string = "KADM5_OLD_SERVER_API_VERSION"; break;
-    case KADM5_NEW_LIB_API_VERSION:
-        code_string = "KADM5_NEW_LIB_API_VERSION"; break;
-    case KADM5_NEW_SERVER_API_VERSION:
-        code_string = "KADM5_NEW_SERVER_API_VERSION"; break;
-    case KADM5_SECURE_PRINC_MISSING:
-        code_string = "KADM5_SECURE_PRINC_MISSING"; break;
-    case KADM5_NO_RENAME_SALT:
-        code_string = "KADM5_NO_RENAME_SALT"; break;
-    case KADM5_BAD_CLIENT_PARAMS:
-        code_string = "KADM5_BAD_CLIENT_PARAMS"; break;
-    case KADM5_BAD_SERVER_PARAMS:
-        code_string = "KADM5_BAD_SERVER_PARAMS"; break;
-    case KADM5_AUTH_LIST:
-        code_string = "KADM5_AUTH_LIST"; break;
-    case KADM5_AUTH_CHANGEPW:
-        code_string = "KADM5_AUTH_CHANGEPW"; break;
-    case KADM5_GSS_ERROR: code_string = "KADM5_GSS_ERROR"; break;
-    case KADM5_BAD_TL_TYPE: code_string = "KADM5_BAD_TL_TYPE"; break;
-    case KADM5_MISSING_CONF_PARAMS:
-        code_string = "KADM5_MISSING_CONF_PARAMS"; break;
-    case KADM5_BAD_SERVER_NAME:
-        code_string = "KADM5_BAD_SERVER_NAME"; break;
-    case KADM5_MISSING_KRB5_CONF_PARAMS:
-        code_string = "KADM5_MISSING_KRB5_CONF_PARAMS"; break;
-    case KADM5_XDR_FAILURE: code_string = "KADM5_XDR_FAILURE"; break;
-    case KADM5_CANT_RESOLVE: code_string = "KADM5_CANT_RESOLVE"; break;
-
-
-    case OSA_ADB_DUP: code_string = "OSA_ADB_DUP"; break;
-    case OSA_ADB_NOENT: code_string = "ENOENT"; break;
-    case OSA_ADB_DBINIT: code_string = "OSA_ADB_DBINIT"; break;
-    case OSA_ADB_BAD_POLICY: code_string = "Bad policy name"; break;
-    case OSA_ADB_BAD_PRINC: code_string = "Bad principal name"; break;
-    case OSA_ADB_BAD_DB: code_string = "Invalid database."; break;
-    case OSA_ADB_XDR_FAILURE: code_string = "OSA_ADB_XDR_FAILURE"; break;
-    case OSA_ADB_BADLOCKMODE: code_string = "OSA_ADB_BADLOCKMODE"; break;
-    case OSA_ADB_CANTLOCK_DB: code_string = "OSA_ADB_CANTLOCK_DB"; break;
-    case OSA_ADB_NOTLOCKED: code_string = "OSA_ADB_NOTLOCKED"; break;
-    case OSA_ADB_NOLOCKFILE: code_string = "OSA_ADB_NOLOCKFILE"; break;
-    case OSA_ADB_NOEXCL_PERM: code_string = "OSA_ADB_NOEXCL_PERM"; break;
-
-    case KRB5_KDB_INUSE: code_string = "KRB5_KDB_INUSE"; break;
-    case KRB5_KDB_UK_SERROR: code_string = "KRB5_KDB_UK_SERROR"; break;
-    case KRB5_KDB_UK_RERROR: code_string = "KRB5_KDB_UK_RERROR"; break;
-    case KRB5_KDB_UNAUTH: code_string = "KRB5_KDB_UNAUTH"; break;
-    case KRB5_KDB_NOENTRY: code_string = "KRB5_KDB_NOENTRY"; break;
-    case KRB5_KDB_ILL_WILDCARD: code_string = "KRB5_KDB_ILL_WILDCARD"; break;
-    case KRB5_KDB_DB_INUSE: code_string = "KRB5_KDB_DB_INUSE"; break;
-    case KRB5_KDB_DB_CHANGED: code_string = "KRB5_KDB_DB_CHANGED"; break;
-    case KRB5_KDB_TRUNCATED_RECORD:
-        code_string = "KRB5_KDB_TRUNCATED_RECORD"; break;
-    case KRB5_KDB_RECURSIVELOCK:
-        code_string = "KRB5_KDB_RECURSIVELOCK"; break;
-    case KRB5_KDB_NOTLOCKED: code_string = "KRB5_KDB_NOTLOCKED"; break;
-    case KRB5_KDB_BADLOCKMODE: code_string = "KRB5_KDB_BADLOCKMODE"; break;
-    case KRB5_KDB_DBNOTINITED: code_string = "KRB5_KDB_DBNOTINITED"; break;
-    case KRB5_KDB_DBINITED: code_string = "KRB5_KDB_DBINITED"; break;
-    case KRB5_KDB_ILLDIRECTION: code_string = "KRB5_KDB_ILLDIRECTION"; break;
-    case KRB5_KDB_NOMASTERKEY: code_string = "KRB5_KDB_NOMASTERKEY"; break;
-    case KRB5_KDB_BADMASTERKEY: code_string = "KRB5_KDB_BADMASTERKEY"; break;
-    case KRB5_KDB_INVALIDKEYSIZE:
-        code_string = "KRB5_KDB_INVALIDKEYSIZE"; break;
-    case KRB5_KDB_CANTREAD_STORED:
-        code_string = "KRB5_KDB_CANTREAD_STORED"; break;
-    case KRB5_KDB_BADSTORED_MKEY:
-        code_string = "KRB5_KDB_BADSTORED_MKEY"; break;
-    case KRB5_KDB_CANTLOCK_DB: code_string = "KRB5_KDB_CANTLOCK_DB"; break;
-    case KRB5_KDB_DB_CORRUPT: code_string = "KRB5_KDB_DB_CORRUPT"; break;
-
-    case KRB5_PARSE_ILLCHAR: code_string = "KRB5_PARSE_ILLCHAR"; break;
-    case KRB5_PARSE_MALFORMED: code_string = "KRB5_PARSE_MALFORMED"; break;
-    case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN"; break;
-    case KRB5_REALM_UNKNOWN: code_string = "KRB5_REALM_UNKNOWN"; break;
-    case KRB5_KDC_UNREACH: code_string = "KRB5_KDC_UNREACH"; break;
-    case KRB5_KDCREP_MODIFIED: code_string = "KRB5_KDCREP_MODIFIED"; break;
-    case KRB5KRB_AP_ERR_BAD_INTEGRITY: code_string  = "KRB5KRB_AP_ERR_BAD_INTEGRITY"; break;
-    case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN"; break;
-    case KRB5_CONFIG_BADFORMAT: code_string = "KRB5_CONFIG_BADFORMAT"; break;
-
-    case KRB5_CC_NOTFOUND: code_string = "KRB5_CC_NOTFOUND"; break;
-    case KRB5_FCC_NOFILE: code_string = "KRB5_FCC_NOFILE"; break;
-
-    case EINVAL: code_string = "EINVAL"; break;
-    case ENOENT: code_string = "ENOENT"; break;
-
-    default:
-        fprintf(stderr, "**** CODE %ld (%s) ***\n", (long) code,
-                error_message (code));
-        code_string = "UNKNOWN";
-        break;
-    }
-
-    error_string = error_message(code);
-
-    if (! (dstring = (Tcl_DString *) malloc(sizeof(Tcl_DString)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX Do we really want to exit?  Ok if this is */
-        /* just a test program, but what about if it gets */
-        /* used for other things later? */
-    }
-
-    Tcl_DStringInit(dstring);
-
-    if (! (Tcl_DStringAppendElement(dstring, "ERROR") &&
-           Tcl_DStringAppendElement(dstring, code_string) &&
-           Tcl_DStringAppendElement(dstring, error_string))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    return dstring;
-}
-
-
-
-static void stash_error(Tcl_Interp *interp, krb5_error_code code)
-{
-    Tcl_DString *dstring = unparse_err(code);
-    Tcl_DStringResult(interp, dstring);
-    Tcl_DStringFree(dstring);
-    free(dstring);
-}
-
-static Tcl_DString *unparse_key_data(krb5_key_data *key_data, int n_key_data)
-{
-    Tcl_DString *str;
-    char buf2048;
-    int i, j;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-    for (i = 0; i < n_key_data; i++) {
-        krb5_key_data *key = &key_datai;
-
-        Tcl_DStringStartSublist(str);
-        sprintf(buf, "%d", key->key_data_type0);
-        Tcl_DStringAppendElement(str, buf);
-        sprintf(buf, "%d", key->key_data_ver > 1 ?
-                key->key_data_type1 : -1);
-        Tcl_DStringAppendElement(str, buf);
-        if (key->key_data_contents0) {
-            sprintf(buf, "0x");
-            for (j = 0; j < key->key_data_length0; j++) {
-                sprintf(buf + 2*(j+1), "%02x",
-                        key->key_data_contents0j);
-            }
-        } else *buf = '\0';
-        Tcl_DStringAppendElement(str, buf);
-        Tcl_DStringEndSublist(str);
-    }
-
-    return str;
-}
-
-static Tcl_DString *unparse_tl_data(krb5_tl_data *tl_data, int n_tl_data)
-{
-    Tcl_DString *str;
-    char buf2048;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-    Tcl_DStringStartSublist(str);
-    for (; tl_data; tl_data = tl_data->tl_data_next) {
-        Tcl_DStringStartSublist(str);
-        sprintf(buf, "%d", tl_data->tl_data_type);
-        Tcl_DStringAppendElement(str, buf);
-        sprintf(buf, "%d", tl_data->tl_data_length);
-        Tcl_DStringAppendElement(str, buf);
-        Tcl_DStringAppend(str, " ", 1);
-        Tcl_DStringAppend(str, (char *) tl_data->tl_data_contents,
-                          tl_data->tl_data_length);
-        Tcl_DStringEndSublist(str);
-    }
-    Tcl_DStringEndSublist(str);
-
-    return str;
-}
-
-static Tcl_DString *unparse_flags(struct flagval *array, int size,
-                                  krb5_int32 flags)
-{
-    int i;
-    Tcl_DString *str;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-
-    for (i = 0; i < size; i++) {
-        if (flags & arrayi.val) {
-            Tcl_DStringAppendElement(str, arrayi.name);
-        }
-    }
-
-    return str;
-}
-
-
-static int parse_flags(Tcl_Interp *interp, Tcl_HashTable *table,
-                       struct flagval *array, int size, const char *str,
-                       krb5_flags *flags)
-{
-    int tmp, argc, i, retcode = TCL_OK;
-    const char **argv;
-    Tcl_HashEntry *entry;
-
-    if (Tcl_GetInt(interp, str, &tmp) == TCL_OK) {
-        *flags = tmp;
-        return TCL_OK;
-    }
-    Tcl_ResetResult(interp);
-
-    if (Tcl_SplitList(interp, str, &argc, &argv) != TCL_OK) {
-        return TCL_ERROR;
-    }
-
-    if (! table) {
-        table = create_flag_table(array, size);
-    }
-
-    *flags = 0;
-
-    for (i = 0; i < argc; i++) {
-        if (! (entry = Tcl_FindHashEntry(table, argvi))) {
-            Tcl_AppendResult(interp, "unknown krb5 flag ", argvi, 0);
-            retcode = TCL_ERROR;
-            break;
-        }
-        *flags |= *(krb5_flags *) Tcl_GetHashValue(entry);
-    }
-
-    Tcl_Free((char *) argv);
-    return(retcode);
-}
-
-static Tcl_DString *unparse_privs(krb5_flags flags)
-{
-    return unparse_flags(priv_flags, sizeof(priv_flags) /
-                         sizeof(struct flagval), flags);
-}
-
-
-static Tcl_DString *unparse_krb5_flags(krb5_flags flags)
-{
-    return unparse_flags(krb5_flags_array, sizeof(krb5_flags_array) /
-                         sizeof(struct flagval), flags);
-}
-
-static int parse_krb5_flags(Tcl_Interp *interp, const char *str,
-                            krb5_flags *flags)
-{
-    krb5_flags tmp;
-    static Tcl_HashTable *table = 0;
-    int tcl_ret;
-
-    if ((tcl_ret = parse_flags(interp, table, krb5_flags_array,
-                               sizeof(krb5_flags_array) /
-                               sizeof(struct flagval),
-                               str, &tmp)) != TCL_OK) {
-        return tcl_ret;
-    }
-
-    *flags = tmp;
-    return TCL_OK;
-}
-
-static Tcl_DString *unparse_aux_attributes(krb5_int32 flags)
-{
-    return unparse_flags(aux_attributes, sizeof(aux_attributes) /
-                         sizeof(struct flagval), flags);
-}
-
-
-static int parse_aux_attributes(Tcl_Interp *interp, const char *str,
-                                long *flags)
-{
-    krb5_flags tmp;
-    static Tcl_HashTable *table = 0;
-    int tcl_ret;
-
-    if ((tcl_ret = parse_flags(interp, table, aux_attributes,
-                               sizeof(aux_attributes) /
-                               sizeof(struct flagval),
-                               str, &tmp)) != TCL_OK) {
-        return tcl_ret;
-    }
-
-    *flags = tmp;
-    return TCL_OK;
-}
-
-static int parse_principal_mask(Tcl_Interp *interp, const char *str,
-                                krb5_int32 *flags)
-{
-    krb5_flags tmp;
-    static Tcl_HashTable *table = 0;
-    int tcl_ret;
-
-    if ((tcl_ret = parse_flags(interp, table, principal_mask_flags,
-                               sizeof(principal_mask_flags) /
-                               sizeof(struct flagval),
-                               str, &tmp)) != TCL_OK) {
-        return tcl_ret;
-    }
-
-    *flags = tmp;
-    return TCL_OK;
-}
-
-static int parse_policy_mask(Tcl_Interp *interp, const char *str,
-                             krb5_int32 *flags)
-{
-    krb5_flags tmp;
-    static Tcl_HashTable *table = 0;
-    int tcl_ret;
-
-    if ((tcl_ret = parse_flags(interp, table, policy_mask_flags,
-                               sizeof(policy_mask_flags) /
-                               sizeof(struct flagval),
-                               str, &tmp)) != TCL_OK) {
-        return tcl_ret;
-    }
-
-    *flags = tmp;
-    return TCL_OK;
-}
-
-
-static Tcl_DString *unparse_principal_ent(kadm5_principal_ent_t princ,
-                                          krb5_int32 mask)
-{
-    Tcl_DString *str, *tmp_dstring;
-    char *tmp;
-    char buf20;
-    krb5_error_code krb5_ret;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-
-    tmp = 0; /* It looks to me from looking at the library source */
-    /* code for krb5_parse_name that the pointer passed into */
-    /* it should be initialized to 0 if I want it do be */
-    /* allocated automatically. */
-    if (mask & KADM5_PRINCIPAL) {
-        krb5_ret = krb5_unparse_name(context, princ->principal, &tmp);
-        if (krb5_ret) {
-            /* XXX Do we want to return an error?  Not sure. */
-            Tcl_DStringAppendElement(str, "unparsable principal");
-        }
-        else {
-            Tcl_DStringAppendElement(str, tmp);
-            free(tmp);
-        }
-    } else
-        Tcl_DStringAppendElement(str, "null");
-
-    sprintf(buf, "%u", (unsigned int)princ->princ_expire_time);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%u", (unsigned int)princ->last_pwd_change);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%u", (unsigned int)princ->pw_expiration);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", princ->max_life);
-    Tcl_DStringAppendElement(str, buf);
-
-    tmp = 0;
-    if (mask & KADM5_MOD_NAME) {
-        if ((krb5_ret = krb5_unparse_name(context, princ->mod_name, &tmp))) {
-            /* XXX */
-            Tcl_DStringAppendElement(str, "unparsable principal");
-        }
-        else {
-            Tcl_DStringAppendElement(str, tmp);
-            free(tmp);
-        }
-    } else
-        Tcl_DStringAppendElement(str, "null");
-
-    sprintf(buf, "%u", (unsigned int)princ->mod_date);
-    Tcl_DStringAppendElement(str, buf);
-
-    if (mask & KADM5_ATTRIBUTES) {
-        tmp_dstring = unparse_krb5_flags(princ->attributes);
-        Tcl_DStringAppendElement(str, tmp_dstring->string);
-        Tcl_DStringFree(tmp_dstring);
-        free(tmp_dstring);
-    } else
-        Tcl_DStringAppendElement(str, "null");
-
-    sprintf(buf, "%d", princ->kvno);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", princ->mkvno);
-    Tcl_DStringAppendElement(str, buf);
-
-    /* XXX This may be dangerous, because the contents of the policy */
-    /* field are undefined if the POLICY bit isn't set.  However, I */
-    /* think it's a bug for the field not to be null in that case */
-    /* anyway, so we should assume that it will be null so that we'll */
-    /* catch it if it isn't. */
-
-    tmp_dstring = unparse_str(princ->policy);
-    Tcl_DStringAppendElement(str, tmp_dstring->string);
-    Tcl_DStringFree(tmp_dstring);
-    free(tmp_dstring);
-
-    tmp_dstring = unparse_aux_attributes(princ->aux_attributes);
-    Tcl_DStringAppendElement(str, tmp_dstring->string);
-    Tcl_DStringFree(tmp_dstring);
-    free(tmp_dstring);
-
-    sprintf(buf, "%d", princ->max_renewable_life);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%u", (unsigned int)princ->last_success);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%u", (unsigned int)princ->last_failed);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", princ->fail_auth_count);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", princ->n_key_data);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", princ->n_tl_data);
-    Tcl_DStringAppendElement(str, buf);
-
-    tmp_dstring = unparse_key_data(princ->key_data, princ->n_key_data);
-    Tcl_DStringAppendElement(str, tmp_dstring->string);
-    Tcl_DStringFree(tmp_dstring);
-    free(tmp_dstring);
-
-    tmp_dstring = unparse_tl_data(princ->tl_data, princ->n_tl_data);
-    Tcl_DStringAppendElement(str, tmp_dstring->string);
-    Tcl_DStringFree(tmp_dstring);
-    free(tmp_dstring);
-
-    return str;
-}
-
-static int parse_keysalts(Tcl_Interp *interp, const char *list,
-                          krb5_key_salt_tuple **keysalts,
-                          int num_keysalts)
-{
-    const char **argv, **argv1 = NULL;
-    int i, tmp, argc, argc1, retcode;
-
-    *keysalts = NULL;
-    if (list == NULL)
-        return TCL_OK;
-
-    if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) {
-        return retcode;
-    }
-    if (argc != num_keysalts) {
-        Tcl_SetResult(interp, "wrong number of keysalts", TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    *keysalts = (krb5_key_salt_tuple *)
-        malloc(sizeof(krb5_key_salt_tuple)*num_keysalts);
-    for (i = 0; i < num_keysalts; i++) {
-        if ((retcode = Tcl_SplitList(interp, argvi, &argc1, &argv1)) !=
-            TCL_OK) {
-            goto finished;
-        }
-        if (argc1 != 2) {
-            Tcl_SetResult(interp, "wrong # of fields in keysalt", TCL_STATIC);
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        /* XXX this used to be argv11 too! */
-        if ((retcode = Tcl_GetInt(interp, argv10, &tmp))
-            != TCL_OK) {
-            Tcl_AppendElement(interp, "while parsing ks_enctype");
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        (*keysalts)i.ks_enctype = tmp;
-        if ((retcode = Tcl_GetInt(interp, argv11, &tmp))
-            != TCL_OK) {
-            Tcl_AppendElement(interp, "while parsing ks_salttype");
-            goto finished;
-        }
-        (*keysalts)i.ks_salttype = tmp;
-
-        Tcl_Free((char *) argv1);
-        argv1 = NULL;
-    }
-
-finished:
-    if (argv1) {
-        Tcl_Free((char *) argv1);
-    }
-    Tcl_Free((char *) argv);
-    return retcode;
-}
-
-static int parse_key_data(Tcl_Interp *interp, const char *list,
-                          krb5_key_data **key_data,
-                          int n_key_data)
-{
-    const char **argv = NULL;
-    int argc, retcode;
-
-    *key_data = NULL;
-    if (list == NULL) {
-        if (n_key_data != 0) {
-            Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC);
-            retcode = TCL_ERROR;
-            goto finished;
-        } else
-            return TCL_OK;
-    }
-
-    if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) {
-        return retcode;
-    }
-    if (argc != n_key_data) {
-        Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if (argc != 0) {
-        Tcl_SetResult(interp, "cannot parse key_data yet", TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-finished:
-    Tcl_Free((char *) argv);
-    return retcode;
-}
-
-static int parse_tl_data(Tcl_Interp *interp, const char *list,
-                         krb5_tl_data **tlp,
-                         int n_tl_data)
-{
-    krb5_tl_data *tl, *tl2;
-    const char **argv = NULL, **argv1 = NULL;
-    int i, tmp, argc, argc1, retcode;
-
-    *tlp = NULL;
-    if (list == NULL) {
-        if (n_tl_data != 0) {
-            Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC);
-            retcode = TCL_ERROR;
-            goto finished;
-        } else
-            return TCL_OK;
-    }
-
-    if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) {
-        return retcode;
-    }
-    if (argc != n_tl_data) {
-        Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    tl = tl2 = NULL;
-    for (i = 0; i < n_tl_data; i++) {
-        tl2 = (krb5_tl_data *) malloc(sizeof(krb5_tl_data));
-        memset(tl2, 0, sizeof(krb5_tl_data));
-        tl2->tl_data_next = tl;
-        tl = tl2;
-    }
-    tl2 = tl;
-
-    for (i = 0; i < n_tl_data; i++) {
-        if ((retcode = Tcl_SplitList(interp, argvi, &argc1, &argv1)) !=
-            TCL_OK) {
-            goto finished;
-        }
-        if (argc1 != 3) {
-            Tcl_SetResult(interp, "wrong # of fields in tl_data", TCL_STATIC);
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        if ((retcode = Tcl_GetInt(interp, argv10, &tmp))
-            != TCL_OK) {
-            Tcl_AppendElement(interp, "while parsing tl_data_type");
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        tl->tl_data_type = tmp;
-        if ((retcode = Tcl_GetInt(interp, argv11, &tmp))
-            != TCL_OK) {
-            Tcl_AppendElement(interp, "while parsing tl_data_length");
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        tl->tl_data_length = tmp;
-        if (tl->tl_data_length != strlen(argv12)) {
-            Tcl_SetResult(interp, "length != string length", TCL_STATIC);
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        tl->tl_data_contents = (krb5_octet *) strdup(argv12);
-
-        Tcl_Free((char *) argv1);
-        argv1 = NULL;
-        tl = tl->tl_data_next;
-    }
-    if (tl != NULL) {
-        Tcl_SetResult(interp, "tl is not NULL!", TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    *tlp = tl2;
-
-finished:
-    if (argv1) {
-        Tcl_Free((char *) argv1);
-    }
-    Tcl_Free((char *) argv);
-    return retcode;
-}
-
-static int parse_config_params(Tcl_Interp *interp, char *list,
-                               kadm5_config_params *params)
-{
-    static Tcl_HashTable *table = 0;
-    const char **argv = NULL;
-    int tmp, argc, retcode;
-
-    memset(params, 0, sizeof(kadm5_config_params));
-    if (list == NULL)
-        return TCL_OK;
-
-    if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) {
-        return retcode;
-    }
-
-    if (argc != 20) {
-        Tcl_SetResult(interp, "wrong # args in config params structure",
-                      TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if ((retcode = parse_flags(interp, table, config_mask_flags,
-                               sizeof(config_mask_flags) /
-                               sizeof(struct flagval),
-                               argv0, &tmp)) != TCL_OK) {
-        goto finished;
-    }
-    params->mask = tmp;
-
-    if ((retcode = parse_str(interp, argv1, &params->realm)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing realm name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if ((retcode = Tcl_GetInt(interp, argv2, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing kadmind_port");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->kadmind_port = tmp;
-    if ((retcode = parse_str(interp, argv3, &params->admin_server))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing profile name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if ((retcode = parse_str(interp, argv4, &params->dbname)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing profile name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    /* Ignore argv5, which used to set the admin_dbname field.  */
-    /* Ignore argv6, which used to set the admin_lockfile field.  */
-    /* Ignore argv7, which used to set the admin_keytab field.  */
-    if ((retcode = parse_str(interp, argv8, &params->acl_file)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing acl_file name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if ((retcode = parse_str(interp, argv9, &params->dict_file)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing dict_file name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if ((retcode = Tcl_GetInt(interp, argv10, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing mkey_from_kbd");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->mkey_from_kbd = tmp;
-    if ((retcode = parse_str(interp, argv11, &params->stash_file)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing stash_file name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if ((retcode = parse_str(interp, argv12, &params->mkey_name)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing mkey_name name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if ((retcode = Tcl_GetInt(interp, argv13, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing enctype");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->enctype = tmp;
-    if ((retcode = Tcl_GetInt(interp, argv14, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing max_life");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->max_life = tmp;
-    if ((retcode = Tcl_GetInt(interp, argv15, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing max_rlife");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->max_rlife = tmp;
-    if ((retcode = Tcl_GetInt(interp, argv16, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing expiration");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->expiration = tmp;
-    if ((retcode = parse_krb5_flags(interp, argv17, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing flags");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->flags = tmp;
-    if ((retcode = Tcl_GetInt(interp, argv18, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing num_keysalts");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    params->num_keysalts = tmp;
-    if ((retcode = parse_keysalts(interp, argv19, &params->keysalts,
-                                  params->num_keysalts)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing keysalts");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-finished:
-    return retcode;
-}
-
-static int parse_principal_ent(Tcl_Interp *interp, char *list,
-                               kadm5_principal_ent_t *out_princ)
-{
-    kadm5_principal_ent_t princ = 0;
-    krb5_error_code krb5_ret;
-    int tcl_ret;
-    int argc;
-    const char **argv;
-    int tmp;
-    int retcode = TCL_OK;
-
-    if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) {
-        return tcl_ret;
-    }
-
-    if (argc != 12 && argc != 20) {
-        Tcl_SetResult(interp, "wrong # args in principal structure",
-                      TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if (! (princ = malloc(sizeof *princ))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-    memset(princ, 0, sizeof(*princ));
-
-    if ((krb5_ret = krb5_parse_name(context, argv0, &princ->principal)) != 0) {
-        stash_error(interp, krb5_ret);
-        Tcl_AppendElement(interp, "while parsing principal");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    /*
-     * All of the numerical values parsed here are parsed into an
-     * "int" and then assigned into the structure in case the actual
-     * width of the field in the Kerberos structure is different from
-     * the width of an integer.
-     */
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv1, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing princ_expire_time");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->princ_expire_time = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv2, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing last_pwd_change");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->last_pwd_change = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv3, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_expiration");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->pw_expiration = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv4, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing max_life");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->max_life = tmp;
-
-    if ((krb5_ret = krb5_parse_name(context, argv5, &princ->mod_name)) != 0) {
-        stash_error(interp, krb5_ret);
-        Tcl_AppendElement(interp, "while parsing mod_name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv6, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing mod_date");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->mod_date = tmp;
-
-    if ((tcl_ret = parse_krb5_flags(interp, argv7, &princ->attributes))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing attributes");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv8, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing kvno");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->kvno = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv9, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing mkvno");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->mkvno = tmp;
-
-    if ((tcl_ret = parse_str(interp, argv10, &princ->policy)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing policy");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if(princ->policy != NULL) {
-        if(!(princ->policy = strdup(princ->policy))) {
-            fprintf(stderr, "Out of memory!\n");
-            exit(1);
-        }
-    }
-
-    if ((tcl_ret = parse_aux_attributes(interp, argv11,
-                                        &princ->aux_attributes)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing aux_attributes");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if (argc == 12) goto finished;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv12, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing max_renewable_life");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->max_renewable_life = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv13, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing last_success");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->last_success = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv14, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing last_failed");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->last_failed = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv15, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing fail_auth_count");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->fail_auth_count = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv16, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing n_key_data");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->n_key_data = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv17, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing n_tl_data");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->n_tl_data = tmp;
-
-    if ((tcl_ret = parse_key_data(interp, argv18,
-                                  &princ->key_data,
-                                  princ->n_key_data)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing key_data");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if ((tcl_ret = parse_tl_data(interp, argv19,
-                                 &princ->tl_data,
-                                 princ->n_tl_data)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing tl_data");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    princ->n_tl_data = tmp;
-
-finished:
-    Tcl_Free((char *) argv);
-    *out_princ = princ;
-    return retcode;
-}
-
-
-static void free_principal_ent(kadm5_principal_ent_t *princ)
-{
-    krb5_free_principal(context, (*princ)->principal);
-    krb5_free_principal(context, (*princ)->mod_name);
-    free((*princ)->policy);
-    free(*princ);
-    *princ = 0;
-}
-
-static Tcl_DString *unparse_policy_ent(kadm5_policy_ent_t policy)
-{
-    Tcl_DString *str, *tmp_dstring;
-    char buf20;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-
-    tmp_dstring = unparse_str(policy->policy);
-    Tcl_DStringAppendElement(str, tmp_dstring->string);
-    Tcl_DStringFree(tmp_dstring);
-    free(tmp_dstring);
-
-    sprintf(buf, "%ld", policy->pw_min_life);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%ld", policy->pw_max_life);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%ld", policy->pw_min_length);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%ld", policy->pw_min_classes);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%ld", policy->pw_history_num);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%ld", policy->policy_refcnt);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", policy->pw_max_fail);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", policy->pw_failcnt_interval);
-    Tcl_DStringAppendElement(str, buf);
-
-    sprintf(buf, "%d", policy->pw_lockout_duration);
-    Tcl_DStringAppendElement(str, buf);
-
-    return str;
-}
-
-
-
-static int parse_policy_ent(Tcl_Interp *interp, char *list,
-                            kadm5_policy_ent_t *out_policy)
-{
-    kadm5_policy_ent_t policy = 0;
-    int tcl_ret;
-    int argc;
-    const char **argv;
-    int tmp;
-    int retcode = TCL_OK;
-
-    if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) {
-        return tcl_ret;
-    }
-
-    if (argc != 7 && argc != 10) {
-        Tcl_SetResult(interp, "wrong # args in policy structure", TCL_STATIC);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if (! (policy = malloc(sizeof *policy))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    if ((tcl_ret = parse_str(interp, argv0, &policy->policy)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing policy name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if(policy->policy != NULL) {
-        if (! (policy->policy = strdup(policy->policy))) {
-            fprintf(stderr, "Out of memory!\n");
-            exit(1); /* XXX */
-        }
-    }
-
-    /*
-     * All of the numerical values parsed here are parsed into an
-     * "int" and then assigned into the structure in case the actual
-     * width of the field in the Kerberos structure is different from
-     * the width of an integer.
-     */
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv1, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_min_life");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_min_life = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv2, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_max_life");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_max_life = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv3, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_min_length");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_min_length = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv4, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_min_classes");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_min_classes = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv5, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_history_num");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_history_num = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv6, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing policy_refcnt");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->policy_refcnt = tmp;
-
-    if (argc == 7) goto finished;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv7, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_max_fail");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_max_fail = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv8, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_failcnt_interval");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_failcnt_interval = tmp;
-
-    if ((tcl_ret = Tcl_GetInt(interp, argv9, &tmp))
-        != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_lockout_duration");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    policy->pw_lockout_duration = tmp;
-
-finished:
-    Tcl_Free((char *) argv);
-    *out_policy = policy;
-    return retcode;
-}
-
-
-static void free_policy_ent(kadm5_policy_ent_t *policy)
-{
-    free((*policy)->policy);
-    free(*policy);
-    *policy = 0;
-}
-
-static Tcl_DString *unparse_keytype(krb5_enctype enctype)
-{
-    Tcl_DString *str;
-    char buf50;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-
-    switch (enctype) {
-        /* XXX is this right? */
-    case ENCTYPE_NULL: Tcl_DStringAppend(str, "ENCTYPE_NULL", -1); break;
-    default:
-        sprintf(buf, "UNKNOWN KEYTYPE (0x%x)", enctype);
-        Tcl_DStringAppend(str, buf, -1);
-        break;
-    }
-
-    return str;
-}
-
-
-static Tcl_DString *unparse_keyblocks(krb5_keyblock *keyblocks, int num_keys)
-{
-    Tcl_DString *str;
-    Tcl_DString *keytype;
-    unsigned int i;
-    int j;
-
-    if (! (str = malloc(sizeof(*str)))) {
-        fprintf(stderr, "Out of memory!\n");
-        exit(1); /* XXX */
-    }
-
-    Tcl_DStringInit(str);
-
-    for (j = 0; j < num_keys; j++) {
-        krb5_keyblock *keyblock = &keyblocksj;
-
-        Tcl_DStringStartSublist(str);
-
-        keytype = unparse_keytype(keyblock->enctype);
-        Tcl_DStringAppendElement(str, keytype->string);
-        Tcl_DStringFree(keytype);
-        free(keytype);
-        if (keyblock->length == 0) {
-            Tcl_DStringAppendElement(str, "0x00");
-        }
-        else {
-            Tcl_DStringAppendElement(str, "0x");
-            for (i = 0; i < keyblock->length; i++) {
-                char buf3;
-                sprintf(buf, "%02x", (int) keyblock->contentsi);
-                Tcl_DStringAppend(str, buf, -1);
-            }
-        }
-
-        Tcl_DStringEndSublist(str);
-    }
-
-
-    return str;
-}
-
-enum init_type { INIT_NONE, INIT_PASS, INIT_CREDS };
-
-static int _tcl_kadm5_init_any(enum init_type init_type, ClientData clientData,
-                               Tcl_Interp *interp, int argc, const char *argv)
-{
-    kadm5_ret_t ret;
-    char *client_name, *pass, *service_name;
-    int tcl_ret;
-    krb5_ui_4 struct_version, api_version;
-    const char *handle_var;
-    void *server_handle;
-    char *handle_name, *params_str;
-    const char *whoami = argv0;
-    kadm5_config_params params;
-
-    argv++, argc--;
-
-    kadm5_init_krb5_context(&context);
-
-    if (argc != 7) {
-        Tcl_AppendResult(interp, whoami, ": ", arg_error, 0);
-        return TCL_ERROR;
-    }
-
-    if (((tcl_ret = parse_str(interp, argv0, &client_name)) != TCL_OK) ||
-        ((tcl_ret = parse_str(interp, argv1, &pass)) != TCL_OK) ||
-        ((tcl_ret = parse_str(interp, argv2, &service_name)) != TCL_OK) ||
-        ((tcl_ret = parse_str(interp, argv3, &params_str)) != TCL_OK) ||
-        ((tcl_ret = parse_config_params(interp, params_str, &params))
-         != TCL_OK) ||
-        ((tcl_ret = Tcl_GetInt(interp, argv4, (int *) &struct_version)) !=
-         TCL_OK) ||
-        ((tcl_ret = Tcl_GetInt(interp, argv5, (int *) &api_version)) !=
-         TCL_OK)) {
-        return tcl_ret;
-    }
-
-    handle_var = argv6;
-
-    if (! (handle_var && *handle_var)) {
-        Tcl_SetResult(interp, "must specify server handle variable name",
-                      TCL_STATIC);
-        return TCL_ERROR;
-    }
-
-    if (init_type == INIT_CREDS) {
-        krb5_ccache cc;
-
-        if (pass == NULL) {
-            if ((ret = krb5_cc_default(context, &cc))) {
-                stash_error(interp, ret);
-                return TCL_ERROR;
-            }
-        } else {
-            if ((ret = krb5_cc_resolve(context, pass, &cc))) {
-                stash_error(interp, ret);
-                return TCL_ERROR;
-            }
-        }
-
-        ret = kadm5_init_with_creds(context, client_name, cc, service_name,
-                                    &params, struct_version,
-                                    api_version, NULL, &server_handle);
-
-        (void) krb5_cc_close(context, cc);
-    } else
-        ret = kadm5_init(context, client_name, pass, service_name, &params,
-                         struct_version, api_version, NULL, &server_handle);
-
-    /* The string fields of params are aliases into argv3, but
-     * params.keysalts is allocated, so clean it up. */
-    free(params.keysalts);
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        return TCL_ERROR;
-    }
-
-    if ((tcl_ret = put_server_handle(interp, server_handle, &handle_name))
-        != TCL_OK) {
-        return tcl_ret;
-    }
-
-    if (! Tcl_SetVar(interp, handle_var, handle_name, TCL_LEAVE_ERR_MSG)) {
-        return TCL_ERROR;
-    }
-
-    set_ok(interp, "KADM5 API initialized.");
-    return TCL_OK;
-}
-
-static int tcl_kadm5_init(ClientData clientData, Tcl_Interp *interp,
-                          int argc, const char *argv)
-{
-    return _tcl_kadm5_init_any(INIT_PASS, clientData, interp, argc, argv);
-}
-
-static int tcl_kadm5_init_with_creds(ClientData clientData, Tcl_Interp *interp,
-                                     int argc, const char *argv)
-{
-    return _tcl_kadm5_init_any(INIT_CREDS, clientData, interp, argc, argv);
-}
-
-static int tcl_kadm5_destroy(ClientData clientData, Tcl_Interp *interp,
-                             int argc, const char *argv)
-{
-    kadm5_ret_t ret;
-    int tcl_ret;
-
-    GET_HANDLE(0, 0);
-
-    ret = kadm5_destroy(server_handle);
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        return TCL_ERROR;
-    }
-
-    if ((tcl_ret = remove_server_handle(interp, argv-1)) != TCL_OK) {
-        return tcl_ret;
-    }
-
-    set_ok(interp, "KADM5 API deinitialized.");
-    return TCL_OK;
-}
-
-static int tcl_kadm5_create_principal(ClientData clientData,
-                                      Tcl_Interp *interp,
-                                      int argc, const char *argv)
-{
-    int tcl_ret;
-    kadm5_ret_t ret;
-    int retcode = TCL_OK;
-    char *princ_string;
-    kadm5_principal_ent_t princ = 0;
-    krb5_int32 mask;
-    char *pw;
-#ifdef OVERRIDE
-    int override_qual;
-#endif
-
-    GET_HANDLE(3, 0);
-
-    if ((tcl_ret = parse_str(interp, argv0, &princ_string)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing principal");
-        return tcl_ret;
-    }
-
-    if (princ_string &&
-        ((tcl_ret = parse_principal_ent(interp, princ_string, &princ))
-         != TCL_OK)) {
-        return tcl_ret;
-    }
-
-    if ((tcl_ret = parse_principal_mask(interp, argv1, &mask)) != TCL_OK) {
-        retcode = tcl_ret;
-        goto finished;
-    }
-
-    if ((tcl_ret = parse_str(interp, argv2, &pw)) != TCL_OK) {
-        retcode = tcl_ret;
-        goto finished;
-    }
-#ifdef OVERRIDE
-    if ((tcl_ret = Tcl_GetBoolean(interp, argv3, &override_qual)) !=
-        TCL_OK) {
-        retcode = tcl_ret;
-        goto finished;
-    }
-#endif
-
-#ifdef OVERRIDE
-    ret = kadm5_create_principal(server_handle, princ, mask, pw,
-                                 override_qual);
-#else
-    ret = kadm5_create_principal(server_handle, princ, mask, pw);
-#endif
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    else {
-        set_ok(interp, "Principal created.");
-    }
-
-finished:
-    if (princ) {
-        free_principal_ent(&princ);
-    }
-    return retcode;
-}
-
-
-
-static int tcl_kadm5_delete_principal(ClientData clientData,
-                                      Tcl_Interp *interp,
-                                      int argc, const char *argv)
-{
-    krb5_principal princ;
-    krb5_error_code krb5_ret;
-    kadm5_ret_t ret;
-    int tcl_ret;
-    char *name;
-
-    GET_HANDLE(1, 0);
-
-    if((tcl_ret = parse_str(interp, argv0, &name)) != TCL_OK)
-        return tcl_ret;
-    if(name != NULL) {
-        if ((krb5_ret = krb5_parse_name(context, name, &princ))) {
-            stash_error(interp, krb5_ret);
-            Tcl_AppendElement(interp, "while parsing principal");
-            return TCL_ERROR;
-        }
-    } else princ = NULL;
-    ret = kadm5_delete_principal(server_handle, princ);
-
-    if(princ != NULL)
-        krb5_free_principal(context, princ);
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        return TCL_ERROR;
-    }
-    else {
-        set_ok(interp, "Principal deleted.");
-        return TCL_OK;
-    }
-}
-
-
-
-static int tcl_kadm5_modify_principal(ClientData clientData,
-                                      Tcl_Interp *interp,
-                                      int argc, const char *argv)
-{
-    char *princ_string;
-    kadm5_principal_ent_t princ = 0;
-    int tcl_ret;
-    krb5_int32 mask;
-    int retcode = TCL_OK;
-    kadm5_ret_t ret;
-
-    GET_HANDLE(2, 0);
-
-    if ((tcl_ret = parse_str(interp, argv0, &princ_string)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing principal");
-        return tcl_ret;
-    }
-
-    if (princ_string &&
-        ((tcl_ret = parse_principal_ent(interp, princ_string, &princ))
-         != TCL_OK)) {
-        return tcl_ret;
-    }
-
-    if ((tcl_ret = parse_principal_mask(interp, argv1, &mask)) != TCL_OK) {
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    ret = kadm5_modify_principal(server_handle, princ, mask);
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-    else {
-        set_ok(interp, "Principal modified.");
-    }
-
-finished:
-    if (princ) {
-        free_principal_ent(&princ);
-    }
-    return retcode;
-}
-
-
-static int tcl_kadm5_rename_principal(ClientData clientData,
-                                      Tcl_Interp *interp,
-                                      int argc, const char *argv)
-{
-    krb5_principal source, target;
-    krb5_error_code krb5_ret;
-    kadm5_ret_t ret;
-    int retcode = TCL_OK;
-
-    GET_HANDLE(2, 0);
-
-    if ((krb5_ret = krb5_parse_name(context, argv0, &source)) != 0) {
-        stash_error(interp, krb5_ret);
-        Tcl_AppendElement(interp, "while parsing source");
-        return TCL_ERROR;
-    }
-
-    if ((krb5_ret = krb5_parse_name(context, argv1, &target)) != 0) {
-        stash_error(interp, krb5_ret);
-        Tcl_AppendElement(interp, "while parsing target");
-        krb5_free_principal(context, source);
-        return TCL_ERROR;
-    }
-
-    ret = kadm5_rename_principal(server_handle, source, target);
-
-    if (ret == KADM5_OK) {
-        set_ok(interp, "Principal renamed.");
-    }
-    else {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-
-    krb5_free_principal(context, source);
-    krb5_free_principal(context, target);
-    return retcode;
-}
-
-
-
-static int tcl_kadm5_chpass_principal(ClientData clientData,
-                                      Tcl_Interp *interp,
-                                      int argc, const char *argv)
-{
-    krb5_principal princ;
-    char *pw;
-#ifdef OVERRIDE
-    int override_qual;
-#endif
-    krb5_error_code krb5_ret;
-    int retcode = TCL_OK;
-    kadm5_ret_t ret;
-
-    GET_HANDLE(2, 0);
-
-    if ((krb5_ret = krb5_parse_name(context, argv0, &princ)) != 0) {
-        stash_error(interp, krb5_ret);
-        Tcl_AppendElement(interp, "while parsing principal name");
-        return TCL_ERROR;
-    }
-
-    if (parse_str(interp, argv1, &pw) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing password");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-#ifdef OVERRIDE
-    if (Tcl_GetBoolean(interp, argv2, &override_qual) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing override_qual");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    ret = kadm5_chpass_principal(server_handle,
-                                 princ, pw, override_qual);
-#else
-    ret = kadm5_chpass_principal(server_handle, princ, pw);
-#endif
-
-    if (ret == KADM5_OK) {
-        set_ok(interp, "Password changed.");
-        goto finished;
-    }
-    else {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-
-finished:
-    krb5_free_principal(context, princ);
-    return retcode;
-}
-
-
-
-static int tcl_kadm5_chpass_principal_util(ClientData clientData,
-                                           Tcl_Interp *interp,
-                                           int argc, const char *argv)
-{
-    krb5_principal princ;
-    char *new_pw;
-#ifdef OVERRIDE
-    int override_qual;
-#endif
-    char *pw_ret, *pw_ret_var;
-    char msg_ret1024, *msg_ret_var;
-    krb5_error_code krb5_ret;
-    kadm5_ret_t ret;
-    int retcode = TCL_OK;
-
-    GET_HANDLE(4, 0);
-
-    if ((krb5_ret = krb5_parse_name(context, argv0, &princ)) != 0) {
-        stash_error(interp, krb5_ret);
-        Tcl_AppendElement(interp, "while parsing principal name");
-        return TCL_ERROR;
-    }
-
-    if (parse_str(interp, argv1, &new_pw) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing new password");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-#ifdef OVERRIDE
-    if (Tcl_GetBoolean(interp, argv2, &override_qual) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing override_qual");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-#endif
-    if (parse_str(interp, argv3, &pw_ret_var) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing pw_ret variable name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    if (parse_str(interp, argv4, &msg_ret_var) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing msg_ret variable name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    ret = kadm5_chpass_principal_util(server_handle, princ, new_pw,
-#ifdef OVERRIDE
-                                      override_qual,
-#endif
-                                      pw_ret_var ? &pw_ret : 0,
-                                      msg_ret_var ? msg_ret : 0,
-                                      msg_ret_var ? sizeof(msg_ret) : 0);
-
-    if (ret == KADM5_OK) {
-        if (pw_ret_var &&
-            (! Tcl_SetVar(interp, pw_ret_var, pw_ret,
-                          TCL_LEAVE_ERR_MSG))) {
-            Tcl_AppendElement(interp, "while setting pw_ret variable");
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        if (msg_ret_var &&
-            (! Tcl_SetVar(interp, msg_ret_var, msg_ret,
-                          TCL_LEAVE_ERR_MSG))) {
-            Tcl_AppendElement(interp,
-                              "while setting msg_ret variable");
-            retcode = TCL_ERROR;
-            goto finished;
-        }
-        set_ok(interp, "Password changed.");
-    }
-    else {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-
-finished:
-    krb5_free_principal(context, princ);
-    return retcode;
-}
-
-
-
-static int tcl_kadm5_randkey_principal(ClientData clientData,
-                                       Tcl_Interp *interp,
-                                       int argc, const char *argv)
-{
-    krb5_principal princ;
-    krb5_keyblock *keyblocks;
-    int num_keys;
-    char *keyblock_var, *num_var, buf50;
-    Tcl_DString *keyblock_dstring = 0;
-    krb5_error_code krb5_ret;
-    kadm5_ret_t ret;
-    int retcode = TCL_OK;
-
-    GET_HANDLE(3, 0);
-
-    if ((krb5_ret = krb5_parse_name(context, argv0, &princ)) != 0) {
-        stash_error(interp, krb5_ret);
-        Tcl_AppendElement(interp, "while parsing principal name");
-        return TCL_ERROR;
-    }
-
-    if (parse_str(interp, argv1, &keyblock_var) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing keyblock variable name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if (parse_str(interp, argv2, &num_var) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing keyblock variable name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    ret = kadm5_randkey_principal(server_handle,
-                                  princ, keyblock_var ? &keyblocks : 0,
-                                  &num_keys);
-
-    if (ret == KADM5_OK) {
-        if (keyblock_var) {
-            keyblock_dstring = unparse_keyblocks(keyblocks, num_keys);
-            if (! Tcl_SetVar(interp, keyblock_var,
-                             keyblock_dstring->string,
-                             TCL_LEAVE_ERR_MSG)) {
-                Tcl_AppendElement(interp,
-                                  "while setting keyblock variable");
-                retcode = TCL_ERROR;
-                goto finished;
-            }
-        }
-        if (num_var) {
-            sprintf(buf, "%d", num_keys);
-            if (! Tcl_SetVar(interp, num_var, buf,
-                             TCL_LEAVE_ERR_MSG)) {
-                Tcl_AppendElement(interp,
-                                  "while setting num_keys variable");
-            }
-        }
-        set_ok(interp, "Key randomized.");
-    }
-    else {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-
-finished:
-    krb5_free_principal(context, princ);
-    if (keyblock_dstring) {
-        Tcl_DStringFree(keyblock_dstring);
-        free(keyblock_dstring);
-    }
-    return retcode;
-}
-
-
-
-static int tcl_kadm5_get_principal(ClientData clientData, Tcl_Interp *interp,
-                                   int argc, const char *argv)
-{
-    krb5_principal princ;
-    kadm5_principal_ent_rec ent;
-    Tcl_DString *ent_dstring = 0;
-    char *ent_var;
-    char *name;
-    krb5_error_code krb5_ret;
-    int tcl_ret;
-    kadm5_ret_t ret = -1;
-    krb5_int32 mask;
-    int retcode = TCL_OK;
-
-    GET_HANDLE(3, 1);
-
-    if((tcl_ret = parse_str(interp, argv0, &name)) != TCL_OK)
-        return tcl_ret;
-    if(name != NULL) {
-        if ((krb5_ret = krb5_parse_name(context, name, &princ)) != 0) {
-            stash_error(interp, krb5_ret);
-            Tcl_AppendElement(interp, "while parsing principal name");
-            return TCL_ERROR;
-        }
-    } else princ = NULL;
-
-    if ((tcl_ret = parse_str(interp, argv1, &ent_var)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing entry variable name");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    if ((tcl_ret = parse_principal_mask(interp, argv2, &mask)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing principal mask");
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    ret = kadm5_get_principal(server_handle, princ, ent_var ? &ent : 0,
-                              mask);
-
-    if (ret == KADM5_OK) {
-        if (ent_var) {
-            ent_dstring = unparse_principal_ent(&ent, mask);
-            if (! Tcl_SetVar(interp, ent_var, ent_dstring->string,
-                             TCL_LEAVE_ERR_MSG)) {
-                Tcl_AppendElement(interp,
-                                  "while setting entry variable");
-                retcode = TCL_ERROR;
-                goto finished;
-            }
-            set_ok(interp, "Principal retrieved.");
-        }
-    }
-    else {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-
-finished:
-    if (ent_dstring) {
-        Tcl_DStringFree(ent_dstring);
-        free(ent_dstring);
-    }
-    if(princ != NULL)
-        krb5_free_principal(context, princ);
-    if (ret == KADM5_OK && ent_var &&
-        (ret = kadm5_free_principal_ent(server_handle, &ent)) &&
-        (retcode == TCL_OK)) {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-    return retcode;
-}
-
-static int tcl_kadm5_create_policy(ClientData clientData, Tcl_Interp *interp,
-                                   int argc, const char *argv)
-{
-    int tcl_ret;
-    kadm5_ret_t ret;
-    int retcode = TCL_OK;
-    char *policy_string;
-    kadm5_policy_ent_t policy = 0;
-    krb5_int32 mask;
-
-    GET_HANDLE(2, 0);
-
-    if ((tcl_ret = parse_str(interp, argv0, &policy_string)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing policy");
-        return tcl_ret;
-    }
-
-    if (policy_string &&
-        ((tcl_ret = parse_policy_ent(interp, policy_string, &policy))
-         != TCL_OK)) {
-        return tcl_ret;
-    }
-
-    if ((tcl_ret = parse_policy_mask(interp, argv1, &mask)) != TCL_OK) {
-        retcode = tcl_ret;
-        goto finished;
-    }
-
-    ret = kadm5_create_policy(server_handle, policy, mask);
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-    else {
-        set_ok(interp, "Policy created.");
-    }
-
-finished:
-    if (policy) {
-        free_policy_ent(&policy);
-    }
-    return retcode;
-}
-
-
-
-static int tcl_kadm5_delete_policy(ClientData clientData, Tcl_Interp *interp,
-                                   int argc, const char *argv)
-{
-    kadm5_ret_t ret;
-    char *policy;
-
-    GET_HANDLE(1, 0);
-
-    if (parse_str(interp, argv0, &policy) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing policy name");
-        return TCL_ERROR;
-    }
-
-    ret = kadm5_delete_policy(server_handle, policy);
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        return TCL_ERROR;
-    }
-    else {
-        set_ok(interp, "Policy deleted.");
-        return TCL_OK;
-    }
-}
-
-
-
-static int tcl_kadm5_modify_policy(ClientData clientData, Tcl_Interp *interp,
-                                   int argc, const char *argv)
-{
-    char *policy_string;
-    kadm5_policy_ent_t policy = 0;
-    int tcl_ret;
-    krb5_int32 mask;
-    int retcode = TCL_OK;
-    kadm5_ret_t ret;
-
-    GET_HANDLE(2, 0);
-
-    if ((tcl_ret = parse_str(interp, argv0, &policy_string)) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing policy");
-        return tcl_ret;
-    }
-
-    if (policy_string &&
-        ((tcl_ret = parse_policy_ent(interp, policy_string, &policy))
-         != TCL_OK)) {
-        return tcl_ret;
-    }
-
-    if ((tcl_ret = parse_policy_mask(interp, argv1, &mask)) != TCL_OK) {
-        retcode = TCL_ERROR;
-        goto finished;
-    }
-
-    ret = kadm5_modify_policy(server_handle, policy, mask);
-
-    if (ret != KADM5_OK) {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-    else {
-        set_ok(interp, "Policy modified.");
-    }
-
-finished:
-    if (policy) {
-        free_policy_ent(&policy);
-    }
-    return retcode;
-}
-
-
-static int tcl_kadm5_get_policy(ClientData clientData, Tcl_Interp *interp,
-                                int argc, const char *argv)
-{
-    kadm5_policy_ent_rec ent;
-    Tcl_DString *ent_dstring = 0;
-    char *policy;
-    char *ent_var;
-    kadm5_ret_t ret;
-    int retcode = TCL_OK;
-
-    GET_HANDLE(2, 1);
-
-    if (parse_str(interp, argv0, &policy) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing policy name");
-        return TCL_ERROR;
-    }
-
-    if (parse_str(interp, argv1, &ent_var) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing entry variable name");
-        return TCL_ERROR;
-    }
-
-    ret = kadm5_get_policy(server_handle, policy, ent_var ? &ent : 0);
-
-    if (ret == KADM5_OK) {
-        if (ent_var) {
-            ent_dstring = unparse_policy_ent(&ent);
-            if (! Tcl_SetVar(interp, ent_var, ent_dstring->string,
-                             TCL_LEAVE_ERR_MSG)) {
-                Tcl_AppendElement(interp,
-                                  "while setting entry variable");
-                retcode = TCL_ERROR;
-                goto finished;
-            }
-            set_ok(interp, "Policy retrieved.");
-        }
-    }
-    else {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-
-finished:
-    if (ent_dstring) {
-        Tcl_DStringFree(ent_dstring);
-        free(ent_dstring);
-    }
-    if (ent_var && ret == KADM5_OK &&
-        (ret = kadm5_free_policy_ent(server_handle, &ent)) &&
-        (retcode == TCL_OK)) {
-        stash_error(interp, ret);
-        retcode = TCL_ERROR;
-    }
-    return retcode;
-}
-
-
-
-static int tcl_kadm5_free_principal_ent(ClientData clientData,
-                                        Tcl_Interp *interp,
-                                        int argc, const char *argv)
-{
-    char *ent_name;
-    kadm5_principal_ent_t ent;
-    kadm5_ret_t ret;
-
-    GET_HANDLE(1, 0);
-
-    if (parse_str(interp, argv0, &ent_name) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing entry name");
-        return TCL_ERROR;
-    }
-
-    if ((! ent_name) &&
-        (ret = kadm5_free_principal_ent(server_handle, 0))) {
-        stash_error(interp, ret);
-        return TCL_ERROR;
-    }
-    else {
-        Tcl_HashEntry *entry;
-
-        if (strncmp(ent_name, "principal", sizeof("principal")-1)) {
-            Tcl_AppendResult(interp, "invalid principal handle \"",
-                             ent_name, "\"", 0);
-            return TCL_ERROR;
-        }
-        if (! struct_table) {
-            if (! (struct_table = malloc(sizeof(*struct_table)))) {
-                fprintf(stderr, "Out of memory!\n");
-                exit(1); /* XXX */
-            }
-            Tcl_InitHashTable(struct_table, TCL_STRING_KEYS);
-        }
-
-        if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) {
-            Tcl_AppendResult(interp, "principal handle \"", ent_name,
-                             "\" not found", 0);
-            return TCL_ERROR;
-        }
-
-        ent = (kadm5_principal_ent_t) Tcl_GetHashValue(entry);
-
-        ret = kadm5_free_principal_ent(server_handle, ent);
-        if (ret != KADM5_OK) {
-            stash_error(interp, ret);
-            return TCL_ERROR;
-        }
-        Tcl_DeleteHashEntry(entry);
-    }
-    set_ok(interp, "Principal freed.");
-    return TCL_OK;
-}
-
-
-static int tcl_kadm5_free_policy_ent(ClientData clientData,
-                                     Tcl_Interp *interp,
-                                     int argc, const char *argv)
-{
-    char *ent_name;
-    kadm5_policy_ent_t ent;
-    kadm5_ret_t ret;
-
-    GET_HANDLE(1, 0);
-
-    if (parse_str(interp, argv0, &ent_name) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing entry name");
-        return TCL_ERROR;
-    }
-
-    if ((! ent_name) &&
-        (ret = kadm5_free_policy_ent(server_handle, 0))) {
-        stash_error(interp, ret);
-        return TCL_ERROR;
-    }
-    else {
-        Tcl_HashEntry *entry;
-
-        if (strncmp(ent_name, "policy", sizeof("policy")-1)) {
-            Tcl_AppendResult(interp, "invalid principal handle \"",
-                             ent_name, "\"", 0);
-            return TCL_ERROR;
-        }
-        if (! struct_table) {
-            if (! (struct_table = malloc(sizeof(*struct_table)))) {
-                fprintf(stderr, "Out of memory!\n");
-                exit(1); /* XXX */
-            }
-            Tcl_InitHashTable(struct_table, TCL_STRING_KEYS);
-        }
-
-        if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) {
-            Tcl_AppendResult(interp, "policy handle \"", ent_name,
-                             "\" not found", 0);
-            return TCL_ERROR;
-        }
-
-        ent = (kadm5_policy_ent_t) Tcl_GetHashValue(entry);
-
-        if ((ret = kadm5_free_policy_ent(server_handle, ent)) != KADM5_OK) {
-            stash_error(interp, ret);
-            return TCL_ERROR;
-        }
-        Tcl_DeleteHashEntry(entry);
-    }
-    set_ok(interp, "Policy freed.");
-    return TCL_OK;
-}
-
-
-static int tcl_kadm5_get_privs(ClientData clientData, Tcl_Interp *interp,
-                               int argc, const char *argv)
-{
-    const char *set_ret;
-    kadm5_ret_t ret;
-    char *priv_var;
-    long privs;
-
-    GET_HANDLE(1, 0);
-
-    if (parse_str(interp, argv0, &priv_var) != TCL_OK) {
-        Tcl_AppendElement(interp, "while parsing privs variable name");
-        return TCL_ERROR;
-    }
-
-    ret = kadm5_get_privs(server_handle, priv_var ? &privs : 0);
-
-    if (ret == KADM5_OK) {
-        if (priv_var) {
-            Tcl_DString *str = unparse_privs(privs);
-            set_ret = Tcl_SetVar(interp, priv_var, str->string,
-                                 TCL_LEAVE_ERR_MSG);
-            Tcl_DStringFree(str);
-            free(str);
-            if (! set_ret) {
-                Tcl_AppendElement(interp, "while setting priv variable");
-                return TCL_ERROR;
-            }
-        }
-        set_ok(interp, "Privileges retrieved.");
-        return TCL_OK;
-    }
-    else {
-        stash_error(interp, ret);
-        return TCL_ERROR;
-    }
-}
-
-
-void Tcl_kadm5_init(Tcl_Interp *interp)
-{
-    char buf20;
-
-    Tcl_SetVar(interp, "KADM5_ADMIN_SERVICE",
-               KADM5_ADMIN_SERVICE, TCL_GLOBAL_ONLY);
-    Tcl_SetVar(interp, "KADM5_CHANGEPW_SERVICE",
-               KADM5_CHANGEPW_SERVICE, TCL_GLOBAL_ONLY);
-    (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION);
-    Tcl_SetVar(interp, "KADM5_STRUCT_VERSION", buf, TCL_GLOBAL_ONLY);
-    (void) sprintf(buf, "%d", KADM5_API_VERSION_2);
-    Tcl_SetVar(interp, "KADM5_API_VERSION_2", buf, TCL_GLOBAL_ONLY);
-    (void) sprintf(buf, "%d", KADM5_API_VERSION_3);
-    Tcl_SetVar(interp, "KADM5_API_VERSION_3", buf, TCL_GLOBAL_ONLY);
-    (void) sprintf(buf, "%d", KADM5_API_VERSION_4);
-    Tcl_SetVar(interp, "KADM5_API_VERSION_4", buf, TCL_GLOBAL_ONLY);
-    (void) sprintf(buf, "%d", KADM5_API_VERSION_MASK);
-    Tcl_SetVar(interp, "KADM5_API_VERSION_MASK", buf, TCL_GLOBAL_ONLY);
-    (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION_MASK);
-    Tcl_SetVar(interp, "KADM5_STRUCT_VERSION_MASK", buf,
-               TCL_GLOBAL_ONLY);
-
-    Tcl_CreateCommand(interp, "kadm5_init", tcl_kadm5_init, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_init_with_creds",
-                      tcl_kadm5_init_with_creds, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_destroy", tcl_kadm5_destroy, 0,
-                      0);
-    Tcl_CreateCommand(interp, "kadm5_create_principal",
-                      tcl_kadm5_create_principal, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_delete_principal",
-                      tcl_kadm5_delete_principal, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_modify_principal",
-                      tcl_kadm5_modify_principal, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_rename_principal",
-                      tcl_kadm5_rename_principal, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_chpass_principal",
-                      tcl_kadm5_chpass_principal, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_chpass_principal_util",
-                      tcl_kadm5_chpass_principal_util, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_randkey_principal",
-                      tcl_kadm5_randkey_principal, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_get_principal",
-                      tcl_kadm5_get_principal, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_create_policy",
-                      tcl_kadm5_create_policy, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_delete_policy",
-                      tcl_kadm5_delete_policy, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_modify_policy",
-                      tcl_kadm5_modify_policy, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_get_policy",
-                      tcl_kadm5_get_policy, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_free_principal_ent",
-                      tcl_kadm5_free_principal_ent, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_free_policy_ent",
-                      tcl_kadm5_free_policy_ent, 0, 0);
-    Tcl_CreateCommand(interp, "kadm5_get_privs",
-                      tcl_kadm5_get_privs, 0, 0);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/tcl_kadm5.h Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/tcl_kadm5_syntax Deleted

@@ -1,57 +0,0 @@
-Here's a brief summary of the syntax of the tcl versions of the
-kadm5 functions:
-
-string		Can be a string or "null" which will turn into a null pointer
-principal_ent	A 12-field list in the order of the principal_ent
-		structure: {string number number number number string
-			    number mask number number string mask}
-		It can also be "null", like a string, to indicate that
-		a null structure pointer should be used.
-mask		Either a number, representing the actual value of the
-		mask, or a sequence of symbols in a list.  Example:
-		{PRINCIPAL ATTRIBUTES} is a valid principal mask.
-boolean		"1", "0", "true", "false", etc.
-varname		The name of a Tcl variable, or "null" to not assign.
-policy_ent	Similar to principal_ent, but with seven fields,
-		instead of 12.  The first is a string, and the rest
-		are numbers.
-
-init
-		client_name:string pass:string service_name:string
-		realm:string struct_version:int api_version:int
-		server_handle_ret:varname
-destroy
-		server_handle:string
-create_principal
-		server_handle:string principal:principal_ent
-		mask:principal_mask password:string
-delete_principal
-		server_handle:string name:string
-modify_principal
-		server_handle:string principal_principal_ent
-		mask:principal_mask
-rename_principal
-		server_handle:string source:string target:string
-chpass_principal
-		server_handle:string name:string password:string
-chpass_principal_util
-		server_handle:string name:string password:string
-		pw_ret:varname msg_ret:varname
-randkey_principal
-		server_handle:string name:string keyblock_var:varname
-get_principal -struct
-		server_handle:string name:string princ_var:varname
-create_policy
-		server_handle:string policy:policy_ent mask:policy_mask
-delete_policy
-		server_handle:string name:string
-modify_policy
-		server_handle:string policy:policy_ent mask:policy_mask
-get_policy -struct
-		server_handle:string name:string policy_var:varname
-free_principal_ent
-		server_handle:string handle:string
-free_policy_ent
-		server_handle:string handle:string
-get_privs
-		server_handle:string privs:priv_var

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/tcl_krb5_hash.c Deleted

@@ -1,167 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/*
- * All of the TCL krb5 functions which return (or place into output
- * variables) structures or pointers to structures that can't be
- * represented as tcl native types, do so by returning a handle for
- * the appropriate structure.  The handle is a string of the form
- * "type$id", where "type" is the type of datum represented by the
- * handle and "id" is a unique identifier for it.  This handle can
- * then be used later by the caller to refer to the object, and
- * internally to retrieve the actually datum from the appropriate hash
- * table.
- *
- * The functions in this file do four things:
- *
- * 1) Given a pointer to a datum and a string representing the type of
- * datum to which the pointer refers, create a new handle for the
- * datum, store the datum in the hash table using the new handle as
- * its key, and return the new handle.
- *
- * 2) Given a handle, locate and return the appropriate hash table
- * datum.
- *
- * 3) Given a handle, look through a table of types and unparse
- * functions to figure out what function to call to get a string
- * representation of the datum, call it with the appropriate pointer
- * (obtained from the hash table) as an argument, and return the
- * resulting string as the unparsed form of the datum.
- *
- * 4) Given a handle, remove that handle and its associated datum from
- * the hash table (but don't free it -- it's assumed to have already
- * been freed by the caller).
- */
-
-#if HAVE_TCL_H
-#include <tcl.h>
-#elif HAVE_TCL_TCL_H
-#include <tcl/tcl.h>
-#endif
-#include <assert.h>
-
-#define SEP_STR "$"
-
-static char *memory_error = "out of memory";
-
-/*
- * Right now, we're only using one hash table.  However, at some point
- * in the future, we might decide to use a separate hash table for
- * every type.  Therefore, I'm putting this function in as an
- * abstraction so it's the only thing we'll have to change if we
- * decide to do that.
- *
- * Also, this function allows us to put in just one place the code for
- * checking to make sure that the hash table exists and initializing
- * it if it doesn't.
- */
-
-static TclHashTable *get_hash_table(Tcl_Interp *interp,
-                                    char *type)
-{
-    static Tcl_HashTable *hash_table = 0;
-
-    if (! hash_table) {
-        if (! (hash_table = malloc(sizeof(*hash_table)))) {
-            Tcl_SetResult(interp, memory_error, TCL_STATIC);
-            return 0;
-        }
-        Tcl_InitHashTable(hash_table, TCL_STRING_KEYS);
-    }
-    return hash_table;
-}
-
-#define MAX_ID 999999999
-#define ID_BUF_SIZE 10
-
-static Tcl_HashEntry *get_new_handle(Tcl_Interp *interp,
-                                     char *type)
-{
-    static unsigned long int id_counter = 0;
-    Tcl_DString *handle;
-    char int_bufID_BUF_SIZE;
-
-    if (! (handle = malloc(sizeof(*handle)))) {
-        Tcl_SetResult(interp, memory_error, TCL_STATIC);
-        return 0;
-    }
-    Tcl_DStringInit(handle);
-
-    assert(id_counter <= MAX_ID);
-
-    sprintf(int_buf, "%d", id_counter++);
-
-    Tcl_DStringAppend(handle, type, -1);
-    Tcl_DStringAppend(handle, SEP_STR, -1);
-    Tcl_DStringAppend(handle, int_buf, -1);
-
-    return handle;
-}
-
-
-Tcl_DString *tcl_krb5_create_object(Tcl_Interp *interp,
-                                    char *type,
-                                    ClientData datum)
-{
-    Tcl_HashTable *table;
-    Tcl_DString *handle;
-    Tcl_HashEntry *entry;
-    int entry_created = 0;
-
-    if (! (table = get_hash_table(interp, type))) {
-        return 0;
-    }
-
-    if (! (handle = get_new_handle(interp, type))) {
-        return 0;
-    }
-
-    if (! (entry = Tcl_CreateHashEntry(table, handle, &entry_created))) {
-        Tcl_SetResult(interp, "error creating hash entry", TCL_STATIC);
-        Tcl_DStringFree(handle);
-        return TCL_ERROR;
-    }
-
-    assert(entry_created);
-
-    Tcl_SetHashValue(entry, datum);
-
-    return handle;
-}
-
-ClientData tcl_krb5_get_object(Tcl_Interp *interp,
-                               char *handle)
-{
-    char *myhandle, *id_ptr;
-    Tcl_HashTable *table;
-    Tcl_HashEntry *entry;
-
-    if (! (myhandle = strdup(handle))) {
-        Tcl_SetResult(interp, memory_error, TCL_STATIC);
-        return 0;
-    }
-
-    if (! (id_ptr = index(myhandle, *SEP_STR))) {
-        free(myhandle);
-        Tcl_ResetResult(interp);
-        Tcl_AppendResult(interp, "malformatted handle \"", handle,
-                         "\"", 0);
-        return 0;
-    }
-
-    *id_ptr = '\0';
-
-    if (! (table = get_hash_table(interp, myhandle))) {
-        free(myhandle);
-        return 0;
-    }
-
-    free(myhandle);
-
-    if (! (entry = Tcl_FindHashEntry(table, handle))) {
-        Tcl_ResetResult(interp);
-        Tcl_AppendResult(interp, "no object corresponding to handle \"",
-                         handle, "\"", 0);
-        return 0;
-    }
-
-    return(Tcl_GetHashValue(entry));
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/testing/util/test.c Deleted

@@ -1,38 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include "autoconf.h"
-#if HAVE_TCL_H
-#include <tcl.h>
-#elif HAVE_TCL_TCL_H
-#include <tcl/tcl.h>
-#endif
-#include "tcl_kadm5.h"
-
-#define _TCL_MAIN ((TCL_MAJOR_VERSION * 100 + TCL_MINOR_VERSION) >= 704)
-
-#if _TCL_MAIN
-int
-main(argc, argv)
-    int argc;                   /* Number of command-line arguments. */
-    char **argv;                /* Values of command-line arguments. */
-{
-    Tcl_Main(argc, argv, Tcl_AppInit);
-    return 0;                   /* Needed only to prevent compiler warning. */
-}
-#else
-/*
- * The following variable is a special hack that allows applications
- * to be linked using the procedure "main" from the Tcl library.  The
- * variable generates a reference to "main", which causes main to
- * be brought in from the library (and all of Tcl with it).
- */
-
-extern int main();
-int *tclDummyMainPtr = (int *) main;
-#endif
-
-int Tcl_AppInit(Tcl_Interp *interp)
-{
-    Tcl_kadm5_init(interp);
-
-    return(TCL_OK);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/crypto_mod.h Deleted

@@ -1,39 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/builtin/crypto_mod.h - Builtin crypto module declarations */
-/*
- * Copyright (C) 2011 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * This header is included from lib/crypto/krb/crypto_int.h to provide
- * module-specific declarations.  It is not included directly from source
- * files.
- */
-
-#ifndef CRYPTO_MOD_H
-#define CRYPTO_MOD_H
-
-#include <aes/aes.h>
-#include <sha2/sha2.h>
-
-#endif /* CRYPTO_MOD_H */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/init.c Deleted

@@ -1,38 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/builtin/init.c - Module init and cleanup functions */
-/*
- * Copyright (C) 2010 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-#include "crypto_int.h"
-
-int
-krb5int_crypto_impl_init(void)
-{
-    return 0;
-}
-
-void
-krb5int_crypto_impl_cleanup(void)
-{
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/crypto_tests/t_prng.c Deleted

@@ -1,90 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/crypto_tests/t_prng.c */
-/*
- * Copyright (C) 2001 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * This file contains tests for the PRNG code in Kerberos.  It reads
- * an input file, and writes an output file.  It is assumed that the
- * output file will be diffed against expected output to see whether
- * regression tests pass.  The input file has a very primitive format.
- * It is composed of alternating seeds and outputs.  The first line in
- * the file is an integer source id from the krb5_c_randsource enum in
- * krb5.h.  Then an integer seed length is read.  Then that many bytes
- * (encoded in hex) are read; whitespace or newlines may be inserted
- * between bytes.  Then after the seed data is an integer describing
- * how many bytes of output should be written.  Then another source ID
- * and seed length is read.  If the seed length is 0, the source id is
- * ignored and the seed is not seeded.
- */
-
-#include "k5-int.h"
-#include <assert.h>
-
-int main () {
-    krb5_error_code ret;
-    krb5_data input, output;
-    unsigned int source_id, seed_length;
-    unsigned int i;
-    while (1) {
-        /* Read source*/
-        if (scanf ("%u", &source_id ) == EOF )
-            break;
-        /* Read seed length*/
-        if (scanf ("%u", &seed_length) == EOF)
-            break;
-        if (seed_length ) {
-            unsigned int lc;
-            ret = alloc_data(&input, seed_length);
-            assert(!ret);
-            for (lc = seed_length; lc > 0; lc--) {
-                scanf ("%2x",  &i);
-                input.dataseed_length-lc = (unsigned) (i&0xff);
-            }
-            ret = krb5_c_random_add_entropy (0, source_id, &input);
-            assert(!ret);
-            free (input.data);
-            input.data = NULL;
-        }
-        if (scanf ("%u", &i) == EOF)
-            break;
-        if (i) {
-            ret = alloc_data(&output, i);
-            assert(!ret);
-            ret = krb5_c_random_make_octets (0, &output);
-            if (ret)
-                printf ("failed\n");
-            else {
-                for (; i > 0; i--) {
-                    printf ("%02x",
-                            (unsigned int) ((unsigned char ) output.dataoutput.length-i));
-                }
-                printf ("\n");
-            }
-            free (output.data);
-            output.data = NULL;
-        }
-    }
-    return (0);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/cmac.c Deleted

@@ -1,200 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/krb/cmac.c */
-/*
- * Copyright 2010 by the Massachusetts Institute of Technology.
- * All Rights Reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-#include "crypto_int.h"
-
-#define BLOCK_SIZE 16
-
-static unsigned char const_RbBLOCK_SIZE = {
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x87
-};
-
-static void
-xor_128(unsigned char *a, unsigned char *b, unsigned char *out)
-{
-    int z;
-
-    for (z = 0; z < BLOCK_SIZE / 4; z++) {
-        unsigned char *aptr = &az * 4;
-        unsigned char *bptr = &bz * 4;
-        unsigned char *outptr = &outz * 4;
-
-        store_32_n(load_32_n(aptr) ^ load_32_n(bptr), outptr);
-    }
-}
-
-static void
-leftshift_onebit(unsigned char *input, unsigned char *output)
-{
-    int i;
-    unsigned char overflow = 0;
-
-    for (i = BLOCK_SIZE - 1; i >= 0; i--) {
-        outputi = inputi << 1;
-        outputi |= overflow;
-        overflow = (inputi & 0x80) ? 1 : 0;
-    }
-}
-
-/* Generate subkeys K1 and K2 as described in RFC 4493 figure 2.2. */
-static krb5_error_code
-generate_subkey(const struct krb5_enc_provider *enc,
-                krb5_key key,
-                unsigned char *K1,
-                unsigned char *K2)
-{
-    unsigned char LBLOCK_SIZE;
-    unsigned char tmpBLOCK_SIZE;
-    krb5_data d;
-    krb5_error_code ret;
-
-    /* L := encrypt(K, const_Zero) */
-    memset(L, 0, sizeof(L));
-    d = make_data(L, BLOCK_SIZE);
-    ret = encrypt_block(enc, key, &d);
-    if (ret != 0)
-        return ret;
-
-    /* K1 := (MSB(L) == 0) ? L << 1 : (L << 1) XOR const_Rb */
-    if ((L0 & 0x80) == 0) {
-        leftshift_onebit(L, K1);
-    } else {
-        leftshift_onebit(L, tmp);
-        xor_128(tmp, const_Rb, K1);
-    }
-
-    /* K2 := (MSB(K1) == 0) ? K1 << 1 : (K1 << 1) XOR const_Rb */
-    if ((K10 & 0x80) == 0) {
-        leftshift_onebit(K1, K2);
-    } else {
-        leftshift_onebit(K1, tmp);
-        xor_128(tmp, const_Rb, K2);
-    }
-
-    return 0;
-}
-
-/* Pad out lastb with a 1 bit followed by 0 bits, placing the result in pad. */
-static void
-padding(unsigned char *lastb, unsigned char *pad, int length)
-{
-    int j;
-
-    /* original last block */
-    for (j = 0; j < BLOCK_SIZE; j++) {
-        if (j < length) {
-            padj = lastbj;
-        } else if (j == length) {
-            padj = 0x80;
-        } else {
-            padj = 0x00;
-        }
-    }
-}
-
-/*
- * Implementation of CMAC algorithm. When used with AES, this function
- * is compatible with RFC 4493 figure 2.3.
- */
-krb5_error_code
-krb5int_cmac_checksum(const struct krb5_enc_provider *enc, krb5_key key,
-                      const krb5_crypto_iov *data, size_t num_data,
-                      krb5_data *output)
-{
-    unsigned char YBLOCK_SIZE, M_lastBLOCK_SIZE, paddedBLOCK_SIZE;
-    unsigned char K1BLOCK_SIZE, K2BLOCK_SIZE;
-    unsigned char inputBLOCK_SIZE;
-    unsigned int n, i, flag;
-    krb5_error_code ret;
-    struct iov_cursor cursor;
-    size_t length;
-    krb5_crypto_iov iov1;
-    krb5_data d;
-
-    assert(enc->cbc_mac != NULL);
-
-    if (enc->block_size != BLOCK_SIZE)
-        return KRB5_BAD_MSIZE;
-
-    length = iov_total_length(data, num_data, TRUE);
-
-    /* Step 1. */
-    ret = generate_subkey(enc, key, K1, K2);
-    if (ret != 0)
-        return ret;
-
-    /* Step 2. */
-    n = (length + BLOCK_SIZE - 1) / BLOCK_SIZE;
-
-    /* Step 3. */
-    if (n == 0) {
-        n = 1;
-        flag = 0;
-    } else {
-        flag = ((length % BLOCK_SIZE) == 0);
-    }
-
-    iov0.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov0.data = make_data(input, BLOCK_SIZE);
-
-    /* Step 5 (we'll do step 4 in a bit). */
-    memset(Y, 0, BLOCK_SIZE);
-    d = make_data(Y, BLOCK_SIZE);
-
-    /* Step 6 (all but last block). */
-    k5_iov_cursor_init(&cursor, data, num_data, BLOCK_SIZE, TRUE);
-    for (i = 0; i < n - 1; i++) {
-        k5_iov_cursor_get(&cursor, input);
-
-        ret = enc->cbc_mac(key, iov, 1, &d, &d);
-        if (ret != 0)
-            return ret;
-    }
-
-    /* Step 4. */
-    k5_iov_cursor_get(&cursor, input);
-    if (flag) {
-        /* last block is complete block */
-        xor_128(input, K1, M_last);
-    } else {
-        padding(input, padded, length % BLOCK_SIZE);
-        xor_128(padded, K2, M_last);
-    }
-
-    /* Step 6 (last block). */
-    iov0.data = make_data(M_last, BLOCK_SIZE);
-    ret = enc->cbc_mac(key, iov, 1, &d, &d);
-    if (ret != 0)
-        return ret;
-
-    assert(output->length >= d.length);
-
-    output->length = d.length;
-    memcpy(output->data, d.data, d.length);
-
-    return 0;
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/crypto_libinit.c Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/prng_device.c Deleted

@@ -1,99 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/krb/prng_device.c - OS device-based PRNG implementation */
-/*
- * Copyright (C) 2011 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- *
- * Export of this software from the United States of America may require
- * a specific license from the United States Government.  It is the
- * responsibility of any person or organization contemplating export to
- * obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- *  or implied warranty.
- */
-
-/*
- * This file implements a PRNG module which relies on the system's /dev/urandom
- * device.  An OS packager can select this module given sufficient confidence
- * in the operating system's native PRNG quality.
- */
-
-#include "crypto_int.h"
-
-#define DEVICE "/dev/urandom"
-
-static int fd = -1;
-
-int
-k5_prng_init(void)
-{
-    /* Try to open the random device read-write; if that fails, read-only is
-     * okay. */
-    fd = open(DEVICE, O_RDWR, 0);
-    if (fd == -1)
-        fd = open(DEVICE, O_RDONLY, 0);
-    if (fd == -1)
-        return errno;
-    return 0;
-}
-
-void
-k5_prng_cleanup(void)
-{
-    close(fd);
-    fd = -1;
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_add_entropy(krb5_context context, unsigned int randsource,
-                          const krb5_data *indata)
-{
-    krb5_error_code ret;
-
-    ret = krb5int_crypto_init();
-    if (ret)
-        return ret;
-
-    /* Some random devices let user-space processes contribute entropy.  Don't
-     * worry if this fails. */
-    (void)write(fd, indata->data, indata->length);
-    return 0;
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_make_octets(krb5_context context, krb5_data *outdata)
-{
-    char *buf = outdata->data;
-    size_t len = outdata->length;
-    ssize_t count;
-
-    while (len > 0) {
-        count = read(fd, buf, len);
-        if (count == 0)         /* Not expected from a random device. */
-            return KRB5_CRYPTO_INTERNAL;
-        if (count == -1)
-            return errno;
-        buf += count;
-        len -= count;
-    }
-    return 0;
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_os_entropy(krb5_context context, int strong, int *success)
-{
-    return 0;
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/prng_fortuna.c Deleted

@@ -1,470 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/krb/prng_fortuna.c - Fortuna PRNG implementation */
-/*
- * Copyright (c) 2005 Marko Kreen
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *        notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *        notice, this list of conditions and the following disclaimer in the
- *        documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.      IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-/*
- * Copyright (C) 2010, 2011 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- *
- * Export of this software from the United States of America may require
- * a specific license from the United States Government.  It is the
- * responsibility of any person or organization contemplating export to
- * obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- *  or implied warranty.
- */
-
-/*
- * This file implements the generator and accumulator parts of the Fortuna PRNG
- * as described in chapter 9 of _Cryptography Engineering_ by Ferguson,
- * Schneier, and Kohno.
- *
- * The generator, once seeded with an unguessable value, produces an unlimited
- * number of pseudo-random outputs which cannot be used to determine the
- * internal state of the generator (without an unreasonable amount of
- * computational power).  The generator protects against the case where the OS
- * random number generator is not cryptographically secure, but can produce an
- * unguessable initial seed.  Successive reseeds of the generator will not make
- * the internal state any more guessable than it was before.
- *
- * The accumulator is layered on top of the generator, and seeks to eventually
- * recover from the case where the OS random number generator did not produce
- * an unguessable initial seed.  Unreliable entropy inputs are collected into
- * 32 pools, which are used to reseed the generator when enough entropy has
- * been collected.  Each pool collects twice as much entropy between reseeds as
- * the previous one; eventually a reseed will occur involving a pool with
- * enough entropy that an attacker cannot maintain knowledge of the generator's
- * internal state.  The accumulator is only helpful for a long-running process
- * such as a KDC which can submit periodic entropy inputs to the PRNG.
- */
-
-#include "crypto_int.h"
-
-/* The accumulator's number of pools. */
-#define NUM_POOLS 32
-
-/* Minimum reseed interval in microseconds. */
-#define RESEED_INTERVAL 100000  /* 0.1 sec */
-
-/* For one big request, change the key after this many bytes. */
-#define MAX_BYTES_PER_KEY (1 << 20)
-
-/* Reseed if pool 0 has had this many bytes added since last reseed. */
-#define MIN_POOL_LEN 64
-
-/* AES-256 key size in bytes. */
-#define AES256_KEYSIZE (256/8)
-
-/* AES-256 block size in bytes. */
-#define AES256_BLOCKSIZE (128/8)
-
-/* SHA-256 block size in bytes. */
-#define SHA256_BLOCKSIZE (512/8)
-
-/* SHA-256 result size in bytes. */
-#define SHA256_HASHSIZE (256/8)
-
-/* Genarator - block cipher in CTR mode */
-struct fortuna_state
-{
-    /* Generator state. */
-    unsigned char counterAES256_BLOCKSIZE;
-    unsigned char keyAES256_KEYSIZE;
-    aes_encrypt_ctx ciph;
-
-    /* Accumulator state. */
-    SHA256_CTX poolNUM_POOLS;
-    unsigned int pool_index;
-    unsigned int reseed_count;
-    struct timeval last_reseed_time;
-    unsigned int pool0_bytes;
-};
-
-/*
- * SHAd-256(m) is defined as SHA-256(SHA-256(0^512||m))--that is, hash a
- * block full of zeros followed by the input data, then re-hash the result.
- * These functions implement the SHAd-256 function on incremental inputs.
- */
-
-static void
-shad256_init(SHA256_CTX *ctx)
-{
-    unsigned char zeroSHA256_BLOCKSIZE;
-
-    /* Initialize the inner SHA-256 context and update it with a zero block. */
-    memset(zero, 0, sizeof(zero));
-    k5_sha256_init(ctx);
-    k5_sha256_update(ctx, zero, sizeof(zero));
-}
-
-static void
-shad256_update(SHA256_CTX *ctx, const unsigned char *data, int len)
-{
-    /* Feed the input to the inner SHA-256 context. */
-    k5_sha256_update(ctx, data, len);
-}
-
-static void
-shad256_result(SHA256_CTX *ctx, unsigned char *dst)
-{
-    /* Finalize the inner context, then feed the result back through SHA256. */
-    k5_sha256_final(dst, ctx);
-    k5_sha256_init(ctx);
-    k5_sha256_update(ctx, dst, SHA256_HASHSIZE);
-    k5_sha256_final(dst, ctx);
-}
-
-/* Initialize state. */
-static void
-init_state(struct fortuna_state *st)
-{
-    unsigned int i;
-
-    memset(st, 0, sizeof(*st));
-    for (i = 0; i < NUM_POOLS; i++)
-        shad256_init(&st->pooli);
-}
-
-/* Increment st->counter using least significant byte first. */
-static void
-inc_counter(struct fortuna_state *st)
-{
-    uint64_t val;
-
-    val = load_64_le(st->counter) + 1;
-    store_64_le(val, st->counter);
-    if (val == 0) {
-        val = load_64_le(st->counter + 8) + 1;
-        store_64_le(val, st->counter + 8);
-    }
-}
-
-/* Encrypt and increment st->counter in the current cipher context. */
-static void
-encrypt_counter(struct fortuna_state *st, unsigned char *dst)
-{
-    k5_aes_encrypt(st->counter, dst, &st->ciph);
-    inc_counter(st);
-}
-
-/* Reseed the generator based on hopefully non-guessable input. */
-static void
-generator_reseed(struct fortuna_state *st, const unsigned char *data,
-                 size_t len)
-{
-    SHA256_CTX ctx;
-
-    /* Calculate SHAd-256(key||s) and make that the new key.  Depend on the
-     * SHA-256 hash size being the AES-256 key size. */
-    shad256_init(&ctx);
-    shad256_update(&ctx, st->key, AES256_KEYSIZE);
-    shad256_update(&ctx, data, len);
-    shad256_result(&ctx, st->key);
-    zap(&ctx, sizeof(ctx));
-    k5_aes_encrypt_key256(st->key, &st->ciph);
-
-    /* Increment counter. */
-    inc_counter(st);
-}
-
-/* Generate two blocks in counter mode and replace the key with the result. */
-static void
-change_key(struct fortuna_state *st)
-{
-    encrypt_counter(st, st->key);
-    encrypt_counter(st, st->key + AES256_BLOCKSIZE);
-    k5_aes_encrypt_key256(st->key, &st->ciph);
-}
-
-/* Output pseudo-random data from the generator. */
-static void
-generator_output(struct fortuna_state *st, unsigned char *dst, size_t len)
-{
-    unsigned char resultAES256_BLOCKSIZE;
-    size_t n, count = 0;
-
-    while (len > 0) {
-        /* Produce bytes and copy the result into dst. */
-        encrypt_counter(st, result);
-        n = (len < AES256_BLOCKSIZE) ? len : AES256_BLOCKSIZE;
-        memcpy(dst, result, n);
-        dst += n;
-        len -= n;
-
-        /* Each time we reach MAX_BYTES_PER_KEY bytes, change the key. */
-        count += AES256_BLOCKSIZE;
-        if (count >= MAX_BYTES_PER_KEY) {
-            change_key(st);
-            count = 0;
-        }
-    }
-    zap(result, sizeof(result));
-
-    /* Change the key after each request. */
-    change_key(st);
-}
-
-/* Reseed the generator using the accumulator pools. */
-static void
-accumulator_reseed(struct fortuna_state *st)
-{
-    unsigned int i, n;
-    SHA256_CTX ctx;
-    unsigned char hash_resultSHA256_HASHSIZE;
-
-    n = ++st->reseed_count;
-
-    /*
-     * Collect entropy from pools.  We use the i-th pool only 1/(2^i) of the
-     * time so that each pool collects twice as much entropy between uses as
-     * the last.
-     */
-    shad256_init(&ctx);
-    for (i = 0; i < NUM_POOLS; i++) {
-        if (n % (1 << i) != 0)
-            break;
-
-        /* Harvest this pool's hash result into ctx, then reset the pool. */
-        shad256_result(&st->pooli, hash_result);
-        shad256_init(&st->pooli);
-        shad256_update(&ctx, hash_result, SHA256_HASHSIZE);
-    }
-    shad256_result(&ctx, hash_result);
-    generator_reseed(st, hash_result, SHA256_HASHSIZE);
-    zap(hash_result, SHA256_HASHSIZE);
-    zap(&ctx, sizeof(ctx));
-
-    /* Reset the count of bytes added to pool 0. */
-    st->pool0_bytes = 0;
-}
-
-/* Add possibly unguessable data to the next accumulator pool. */
-static void
-accumulator_add_event(struct fortuna_state *st, const unsigned char *data,
-                      size_t len)
-{
-    unsigned char lenbuf2;
-    SHA256_CTX *pool;
-
-    /* Track how many bytes have been added to pool 0. */
-    if (st->pool_index == 0 && st->pool0_bytes < MIN_POOL_LEN)
-        st->pool0_bytes += len;
-
-    /* Hash events into successive accumulator pools. */
-    pool = &st->poolst->pool_index;
-    st->pool_index = (st->pool_index + 1) % NUM_POOLS;
-
-    /*
-     * Fortuna specifies that events are encoded with a source identifier byte,
-     * a length byte, and the event data itself.  We do not have source
-     * identifiers and they're not really important, so just encode the
-     * length in two bytes instead.
-     */
-    store_16_be(len, lenbuf);
-    shad256_update(pool, lenbuf, 2);
-    shad256_update(pool, data, len);
-}
-
-/* Limit dependencies for test program. */
-#ifndef TEST
-
-/* Return true if RESEED_INTERVAL microseconds have passed since the last
- * reseed. */
-static krb5_boolean
-enough_time_passed(struct fortuna_state *st)
-{
-    struct timeval tv, *last = &st->last_reseed_time;
-    krb5_boolean ok = FALSE;
-
-    gettimeofday(&tv, NULL);
-
-    /* Check how much time has passed. */
-    if (tv.tv_sec > last->tv_sec + 1)
-        ok = TRUE;
-    else if (tv.tv_sec == last->tv_sec + 1) {
-        if (1000000 + tv.tv_usec - last->tv_usec >= RESEED_INTERVAL)
-            ok = TRUE;
-    } else if (tv.tv_usec - last->tv_usec >= RESEED_INTERVAL)
-        ok = TRUE;
-
-    /* Update last_reseed_time if we're returning success. */
-    if (ok)
-        memcpy(last, &tv, sizeof(tv));
-
-    return ok;
-}
-
-static void
-accumulator_output(struct fortuna_state *st, unsigned char *dst, size_t len)
-{
-    /* Reseed the generator with data from pools if we have accumulated enough
-     * data and enough time has passed since the last accumulator reseed. */
-    if (st->pool0_bytes >= MIN_POOL_LEN && enough_time_passed(st))
-        accumulator_reseed(st);
-
-    generator_output(st, dst, len);
-}
-
-static k5_mutex_t fortuna_lock = K5_MUTEX_PARTIAL_INITIALIZER;
-static struct fortuna_state main_state;
-#ifdef _WIN32
-static DWORD last_pid;
-#else
-static pid_t last_pid;
-#endif
-static krb5_boolean have_entropy = FALSE;
-
-int
-k5_prng_init(void)
-{
-    krb5_error_code ret = 0;
-    unsigned char osbuf64;
-
-    ret = k5_mutex_finish_init(&fortuna_lock);
-    if (ret)
-        return ret;
-
-    init_state(&main_state);
-#ifdef _WIN32
-    last_pid = GetCurrentProcessId();
-#else
-    last_pid = getpid();
-#endif
-    if (k5_get_os_entropy(osbuf, sizeof(osbuf), 0)) {
-        generator_reseed(&main_state, osbuf, sizeof(osbuf));
-        have_entropy = TRUE;
-    }
-
-    return 0;
-}
-
-void
-k5_prng_cleanup(void)
-{
-    have_entropy = FALSE;
-    zap(&main_state, sizeof(main_state));
-    k5_mutex_destroy(&fortuna_lock);
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_add_entropy(krb5_context context, unsigned int randsource,
-                          const krb5_data *indata)
-{
-    krb5_error_code ret;
-
-    ret = krb5int_crypto_init();
-    if (ret)
-        return ret;
-    k5_mutex_lock(&fortuna_lock);
-    if (randsource == KRB5_C_RANDSOURCE_OSRAND ||
-        randsource == KRB5_C_RANDSOURCE_TRUSTEDPARTY) {
-        /* These sources contain enough entropy that we should use them
-         * immediately, so that they benefit the next request. */
-        generator_reseed(&main_state, (unsigned char *)indata->data,
-                         indata->length);
-        have_entropy = TRUE;
-    } else {
-        /* Other sources should just go into the pools and be used according to
-         * the accumulator logic. */
-        accumulator_add_event(&main_state, (unsigned char *)indata->data,
-                              indata->length);
-    }
-    k5_mutex_unlock(&fortuna_lock);
-    return 0;
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_make_octets(krb5_context context, krb5_data *outdata)
-{
-#ifdef _WIN32
-    DWORD pid = GetCurrentProcessId();
-#else
-    pid_t pid = getpid();
-#endif
-    unsigned char pidbuf4;
-
-    k5_mutex_lock(&fortuna_lock);
-
-    if (!have_entropy) {
-        k5_mutex_unlock(&fortuna_lock);
-        if (context != NULL) {
-            k5_set_error(&context->err, KRB5_CRYPTO_INTERNAL,
-                         _("Random number generator could not be seeded"));
-        }
-        return KRB5_CRYPTO_INTERNAL;
-    }
-
-    if (pid != last_pid) {
-        /* We forked; make sure child's PRNG stream differs from parent's. */
-        store_32_be(pid, pidbuf);
-        generator_reseed(&main_state, pidbuf, 4);
-        last_pid = pid;
-    }
-
-    accumulator_output(&main_state, (unsigned char *)outdata->data,
-                       outdata->length);
-    k5_mutex_unlock(&fortuna_lock);
-    return 0;
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_os_entropy(krb5_context context, int strong, int *success)
-{
-    krb5_error_code ret;
-    krb5_data data;
-    uint8_t buf64;
-    int status = 0;
-
-    if (!k5_get_os_entropy(buf, sizeof(buf), strong))
-        goto done;
-
-    data = make_data(buf, sizeof(buf));
-    ret = krb5_c_random_add_entropy(context, KRB5_C_RANDSOURCE_OSRAND, &data);
-    if (ret)
-        goto done;
-
-    status = 1;
-
-done:
-    if (success != NULL)
-        *success = status;
-    return 0;
-}
-
-#endif /* not TEST */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/prng_os.c Deleted

@@ -1,72 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/krb/prng_os.c - OS PRNG implementation */
-/*
- * Copyright (C) 2016 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * * Redistributions of source code must retain the above copyright
- *   notice, this list of conditions and the following disclaimer.
- *
- * * Redistributions in binary form must reproduce the above copyright
- *   notice, this list of conditions and the following disclaimer in
- *   the documentation and/or other materials provided with the
- *   distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * This file implements a PRNG module which relies on the system's PRNG.  An
- * OS packager can select this module given sufficient confidence in the
- * operating system's native PRNG quality.
- */
-
-#include "crypto_int.h"
-
-int
-k5_prng_init(void)
-{
-    return 0;
-}
-
-void
-k5_prng_cleanup(void)
-{
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_add_entropy(krb5_context context, unsigned int randsource,
-                          const krb5_data *indata)
-{
-    return 0;
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_make_octets(krb5_context context, krb5_data *outdata)
-{
-    krb5_boolean res;
-
-    res = k5_get_os_entropy((uint8_t *)outdata->data, outdata->length, 0);
-    return res ? 0 : KRB5_CRYPTO_INTERNAL;
-}
-
-krb5_error_code KRB5_CALLCONV
-krb5_c_random_os_entropy(krb5_context context, int strong, int *success)
-{
-    return 0;
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/t_fortuna.c Deleted

@@ -1,179 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/krb/t_fortuna.c - Fortuna test program */
-/*
- * Copyright (c) 2007 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-/*
- * Copyright (C) 2011 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-#include "k5-int.h"
-#ifdef FORTUNA
-
-/* Include most of prng_fortuna.c so we can test the PRNG internals. */
-#define TEST
-#include "prng_fortuna.c"
-
-static void
-display(const unsigned char *data, size_t len)
-{
-    size_t i;
-
-    for (i = 0; i < len; i++)
-        printf("%02X", datai);
-    printf("\n");
-}
-
-/*
- * Generate data from st with its current internal state and check for
- * significant bias in each bit of the resulting bytes.  This test would have a
- * small chance of failure on random inputs, but we have a predictable state
- * after all the other tests have been run, so it will never fail if the PRNG
- * operates the way we expect.
- */
-static void
-head_tail_test(struct fortuna_state *st)
-{
-    static unsigned char buffer1024 * 1024;
-    unsigned char c;
-    int i, len = sizeof(buffer);
-    int bit, bits8 = { 0, 0, 0, 0, 0, 0, 0, 0 };
-    double res;
-
-    memset(buffer, 0, len);
-
-    generator_output(st, buffer, len);
-    for (i = 0; i < len; i++) {
-        c = bufferi;
-        for (bit = 0; bit < 8 && c; bit++) {
-            if (c & 1)
-                bitsbit++;
-            c = c >> 1;
-        }
-    }
-
-    for (bit = 0; bit < 8; bit++) {
-        res = ((double)abs(len - bitsbit * 2)) / (double)len;
-        if (res > 0.005){
-            fprintf(stderr,
-                    "Bit %d: %d zero, %d one exceeds 0.5%% variance (%f)\n",
-                    bit, (int)len - bitsbit, bitsbit, res);
-            exit(1);
-        }
-    }
-}
-
-int
-main(int argc, char **argv)
-{
-    struct fortuna_state test_state;
-    struct fortuna_state *st = &test_state;
-    static unsigned char buf2 * 1024 * 1024;
-    unsigned int i;
-
-    /* Seed the generator with a known state. */
-    init_state(&test_state);
-    generator_reseed(st, (unsigned char *)"test", 4);
-
-    /* Generate two pieces of output; key should change for each request. */
-    generator_output(st, buf, 32);
-    display(buf, 32);
-    generator_output(st, buf, 32);
-    display(buf, 32);
-
-    /* Generate a lot of output to test key changes during request. */
-    generator_output(st, buf, sizeof(buf));
-    display(buf, 32);
-    display(buf + sizeof(buf) - 32, 32);
-
-    /* Reseed the generator and generate more output. */
-    generator_reseed(st, (unsigned char *)"retest", 6);
-    generator_output(st, buf, 32);
-    display(buf, 32);
-
-    /* Add sample data to accumulator pools. */
-    for (i = 0; i < 44; i++) {
-        store_32_be(i, buf);
-        accumulator_add_event(st, buf, 4);
-    }
-    assert(st->pool_index == 12);
-    assert(st->pool0_bytes == 8);
-
-    /* Exercise accumulator reseeds. */
-    accumulator_reseed(st);
-    generator_output(st, buf, 32);
-    display(buf, 32);
-    accumulator_reseed(st);
-    generator_output(st, buf, 32);
-    display(buf, 32);
-    accumulator_reseed(st);
-    generator_output(st, buf, 32);
-    display(buf, 32);
-    for (i = 0; i < 1000; i++)
-        accumulator_reseed(st);
-    assert(st->reseed_count == 1003);
-    generator_output(st, buf, 32);
-    display(buf, 32);
-
-    head_tail_test(st);
-    return 0;
-}
-
-#else /* FORTUNA */
-
-int
-main()
-{
-    return 0;
-}
-
-#endif /* FORTUNA */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/t_fortuna.expected Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/aes Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/aes/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/aes/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/camellia Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/camellia/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/camellia/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/crypto_mod.h Deleted

@@ -1,54 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/openssl/crypto_mod.h - OpenSSL crypto module declarations */
-/*
- * Copyright (C) 2011 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * This header is included from lib/crypto/krb/crypto_int.h to provide
- * module-specific declarations.  It is not included directly from source
- * files.
- */
-
-#ifndef CRYPTO_MOD_H
-#define CRYPTO_MOD_H
-
-#include <openssl/crypto.h>
-#include <openssl/aes.h>
-#include <openssl/sha.h>
-
-/* 1.1 standardizes constructor and destructor names, renaming
- * EVP_MD_CTX_create and EVP_MD_CTX_destroy. */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define EVP_MD_CTX_new EVP_MD_CTX_create
-#define EVP_MD_CTX_free EVP_MD_CTX_destroy
-#endif
-
-#define aes_encrypt_ctx AES_KEY
-#define k5_aes_encrypt_key256(k, ctx) AES_set_encrypt_key(k, 256, ctx)
-#define k5_aes_encrypt(in, out, ctx) AES_encrypt(in, out, ctx)
-#define k5_sha256_init SHA256_Init
-#define k5_sha256_update SHA256_Update
-#define k5_sha256_final SHA256_Final
-
-#endif /* CRYPTO_MOD_H */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/init.c Deleted

@@ -1,38 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/openssl/init.c - Module init and cleanup functions */
-/*
- * Copyright (C) 2010 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-#include "crypto_int.h"
-
-int
-krb5int_crypto_impl_init(void)
-{
-    return 0;
-}
-
-void
-krb5int_crypto_impl_cleanup(void)
-{
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/md4 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/md4/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/md4/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/md5 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/md5/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/md5/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/sha1 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/sha1/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/sha1/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/sha2 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/sha2/Makefile.in Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/sha2/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/stubs.c Deleted

@@ -1,69 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/openssl/stubs.c - OpenSSL stub functions */
-/*
- * Copyright (C) 2011 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * This file defines symbols which must be exported by libk5crypto because they
- * are in the export list (for the sake of test programs), but which are not
- * used when OpenSSL is the back end.
- */
-
-#include "k5-int.h"
-
-/*
- * These functions are used by the Fortuna PRNG and test program.  They are
- * defined to OpenSSL equivalents when the OpenSSL back end headers are
- * used.
- */
-void k5_aes_encrypt(void);
-void k5_aes_encrypt_key256(void);
-void k5_sha256_final(void);
-void k5_sha256_init(void);
-void k5_sha256_update(void);
-
-void k5_aes_encrypt(void)
-{
-    abort();
-}
-
-void k5_aes_encrypt_key256(void)
-{
-    abort();
-}
-
-void k5_sha256_final(void)
-{
-    abort();
-}
-
-void k5_sha256_init(void)
-{
-    abort();
-}
-
-void k5_sha256_update(void)
-{
-    abort();
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/Makefile.in Deleted

@@ -1,143 +0,0 @@
-mydir=lib$(S)kadm5$(S)unit-test
-BUILDTOP=$(REL)..$(S)..$(S)..
-KDB_DEP_LIB=$(DL_LIB) $(THREAD_LINKOPTS)
-
-SRCS= init-test.c destroy-test.c handle-test.c iter-test.c setkey-test.c \
-	randkey-test.c lock-test.c
-
-#
-# The client-side test programs.
-#
-
-init-test: init-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o init-test init-test.o \
-		$(KADMCLNT_LIBS) $(KRB5_BASE_LIBS)
-
-destroy-test: destroy-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o destroy-test destroy-test.o \
-		$(KADMCLNT_LIBS) $(KRB5_BASE_LIBS)
-
-client-handle-test: client-handle-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o client-handle-test client-handle-test.o \
-		$(KADMCLNT_LIBS) $(KRB5_BASE_LIBS)
-
-client-handle-test.o: handle-test.c
-	$(CC) $(ALL_CFLAGS) -DCLIENT_TEST -o client-handle-test.o -c $(srcdir)/handle-test.c
-
-client-iter-test: iter-test.o $(KADMLCNT_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o client-iter-test iter-test.o \
-		$(KADMCLNT_LIBS) $(KRB5_BASE_LIBS)
-
-client-setkey-test: setkey-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o client-setkey-test setkey-test.o \
-		$(KADMCLNT_LIBS) $(KRB5_BASE_LIBS)
-
-#
-# The server-side test programs.
-#
-
-randkey-test: randkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o randkey-test randkey-test.o \
-		$(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS)
-
-server-handle-test: handle-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o server-handle-test handle-test.o \
-		$(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS)
-
-lock-test: lock-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o lock-test lock-test.o \
-		$(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS)
-
-server-iter-test: iter-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o server-iter-test iter-test.o \
-		$(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS)
-
-server-setkey-test: setkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o server-setkey-test setkey-test.o \
-		$(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS)
-
-runenv.exp: Makefile
-	$(RUN_SETUP); for i in $(RUN_VARS); do \
-		eval echo "set env$$$i$ \$$$$i"; done > runenv.exp
-
-#
-# The unit-test targets
-#
-
-check: check-@DO_TEST@
-
-check-:
-	@echo "+++"
-	@echo "+++ WARNING: lib/kadm5 unit tests not run."
-	@echo "+++ Either tcl, runtest, or Perl is unavailable."
-	@echo "+++"
-
-check-ok unit-test: unit-test-client unit-test-server
-
-unit-test-client: unit-test-client-setup unit-test-client-body \
-	unit-test-client-cleanup
-
-unit-test-server: unit-test-server-setup unit-test-server-body \
-	unit-test-server-cleanup
-
-test-randkey: randkey-test
-	$(ENV_SETUP) $(VALGRIND) ./randkey-test
-
-test-handle-server: server-handle-test
-	$(ENV_SETUP) $(VALGRIND) ./server-handle-test
-
-test-handle-client: client-handle-test
-	$(ENV_SETUP) $(VALGRIND) ./client-handle-test
-
-test-noauth: init-test
-	$(ENV_SETUP) $(VALGRIND) ./init-test
-
-test-destroy: destroy-test
-	$(ENV_SETUP) $(VALGRIND) ./destroy-test
-
-test-setkey-client: client-setkey-test
-	$(ENV_SETUP) $(VALGRIND) ./client-setkey-test testkeys admin admin
-
-unit-test-client-setup: runenv.sh
-	$(ENV_SETUP) $(VALGRIND) $(START_SERVERS)
-
-unit-test-client-cleanup:
-	$(ENV_SETUP) $(STOP_SERVERS)
-
-unit-test-server-setup: runenv.sh
-	$(ENV_SETUP) $(VALGRIND) $(START_SERVERS_LOCAL)
-
-unit-test-server-cleanup:
-	$(ENV_SETUP) $(STOP_SERVERS_LOCAL)
-
-unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \
-	test-setkey-client runenv.exp
-	$(ENV_SETUP) $(RUNTEST) --tool api RPC=1 API=$(CLNTTCL) \
-		KINIT=$(BUILDTOP)/clients/kinit/kinit \
-		KDESTROY=$(BUILDTOP)/clients/kdestroy/kdestroy \
-		KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \
-		PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \
-		$(RUNTESTFLAGS)
-	-mv api.log capi.log
-	-mv api.sum capi.sum
-
-unit-test-server-body: site.exp test-handle-server lock-test 
-	$(ENV_SETUP) $(RUNTEST) --tool api RPC=0 API=$(SRVTCL) \
-		LOCKTEST=./lock-test \
-		KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \
-		PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \
-		$(RUNTESTFLAGS)
-	-mv api.log sapi.log
-	-mv api.sum sapi.sum
-
-clean:
-	$(RM) init-test client_init.o init-test.o
-	$(RM) destroy-test destroy-test.o
-	$(RM) client-handle-test handle-test.o client-handle-test.o
-	$(RM) client-iter-test iter-test.o
-	$(RM) randkey-test randkey-test.o
-	$(RM) server-handle-test handle-test.o
-	$(RM) lock-test lock-test.o
-	$(RM) server-iter-test iter-test.o
-	$(RM) server-setkey-test client-setkey-test setkey-test.o
-	$(RM) *.log *.plog *.sum *.psum unit-test-log.* runenv.exp

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.2 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.2/crte-policy.exp Deleted

@@ -1,927 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-# Description: (1) Fails for mask with undefined bit set.
-# 01/24/94: pshuang: untried.
-test "create-policy 1"
-proc test1 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-           delete_policy "$test/a")} {
-            error_and_restart "$test: couldn't delete policy \"$test/a\""
-            return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		0xF01000
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test1
-
-# Description: (2) Fails if caller connected with CHANGEPW_SERVICE.
-test "create-policy 2"
-proc test2 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy";
-	return
-    }
-}
-if {$RPC} { test2 }
-
-# Description: (3) Fails for mask without POLICY bit set.
-# 01/24/94: pshuang: untried.
-test "create-policy 3"
-proc test3 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-           delete_policy "$test/a")} {
-            error_and_restart "$test: couldn't delete policy \"$test/a\""
-            return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		0x000000
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test3
-
-# Description: (5) Fails for invalid policy name.
-# 01/24/94: pshuang: untried.
-test "create-policy 5"
-proc test5 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/&#x7;" \
-		{KADM5_POLICY}
-    } $test "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test5
-
-# Description: (6) Fails for existing policy name.
-test "create-policy 6"
-proc test6 {} {
-    global test
-#    set prms_id 777
-#    setup_xfail {*-*-*} $prms_id
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle simple_policy test-pol \
-		{KADM5_POLICY}
-    } "DUP"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test6
-
-# Description: (7) Fails for null policy name.
-# 01/24/94: pshuang: untried.
-test "create-policy 7"
-proc test7 {} {
-    global test
-#    set prms_id 1977
-#    setup_xfail {*-*-*} $prms_id
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle simple_policy null \
-		{KADM5_POLICY}
-    } "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test7
-
-# Description: (8) Fails for empty-string policy name.
-test "create-policy 8"
-proc test8 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle simple_policy "" \
-		{KADM5_POLICY}
-    } "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test8
-
-# Description: (9) Accepts 0 for pw_min_life.
-test "create-policy 9"
-proc test9 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail "$test: create failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test9
-
-# Description: (10) Accepts non-zero for pw_min_life.
-test "create-policy 10"
-proc test10 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \
-		{KADM5_POLICY KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail "$test"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test10
-
-# Description: (11) Accepts 0 for pw_max_life.
-test "create-policy 11"
-proc test11 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail "$test"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test11
-
-# Description: (12) Accepts non-zero for pw_max_life.
-test "create-policy 12"
-proc test12 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \
-		{KADM5_POLICY KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail "$test"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-# Description: (13) Rejects 0 for pw_min_length.
-test "create-policy 13"
-proc test13 {} {
-    global test
-    global prompt
-
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MIN_LENGTH}
-    } $test "BAD_LENGTH"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test13
-
-# Description: (14) Accepts non-zero for pw_min_length.
-test "create-policy 14"
-proc test14 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \
-		{KADM5_POLICY KADM5_PW_MIN_LENGTH}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 3\n"
-    expect {
-	-re "8\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test14
-
-# Description: (15) Rejects 0 for pw_min_classes.
-test "create-policy 15"
-proc test15 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test15
-
-# Description: (16) Accepts 1 for pw_min_classes.
-test "create-policy 16"
-proc test16 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test16
-
-# Description: (17) Accepts 4 for pw_min_classes.
-test "create-policy 17"
-proc test17 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "5\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test17
-
-# Description: (18) Rejects 5 for pw_min_classes.
-test "create-policy 18"
-proc test18 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test18
-
-# Description: (19) Rejects 0 for pw_history_num.
-test "create-policy 19"
-proc test19 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_HISTORY_NUM}
-    } $test "BAD_HISTORY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test19
-
-# Description: (20) Accepts 1 for pw_history_num.
-test "create-policy 20"
-proc test20 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd  format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \
-		{KADM5_POLICY KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test20
-
-# Description: (21) Accepts 10 for pw_history_num.
-test "create-policy 21"
-proc test21 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \
-		{KADM5_POLICY KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "10\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test21
-    
-# Description: (22) Fails for user with no access bits.
-test "create-policy 22"
-proc test22 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test22
-
-# Description: (23) Fails for user with "get" but not "add".
-test "create-policy 23"
-proc test23 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test23
-
-# Description: (24) Fails for user with "modify" but not "add".
-# 01/24/94: pshuang: untried.
-test "create-policy 24"
-proc test24 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test24
-
-# Description: (25) Fails for user with "delete" but not "add".
-# 01/24/94: pshuang: untried.
-test "create-policy 25"
-proc test25 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test25
-
-# Description: Succeeds for user with "add".
-test "create-policy 26"
-proc test26 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test26
-
-# Description: Succeeds for user with "get" and "add".
-# 01/24/94: pshuang: untried.
-test "create-policy 27"
-proc test27 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test27
-
-# Description: (28) Rejects null policy argument.
-# 01/24/94: pshuang: untried.
-test "create-policy 28"
-proc test28 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle null {KADM5_POLICY}
-    } "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test28
-
-test "create-policy 30"
-proc test30 {} {
-    global test
-    one_line_fail_test format {
-	kadm5_create_policy null simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "BAD_SERVER_HANDLE"
-}
-test30
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.2/get-policy.exp Deleted

@@ -1,199 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "get-policy 3"
-proc test3 {} {
-    global test
-#    set prms_id 744
-#    setup_xfail {*-*-*} $prms_id
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-	server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test3
-
-test "get-policy 6"
-proc test6 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-	    server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \
-	    "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } test6
-
-test "get-policy 7"
-proc test7 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-	    server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \
-	    "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } test7
-
-test "get-policy 11"
-proc test11 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_policy $server_handle test-pol p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test11
-
-test "get-policy 12"
-proc test12 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get-pol StupidAdmin \
-		$KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \
-		$KADM5_API_VERSION_2 server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_policy $server_handle test-pol-nopw p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-test "get-policy 15"
-proc test15 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_policy $server_handle test-pol-nopw p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test15
-
-test "get-policy 16"
-proc test16 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_policy $server_handle test-pol-nopw p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test16
-
-test "get-policy 17"
-proc test17 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-	    server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_policy $server_handle test-pol p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test17
-
-test "get-policy 18"
-proc test18 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \
-	    "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } test18
-
-test "get-policy 21"
-proc test21 {} {
-    global test
-
-    one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE"
-}
-test21

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.2/mod-policy.exp Deleted

@@ -1,675 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "modify-policy 2"
-proc test2 {} {
-    global test
-
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "AUTH_MODIFY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test2 }
-
-test "modify-policy 8"
-proc test8 {} {
-    global test
-#    set prms_id 744
-#    setup_xfail {*-*-*} $prms_id
-
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_modify_policy $server_handle simple_policy "" \
-		{KADM5_PW_MAX_LIFE}
-    } "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test8
-
-test "modify-policy 9"
-proc test9 {} {
-    global test
-    global prompt
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test9
-
-test "modify-policy 10"
-proc test10 {} {
-    global test
-    global prompt
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0} \
-		{KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test10
-
-
-test "modify-policy 11"
-proc test11 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test11
-
-test "modify-policy 12"
-proc test12 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0} \
-		{KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-test "modify-policy 13"
-proc test13 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MIN_LENGTH}
-    } $test "BAD_LENGTH"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test13
-
-test "modify-policy 14"
-proc test14 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0} \
-		{KADM5_PW_MIN_LENGTH}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 3\n"
-    expect {
-	-re "8\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test14
-
-test "modify-policy 15"
-proc test15 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test15
-
-test "modify-policy 16"
-proc test16 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0} \
-		{KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test16
-
-test "modify-policy 17"
-proc test17 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0} \
-		{KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "5\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test17
-
-test "modify-policy 18"
-proc test18 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0} \
-		{KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test18
-
-test "modify-policy 19"
-proc test19 {} {
-    global test
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_HISTORY_NUM}
-    } $test "BAD_HISTORY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test19
-
-test "modify-policy 20"
-proc test20 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0} \
-		{KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test20
-
-test "modify-policy 21"
-proc test21 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0} \
-		{KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "10\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test21
-
-test "modify-policy 22"
-proc test22 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "AUTH_MODIFY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test22
-
-test "modify-policy 23"
-proc test23 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "AUTH_MODIFY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test23
-
-test "modify-policy 26"
-proc test26 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test26
-
-test "modify-policy 30"
-proc test30 {} {
-    global test
-
-    one_line_fail_test format {
-	kadm5_modify_policy null simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "BAD_SERVER_HANDLE"
-}
-test30
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp Deleted

@@ -1,68 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "chpass-principal 200"
-proc test200 {} {
-    global test prompt
-
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal "$test/a"} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-
-    # I'd like to specify a long list of keysalt tuples and make sure
-    # that chpass does the right thing, but we can only use those
-    # enctypes that krbtgt has a key for: the AES enctypes, according to
-    # the prototype kdc.conf.
-    if {! cmd format {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_chpass_principal $server_handle "%s/a" newpassword
-    } $test} {
-	perror "$test: unexpected failure in chpass_principal"
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle  "%s/a" p \
-		{KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA}
-    } $test} {
-	perror "$test: unexpected failure in get_principal"
-    }
-    send "lindex \$p 16\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" { set num_keys $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting num_keys"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting num_keys"
-	    return
-	}
-    }
-
-    # XXX Perhaps I should actually check the key type returned.
-    if {$num_keys == 5} {
-	pass "$test"
-    } else {
-	fail "$test: $num_keys keys, should be 5"
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test200
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/chpass-principal.exp Deleted

@@ -1,176 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "chpass-principal 180"
-proc test180 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal_pol "$test/a" once-a-min} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_chpass_principal $server_handle "%s/a" FoobarBax
-    } $test
-
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test180 }
-
-test "chpass-principal 180.5"
-proc test1805 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal_pol "$test/a" once-a-min} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_chpass_principal $server_handle "%s/a" FoobarBax
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test1805 }
-
-#
-# admin with changepw service tickets try to change other principals
-# password, fails with AUTH error
-test "chpass-principal 180.625"
-proc test180625 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_chpass_principal $server_handle "%s/a" password
-    } $test "AUTH"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test180625 }
-
-test "chpass-principal 180.75"
-proc test18075 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal_pol "$test/a" once-a-min} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_chpass_principal $server_handle "%s/a" Foobar
-    } $test "AUTH_CHANGEPW"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test18075 }
-
-test "chpass-principal 182"
-proc test182 {} {
-    global test
-
-    if { ! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_chpass_principal $server_handle kadmin/history password
-    } "PROTECT"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test182
-
-test "chpass-principal 183"
-proc test183 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if { ! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_chpass_principal null "%s/a" password
-    } $test "BAD_SERVER_HANDLE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test183
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/crte-policy.exp Deleted

@@ -1,927 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-# Description: (1) Fails for mask with undefined bit set.
-# 01/24/94: pshuang: untried.
-test "create-policy 1"
-proc test1 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-           delete_policy "$test/a")} {
-            error_and_restart "$test: couldn't delete policy \"$test/a\""
-            return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		0xF01000
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test1
-
-# Description: (2) Fails if caller connected with CHANGEPW_SERVICE.
-test "create-policy 2"
-proc test2 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy";
-	return
-    }
-}
-if {$RPC} { test2 }
-
-# Description: (3) Fails for mask without POLICY bit set.
-# 01/24/94: pshuang: untried.
-test "create-policy 3"
-proc test3 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-           delete_policy "$test/a")} {
-            error_and_restart "$test: couldn't delete policy \"$test/a\""
-            return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		0x000000
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test3
-
-# Description: (5) Fails for invalid policy name.
-# 01/24/94: pshuang: untried.
-test "create-policy 5"
-proc test5 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/&#x7;" \
-		{KADM5_POLICY}
-    } $test "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test5
-
-# Description: (6) Fails for existing policy name.
-test "create-policy 6"
-proc test6 {} {
-    global test
-#    set prms_id 777
-#    setup_xfail {*-*-*} $prms_id
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle simple_policy test-pol \
-		{KADM5_POLICY}
-    } "DUP"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test6
-
-# Description: (7) Fails for null policy name.
-# 01/24/94: pshuang: untried.
-test "create-policy 7"
-proc test7 {} {
-    global test
-#    set prms_id 1977
-#    setup_xfail {*-*-*} $prms_id
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle simple_policy null \
-		{KADM5_POLICY}
-    } "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test7
-
-# Description: (8) Fails for empty-string policy name.
-test "create-policy 8"
-proc test8 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle simple_policy "" \
-		{KADM5_POLICY}
-    } "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test8
-
-# Description: (9) Accepts 0 for pw_min_life.
-test "create-policy 9"
-proc test9 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail "$test: create failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test9
-
-# Description: (10) Accepts non-zero for pw_min_life.
-test "create-policy 10"
-proc test10 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \
-		{KADM5_POLICY KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail "$test"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test10
-
-# Description: (11) Accepts 0 for pw_max_life.
-test "create-policy 11"
-proc test11 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail "$test"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test11
-
-# Description: (12) Accepts non-zero for pw_max_life.
-test "create-policy 12"
-proc test12 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \
-		{KADM5_POLICY KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail "$test"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-# Description: (13) Rejects 0 for pw_min_length.
-test "create-policy 13"
-proc test13 {} {
-    global test
-    global prompt
-
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MIN_LENGTH}
-    } $test "BAD_LENGTH"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test13
-
-# Description: (14) Accepts non-zero for pw_min_length.
-test "create-policy 14"
-proc test14 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \
-		{KADM5_POLICY KADM5_PW_MIN_LENGTH}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 3\n"
-    expect {
-	-re "8\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test14
-
-# Description: (15) Rejects 0 for pw_min_classes.
-test "create-policy 15"
-proc test15 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test15
-
-# Description: (16) Accepts 1 for pw_min_classes.
-test "create-policy 16"
-proc test16 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test16
-
-# Description: (17) Accepts 4 for pw_min_classes.
-test "create-policy 17"
-proc test17 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "5\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test17
-
-# Description: (18) Rejects 5 for pw_min_classes.
-test "create-policy 18"
-proc test18 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \
-		{KADM5_POLICY KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test18
-
-# Description: (19) Rejects 0 for pw_history_num.
-test "create-policy 19"
-proc test19 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY KADM5_PW_HISTORY_NUM}
-    } $test "BAD_HISTORY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test19
-
-# Description: (20) Accepts 1 for pw_history_num.
-test "create-policy 20"
-proc test20 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd  format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \
-		{KADM5_POLICY KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retreuve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test20
-
-# Description: (21) Accepts 10 for pw_history_num.
-test "create-policy 21"
-proc test21 {} {
-    global test
-    global prompt
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \
-		{KADM5_POLICY KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "10\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test21
-    
-# Description: (22) Fails for user with no access bits.
-test "create-policy 22"
-proc test22 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test22
-
-# Description: (23) Fails for user with "get" but not "add".
-test "create-policy 23"
-proc test23 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test23
-
-# Description: (24) Fails for user with "modify" but not "add".
-# 01/24/94: pshuang: untried.
-test "create-policy 24"
-proc test24 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test24
-
-# Description: (25) Fails for user with "delete" but not "add".
-# 01/24/94: pshuang: untried.
-test "create-policy 25"
-proc test25 {} {
-    global test
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test25
-
-# Description: Succeeds for user with "add".
-test "create-policy 26"
-proc test26 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test26
-
-# Description: Succeeds for user with "get" and "add".
-# 01/24/94: pshuang: untried.
-test "create-policy 27"
-proc test27 {} {
-    global test
-
-    if {! (( ! policy_exists "$test/a") ||
-	   delete_policy "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_create_policy $server_handle simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test27
-
-# Description: (28) Rejects null policy argument.
-# 01/24/94: pshuang: untried.
-test "create-policy 28"
-proc test28 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_policy $server_handle null {KADM5_POLICY}
-    } "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-        perror "$test: unexpected failure in destroy"
-        return
-    }
-}
-test28
-
-test "create-policy 30"
-proc test30 {} {
-    global test
-    one_line_fail_test format {
-	kadm5_create_policy null simple_policy "%s/a" \
-		{KADM5_POLICY}
-    } $test "BAD_SERVER_HANDLE"
-}
-test30
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/crte-principal.exp Deleted

@@ -1,1336 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-#test "create-principal 1"
-#
-#proc test1 {} {
-#	global test
-#	begin_dump
-#	one_line_fail_test format {
-#	    kadm5_create_principal $server_handle \
-#		    simple_principal "%s/a" {KADM5_PRINCIPAL} "%s/a"
-#	} $test $test "NOT_INIT"
-#	end_dump_compare "no-diffs"
-#}
-#test1
-
-# v2 create-principal 3 test, to avoid name conflict
-test "create-principal 1"
-proc test1 {} {
-    global test
-#    set prms_id 777
-#    setup_xfail {*-*-*} $prms_id
-    begin_dump
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} null
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"    
-}
-test1
-
-test "create-principal 2"
-
-proc test2 {} {
-    global test
-    begin_dump
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_create_principal $server_handle null \
-		{KADM5_PRINCIPAL} testpass
-    } "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"
-}
-test2
-
-test "create-principal 4"
-proc test4 {} {
-    global test
-
-    begin_dump    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} ""
-    } $test "_Q_TOOSHORT"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"     
-}
-test4
-
-test "create-principal 5"
-proc test5 {} {
-    global test
-    begin_dump    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle \
-		simple_principal "%s/a" {0x100001} "%s/a"
-    } $test $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"    
-}
-test5
-
-test "create-principal 6"
-proc test6 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_LAST_PWD_CHANGE} "%s/a"
-    } $test $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test6
-
-test "create-principal 7"
-proc test7 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MOD_TIME} "%s/a"
-    } $test $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test7
-
-test "create-principal 8"
-proc test8 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MOD_NAME} "%s/a"
-    } $test $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test8
-
-test "create-principal 9"
-proc test9 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MKVNO} "%s/a"
-    } $test $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test9
-
-test "create-principal 10"
-proc test10 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_AUX_ATTRIBUTES} "%s/a"
-    } $test $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test10
-
-test "create-principal 11"
-proc test11 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_POLICY_CLR} "%s/a"
-    } $test $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test11
-
-test "create-principal 12"
-proc test12 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-
-}
-if {$RPC} { test12 }
-
-test "create-principal 13"
-proc test13 {} {
-    global test
-    begin_dump        
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"    
-}
-if {$RPC} { test13 }
-
-test "create-principal 14"
-proc test14 {} {
-    global test
-    begin_dump        
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"    
-}
-if {$RPC} { test14 }
-
-test "create-principal 15"
-proc test15 {} {
-    global test
-    begin_dump    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"    
-}
-if {$RPC} { test15 }
-
-test "create-principal 16"
-proc test16 {} {
-    global test
-    begin_dump        
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test "AUTH_ADD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-if {$RPC} { test16 }
-
-test "create-principal 17"
-proc test17 {} {
-    global test
-
-    begin_dump    
-    if {! (( principal_exists "$test/a") || create_principal "$test/a")} {
-		error_and_restart "$test: couldn't create principal \"$test/a\""
-		return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test "DUP"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test17
-
-test "create-principal 18"
-proc test18 {} {
-    global test
-
-    begin_dump    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle \
-		princ_w_pol "%s/a" test-pol \
-		{KADM5_PRINCIPAL KADM5_POLICY} tP
-    } $test "_Q_TOOSHORT"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"    
-}
-test18
-
-test "create-principal 19"
-proc test19 {} {
-    global test
-
-    begin_dump    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle \
-		princ_w_pol "%s/a" test-pol \
-		{KADM5_PRINCIPAL KADM5_POLICY} testpassword
-    } $test "_Q_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test19
-
-test "create-principal 20"
-proc test20 {} {
-    global test
-
-    begin_dump    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_create_principal $server_handle \
-		princ_w_pol "%s/a" test-pol \
-		{KADM5_PRINCIPAL KADM5_POLICY} Abyssinia
-    } $test "_Q_DICT"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test20
-
-test "create-principal 21"
-proc test21 {} {
-    global test
-
-    begin_dump    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_create_principal $server_handle \
-		princ_w_pol "%s/a" non-existant-pol \
-		{KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    end_dump_compare "no-diffs"        
-}
-test21
-
-test "create-principal 23"
-proc test23 {} {
-    global test
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    one_line_succeed_test \
-	    format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test23
-
-test "create-principal 24"
-proc test24 {} {
-    global test
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/rename admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    one_line_succeed_test \
-	    format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test24 }
-
-
-test "create-principal 28"
-proc test28 {} {
-    global test
-    global prompt
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    
-    if {! cmd format {
-	kadm5_create_principal $server_handle \
-		princ_w_pol "%s/a" test-pol \
-		{KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return
-    }
-    send "lindex \$principal 10\n"
-    expect {
-	-re "test-pol.*$prompt$"   { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test28
-
-test "create-principal 29"
-proc test29 {} {
-    global test
-    global prompt
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL KADM5_PRINC_EXPIRE_TIME} \
-		inTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 1\n"
-    expect {
-	-re "0.*$prompt$"   { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test29
-
-test "create-principal 30"
-proc test30 {} {
-    global test
-    global prompt
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \
-		NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test30
-
-test "create-principal 31"
-proc test31 {} {
-    global test
-    global prompt
-    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle \
-		princ_w_pol "%s/a" test-pol-nopw \
-		{KADM5_PRINCIPAL KADM5_POLICY \
-		KADM5_PW_EXPIRATION} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test31
-
-test "create-principal 32"
-proc test32 {} {
-    global test
-    global prompt
-    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle \
-		princ_w_pol "%s/a" test-pol \
-		{KADM5_PRINCIPAL KADM5_POLICY \
-		KADM5_PW_EXPIRATION} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol policy}} {
-	error_and_restart "$test: cannot retrieve policy"
-	return
-    }
-
-    send "lindex \$principal 6\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set mod_date $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting mod_date"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting mod_date"
-	    return
-	}
-    }
-
-    send "lindex \$principal 3\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_expire $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_expire"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_expire"
-	    return
-	}
-    }
-
-    send "lindex \$policy 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_max_life"
-	    return
-	}
-    }
-    if { $pw_expire != 0 } {
-	fail "$test: pw_expire $pw_expire should be 0"
-	return
-    } else {
-	pass "$test"
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test32
-
-test "create-principal 33"
-proc test33 {} {
-    global test
-    global prompt
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle \
-		{"%s/a" 0 0 1234 0 null 0 0 0 0 null 0} \
-		{KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \
-		NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "1234.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test33
-
-test "create-principal 34"
-proc test34 {} {
-    global test
-    global prompt
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle \
-		{ "%s/a" 0 0 1234 0 null 0 0 0 0 test-pol-nopw 0} \
-		{KADM5_PRINCIPAL KADM5_POLICY \
-		KADM5_PW_EXPIRATION} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "1234.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test34
-
-test "create-principal 35"
-proc test35 {} {
-    global test
-    global prompt
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle \
-		{"%s/a" 0 0 1234 0 null 0 0 0 0 test-pol 0} \
-		{KADM5_PRINCIPAL KADM5_POLICY \
-		KADM5_PW_EXPIRATION} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "1234.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test35
-
-test "create-principal 36"
-proc test36 {} {
-    global test
-    global prompt
-    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle \
-		{"%s/a" 0 0 999999999 0 null 0 0 0 0 test-pol 0} \
-		{KADM5_PRINCIPAL KADM5_POLICY \
-		KADM5_PW_EXPIRATION} NotinTheDictionary
-    } $test} {    
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol policy} } {
-	error_and_restart "$test: cannot retrieve policy"
-	return
-    }
-
-    send "lindex \$principal 6\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set mod_date $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting mod_date"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting mod_date"
-	    return
-	}
-    }
-
-    send "lindex \$principal 3\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_expire $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_expire"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_expire"
-	    return
-	}
-    }
-
-    send "lindex \$policy 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_max_life"
-	    return
-	}
-    }
-    if { $pw_expire != 999999999 } {
-	fail "$test: pw_expire is wrong"
-	return
-    } else {
-	pass "$test"
-    }
-
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test36
-
-test "create-principal 37"
-proc test37 {} {
-    global test
-    global prompt
-
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test37
-
-test "create-principal 38"
-proc test38 {} {
-    global test
-    global prompt
-    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle princ_w_pol "%s/a" \
-		test-pol-nopw {KADM5_PRINCIPAL KADM5_POLICY} \
-		NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test38
-
-test "create-principal 39"
-proc test39 {} {
-    global test
-    global prompt
-    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle princ_w_pol "%s/a" \
-		test-pol {KADM5_PRINCIPAL KADM5_POLICY} \
-		NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if { ! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: cannot not retrieve principal"
-	return
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol policy}} {
-	error_and_restart "$test: cannot retrieve policy"
-	return
-    }
-    send "lindex \$principal 6\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set mod_date $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting mod_date"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting mod_date"
-	    return
-	}
-    }
-
-    send "lindex \$principal 3\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_expire $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_expire"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_expire"
-	    return
-	}
-    }
-
-    send "lindex \$policy 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_max_life"
-	    return
-	}
-    }
-    if { expr "$mod_date + $pw_max_life - $pw_expire" > 5 } {
-	fail "$test: pw_expire is wrong"
-	return
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test39
-
-test "create-principal 40"
-proc test40 {} {
-    global test
-    global prompt
-    
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \
-		NotinTheDictionary
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	fail "$test: can not retrieve principal"
-	return;
-    }
-    send "lindex \$principal 4\n"
-    expect {
-	-re "0.*$prompt$"	    { pass "$test" }
-	timeout			    { fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test40
-
-test "create-principal 43"
-proc test43 {} {
-    global test
-    one_line_fail_test format {
-	kadm5_create_principal null \
-		    simple_principal "%s/a" {KADM5_PRINCIPAL} "%s/a"
-    } $test $test "BAD_SERVER_HANDLE"
-}
-test43
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/destroy.exp Deleted

@@ -1,203 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "destroy 1"
-
-proc test1 {} {
-	global test
-	begin_dump
-	if {! cmd {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-	}} {
-		perror "$test: unexpected failure in init"
-		return
-	}
-	one_line_succeed_test {kadm5_destroy $server_handle}
-	end_dump_compare "no-diffs"
-}
-test1
-
-#test "destroy 2"
-#
-#proc test2 {} {
-#	global test
-#	begin_dump
-#	if {! cmd {
-#	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-#		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		    server_handle
-#	}} {
-#	    perror "$test: unexpected failure on init"
-#	    return
-#	}
-#	if {! cmd {kadm5_destroy $server_handle}} {
-#		error_and_restart "$test: couldn't close database"
-#		return
-#	}
-#	one_line_fail_test \
-#		{kadm5_get_principal $server_handle admin principal} \
-#		"NOT_INIT"
-#	end_dump_compare "no-diffs"
-#}
-#test2
-
-#test "destroy 3"
-#proc test3 {} {
-#	global test
-#
-#	begin_dump
-#	if {! (( ! principal_exists "$test/a") || delete_principal "$test/a")} {
-#	    error_and_restart "$test couldn't delete principal \"$test/a\""
-#	    return
-#	}
-#	if {! cmd {
-#	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-#		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		    server_handle
-#	}} {
-#	    perror "$test: unexpected failure on init"
-#	    return
-#	}
-#	if {! cmd {kadm5_destroy $server_handle}} {
-#		error_and_restart "$test: couldn't close database"
-#		return
-#	}
-#	one_line_fail_test format {
-#	    kadm5_create_principal $server_handle \
-#		    simple_principal "%s/a" {KADM5_PRINCIPAL} "%s/a"
-#	} $test $test "NOT_INIT"
-#	end_dump_compare "no-diffs"
-#}
-#test3
-
-#test "destroy 4"
-#proc test4 {} {
-#	global test prompt
-#
-#	if {! ((principal_exists "$test/a") || create_principal "$test/a")} {
-#		error_and_restart "$test: couldn't create principal \"$test/a\""
-#		return
-#	}
-#	begin_dump
-#	if {! (cmd {
-#	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-#		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		    server_handle
-#	} &&
-#	    cmd format {
-#		kadm5_get_principal $server_handle "%s/a" principal
-#	    } $test)} {
-#		error_and_restart "$test: error getting principal"
-#		return;
-#	}
-#	if {! cmd {kadm5_destroy $server_handle}} {
-#		error_and_restart "$test: couldn't close database"
-#		return
-#	}
-#	one_line_fail_test format {
-#	    kadm5_modify_principal $server_handle \
-#		    {"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO}
-#	} $test "77" "NOT_INIT"
-#	end_dump_compare "no-diffs"
-#}
-#test4
-
-#test "destroy 5"
-#
-#proc test5 {} {
-#	global test
-#
-#	if {! (principal_exists "$test/a" || create_principal "$test/a")} {
-#		error_and_restart "$test: couldn't create principal \"$test/a\""
-#		return
-#	}
-#	begin_dump
-#	if {! cmd {
-#	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-#		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		    server_handle
-#	}} {
-#	    perror "$test: unexpected failure on init"
-#	    return
-#	}
-#	if {! cmd {kadm5_destroy $server_handle}} {
-#		error_and_restart "$test: couldn't close database"
-#		return
-#	}
-#	one_line_fail_test format {
-#	    kadm5_delete_principal $server_handle "%s/a"
-#	} $test "NOT_INIT"
-#	end_dump_compare "no-diffs"
-#}
-#test5
-
-#test	"destroy 6"
-#
-#proc test6 {} {
-#	global test
-#	begin_dump	
-#	one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT"
-#	end_dump_compare "no-diffs"	
-#}
-#test6
-
-
-#test	"destroy 7"
-#
-#proc test7 {} {
-#	global test
-#	begin_dump	
-#	if {! cmd {
-#	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-#		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		    server_handle
-#	}} {
-#		perror "$test: unexpected failure in init"
-#		return
-#	}
-#	if {! cmd {kadm5_destroy $server_handle}} {
-#		error_and_restart "$test: couldn't close database"
-#	}
-#	one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT"
-#	end_dump_compare "no-diffs"	
-#}
-#test7
-
-test	"destroy 8"
-proc test8 {} {
-	global test
-	begin_dump	
-	if {! cmd {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}} {
-		perror "$test: unexpected failure in init"
-		return
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-	one_line_succeed_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-	end_dump_compare "no-diffs"		
-}
-test8
-
-test "destroy 9"
-proc test9 {} {
-	global test
-	one_line_fail_test {kadm5_destroy null} "BAD_SERVER_HANDLE"
-}
-test9
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/dlte-policy.exp Deleted

@@ -1,208 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "delete-policy 2"
-proc test2 {} {
-    global test
-#    set prms_id 744
-#    setup_xfail {*-*-*} $prms_id
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test \
-	    {kadm5_delete_policy $server_handle ""} "BAD_POL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test2
-
-test "delete-policy 5"
-proc test5 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_policy $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if ${RPC} test5
-
-test "delete-policy 6"
-proc test6 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_policy $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if ${RPC} test6
-
-test "delete-policy 7"
-proc test7 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_policy $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test7
-
-test "delete-policy 10"
-proc test10 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_delete_policy $server_handle  "%s/a"
-    } $test} {
-	fail "$test"
-	return
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    if { policy_exists "$test/a"} {
-	fail "$test"
-	return
-    }
-}
-test10
-
-test "delete-policy 12"
-proc test12 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-    if {! ((! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle princ_w_pol "%s/a" \
-		"%s/a" {KADM5_PRINCIPAL KADM5_POLICY} \
-		NotinTheDictionary
-    } $test $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_delete_policy $server_handle "%s/a"
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-test "delete-policy 13"
-proc test13 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-    one_line_fail_test format {
-	kadm5_delete_policy null "%s/a"
-    } $test "BAD_SERVER_HANDLE"
-}
-test13
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/dlte-principal.exp Deleted

@@ -1,253 +0,0 @@
-load_lib lib.t
-
-api_exit
-api_start
-
-#test "delete-principal 1"
-#proc test1 {} {
-#	global test
-#	one_line_fail_test format {
-#	    kadm5_delete_principal $server_handle "%s/a"
-#	} $test "NOT_INIT"
-#}
-#test1
-
-test "delete-principal 2"
-proc test2 {} {
-    global test
-   
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	error_and_restart "$test: couldn't delete principal \"$test/a\""
-	return
-    }
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test \
-	    {kadm5_delete_principal $server_handle null} "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	error_and_restart "$test: unexpected failure in destroy"
-	return
-    }
-}
-test2
-
-test "delete-principal 5"
-proc test5 {} {
-    global test
-   
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	error_and_restart "$test: couldn't delete principal \"$test/a\""
-	return
-    }
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_principal $server_handle "%s/a"
-    } $test "UNK_PRINC"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test5
-
-test "delete-principal 6"
-proc test6 {} {
-    global test
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal_pol "$test/a" test-pol)} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_principal $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test6 }
-    
-	
-test "delete-principal 7"
-proc test7 {} {
-    global test
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_principal $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test7 }
-    
-	
-test "delete-principal 8"
-proc test8 {} {
-    global test
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_principal $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test8 }
-
-test "delete-principal 9"
-proc test9 {} {
-    global test
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_principal $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test9 }
-
-test "delete-principal 10"
-proc test10 {} {
-    global test
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_delete_principal $server_handle "%s/a"
-    } $test "AUTH_DELETE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test10 }
-
-test "delete-principal 11"
-proc test11 {} {
-    global test
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_delete_principal $server_handle "%s/a"
-    } $test} {
-	fail "$test: delete failed"
-	return;
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    if { principal_exists "$test/a" } {
-	fail "$test"
-	return
-    }
-}
-test11
-
-test "delete-principal 13"
-proc test13 {} {
-	global test
-	one_line_fail_test format {
-	    kadm5_delete_principal null "%s/a"
-	} $test "BAD_SERVER_HANDLE"
-}
-test13
-    
-return ""
-
-
-
-
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/get-policy.exp Deleted

@@ -1,199 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "get-policy 3"
-proc test3 {} {
-    global test
-#    set prms_id 744
-#    setup_xfail {*-*-*} $prms_id
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test3
-
-test "get-policy 6"
-proc test6 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	    server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \
-	    "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } test6
-
-test "get-policy 7"
-proc test7 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	    server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \
-	    "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } test7
-
-test "get-policy 11"
-proc test11 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_policy $server_handle test-pol p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test11
-
-test "get-policy 12"
-proc test12 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get-pol StupidAdmin \
-		$KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \
-		$KADM5_API_VERSION_3 server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_policy $server_handle test-pol-nopw p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-test "get-policy 15"
-proc test15 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_policy $server_handle test-pol-nopw p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test15
-
-test "get-policy 16"
-proc test16 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_policy $server_handle test-pol-nopw p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test16
-
-test "get-policy 17"
-proc test17 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	    server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_policy $server_handle test-pol p}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test17
-
-test "get-policy 18"
-proc test18 {} {
-    global test
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \
-	    "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } test18
-
-test "get-policy 21"
-proc test21 {} {
-    global test
-
-    one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE"
-}
-test21

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp Deleted

@@ -1,250 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "get-principal 100"
-proc test100 {} {
-    global test prompt
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd {
-	kadm5_get_principal $server_handle testuser p \
-		{KADM5_PRINCIPAL_NORMAL_MASK}
-    }} {
-	perror "$test: unexpected failure in get_principal"
-    }
-    send "lindex \$p 16\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" { set num_keys $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting num_keys"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting num_keys"
-	    return
-	}
-    }
-    send "lindex \$p 17\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" { set num_tl $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting num_tl"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting num_tl"
-	    return
-	}
-    }
-    send "lindex \$p 18\n"
-    expect {
-	-re "({.*})\n$prompt" {set key_data $expect_out(1,string) }
-	-re "\n$prompt" { set key_data {} }
-	timeout {
-	    error_and_restart "$test: timeout getting key_data"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting key_data"
-	    return
-	}
-    }
-    send "lindex \$p 19\n"
-    expect {
-	-re "({.*})\n$prompt" {set tl_data $expect_out(1,string) }
-	-re "\n$prompt" { set tl_data {} }
-	timeout {
-	    error_and_restart "$test: timeout getting tl_data"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting tl_data"
-	    return
-	}
-    }
-    
-    set failed 0
-    if {$num_keys != 0} {
-	fail "$test: num_keys $num_keys should be 0"
-	set failed 1
-    }
-    if {$num_tl != 0} {
-	fail "$test: num_tl $num_tl should be 0"
-	set failed 1
-    }
-    if {$key_data != {}} {
-	fail "$test: key_data $key_data should be {}"
-	set failed 1
-    }
-    if {$tl_data != "{}"} {
-	fail "$test: tl_data $tl_data should be empty"
-	set failed 1
-    }
-    if {$failed == 0} {
-	pass "$test"
-    }
-
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test100
-
-proc test101_102 {rpc} {
-    global test prompt
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd {
-	kadm5_get_principal $server_handle testuser p \
-		{KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA}
-    }} {
-	perror "$test: unexpected failure in get_principal"
-    }
-    send "lindex \$p 16\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" { set num_keys $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting num_keys"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting num_keys"
-	    return
-	}
-    }
-    send "lindex \$p 18\n"
-    expect {
-	-re "({.*})\n$prompt" {set key_data $expect_out(1,string) }
-	-re "\n$prompt" { set key_data {} }
-	timeout {
-	    error_and_restart "$test: timeout getting key_data"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting key_data"
-	    return
-	}
-    }
-
-    set failed 0
-    if {$num_keys != 5} {
-	fail "$test: num_keys $num_keys should be 5"
-	set failed 1
-    }
-    for {set i 0} {$i < $num_keys} {incr i} {
-	set key "lindex lindex $key_data $i 2"
-	if {($rpc && string compare $key "" != 0) ||
-	    ((! $rpc) && string compare $key "" == 0)} {
-	    fail "$test: key_data $key is wrong"
-	    set failed 1
-	    
-	}
-    }
-    if {$failed == 0} { pass "$test" }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test "get-principal 101" 
-if {$RPC} {test101_102 $RPC}
-test "get-principal 102" 
-if {! $RPC} {test101_102 $RPC}
-
-test "get-principal 103"
-proc test103 {} {
-    global test prompt
-
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		"{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{999 6 foobar}}" \
-		{KADM5_TL_DATA}
-    } $test $test} {
-	fail "$test: cannot set TL_DATA"
-	return
-    }
-
-    if {! cmd format {
-	kadm5_get_principal $server_handle {%s/a} p \
-		{KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA}
-    } $test} {
-	perror "$test: unexpected failure in get_principal"
-    }
-    send "lindex \$p 17\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" { set num_tl $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting num_tl"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting num_tl"
-	    return
-	}
-    }
-    send "lindex \$p 19\n"
-    expect {
-	-re "({.*})\n$prompt" {set tl_data $expect_out(1,string) }
-	-re "\n$prompt" { set tl_data {} }
-	timeout {
-	    error_and_restart "$test: timeout getting tl_data"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting tl_data"
-	    return
-	}
-    }
-    
-    if {$num_tl == 0} {
-	fail "$test: num_tl $num_tl should not be 0"
-    } elseif {$tl_data == "{{999 6 foobar}}"} {
-	pass "$test"
-    } else {
-	fail "$test: tl_data $tl_data should be {{999 6 foobar}}"
-    }
-
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test103
-
-return ""
-
-
-
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/get-principal.exp Deleted

@@ -1,346 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "get-principal 1"
-proc test1 {} {
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test \
-	    {kadm5_get_principal $server_handle null p KADM5_PRINCIPAL_NORMAL_MASK} "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test1
-
-test "get-principal 2"
-proc test2 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK
-    } $test "UNK_PRINC"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test2
-
-test "get-principal 3"
-proc test3 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK
-    } $test "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test3 }
-    
-test "get-principal 4"
-proc test4 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK
-    } $test "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test4 }
-
-test "get-principal 5"
-proc test5 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK
-    } $test "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test5 }
-
-test "get-principal 6"
-proc test6 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK
-    } $test "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test6 }
-
-test "get-principal 7"
-proc test7 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK
-    } $test "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test7 }
-
-    
-test "get-principal 8"
-proc test8 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK
-    } $test "AUTH_GET"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test8 }
-
-    
-test "get-principal 9"
-proc test9 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK} 
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test9
-
-test "get-principal 10"
-proc test10 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test \
-	    {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test10
-
-test "get-principal 11"
-proc test11 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test11
-
-test "get-principal 12"
-proc test12 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-test "get-principal 13"
-proc test13 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK} 
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test13
-
-test "get-principal 14"
-proc test14 {} {
-    global test
-    if {! cmd {
-	kadm5_init admin/get-mod admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK}
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test14
-
-test "get-principal 15"
-proc test15 {} {
-    one_line_fail_test \
-	    {kadm5_get_principal null "admin" p KADM5_PRINCIPAL_NORMAL_MASK} "BAD_SERVER_HANDLE"
-}
-test15
-
-return ""
-
-
-
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/init-v2.exp Deleted

@@ -1,506 +0,0 @@
-load_lib lib.t
-
-api_exit
-api_start
-
-proc get_hostname { } {
-    global hostname
-
-    if {info exists hostname} {
-	return 1
-    }
-
-    catch "exec hostname >myname" exec_output
-    if !string match "" $exec_output {
-	send_log "$exec_output\n"
-	verbose $exec_output
-	send_error "ERROR: can't get hostname\n"
-	return 0
-    }
-    set file open myname r
-    if {  gets $file hostname  == -1 } {
-	send_error "ERROR: no output from hostname\n"
-	return 0
-    }
-    close $file
-    catch "exec rm -f myname" exec_output
-
-    set hostname string tolower $hostname
-    verbose "hostname: $hostname"
-
-    return 1
-}
-
-
-test "init 101"
-proc test101 {} {
-    global test
-    global hostname
-
-    get_hostname
-    tcl_cmd "set hostname $hostname"
-
-    # XXX Fix to work with a remote TEST_SERVER.  For now, make sure
-    # it fails in that case.
-    one_line_succeed_test {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} list $hostname 1751 \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }
-    one_line_fail_test {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} list $hostname 4 \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "RPC_ERROR"
-}
-if {$RPC} test101
-
-test "init 102"
-proc test102 {} {
-    global test
-
-    one_line_fail_test {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_ADMIN_SERVER} does.not.exist \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "CANT_RESOLVE"
-}
-if {$RPC} test102
-
-test "init 103"
-proc test103 {} {
-    global test
-
-    one_line_fail_test {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_DBNAME} /does-not-exist \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "ENOENT"
-}
-#if {! $RPC} test103
-if {! $RPC} {
-    send_user "UNTESTED: test103: test needs updating for DAL changes (see MIT RT ticket 3202)\n"
-    untested "test103: test needs updating for DAL changes (see MIT RT ticket 3202)"
-}
-
-
-test "init 106"
-proc test106 {} {
-    global test prompt
-
-    set prompting 0
-    send string trim {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_MKEY_FROM_KBD} 1 \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }
-    send "\n"
-    expect {
-	-re "\n\^\n\+:\^\n\*$" { set prompting 1}
-	-re "\nOK .*$prompt$" { fail "$test: premature success" }
-	-re "\nERROR .*$prompt$" { fail "$test: premature failure" }
-	timeout { fail "$test: timeout" }
-	eof { fail "$test: eof" }
-    }
-    if {$prompting} {
-	one_line_succeed_test mrroot
-    }
-    if {! cmd {kadm5_destroy $server_handle}} {
-	error_and_restart "$test: couldn't close database"
-    }
-}
-if {! $RPC} test106
-
-test "init 107"
-proc test107 {} {
-    global test
-
-    one_line_fail_test {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_STASH_FILE} /does-not-exist \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "KDB_CANTREAD_STORED"
-}
-if {! $RPC} test107
-
-test "init 108"
-proc test108 {} {
-    global test
-
-    one_line_fail_test {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_MKEY_NAME} does/not/exist \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "KRB5_KDB_CANTREAD_STORED"
-}
-if {! $RPC} test108
-
-test "init 109-113"
-proc test109 {} {
-    global test prompt
-
-    delete_principal "$test/a"
-
-    # I'd like to specify flags explicitly and check them, as in the
-    # following config_params, but tcl gets mighty confused if I do and 
-    # I have no idea why.
-#		config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_FLAGS KADM5_CONFIG_ENCTYPES} {10 20 30 KRB5_KDB_DISALLOW_TGT_BASED {}} 
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-		config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_ENCTYPES} {10 20 30 {}}  \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	fail "$test: cannot init with max_life"
-	return
-    }
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test} {
-	fail "$test: can not create principal"
-	return;
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" p \
-		{KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA}
-    } $test} {
-	fail "$test: can not get principal"
-	return;
-    }
-    send "puts \$p\n"
-    expect {
-	-re "$prompt" { }
-	timeout {
-	    error_and_restart "$test: timeout getting prompt"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting prompt"
-	    return
-	}
-    }
-    send "lindex \$p 4\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting max_life"
-	    return
-	}
-    }
-    send "lindex \$p 12\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set max_rlife $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting max_rlife"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting max_rlife"
-	    return
-	}
-    }
-    send "lindex \$p 1\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set expiration $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting expiration"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting expiration"
-	    return
-	}
-    }
-    send "lindex \$p 7\n"
-    expect {
-	-re "(\A-Z_\*)\n$prompt" {set flags $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting flags"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting flags"
-	    return
-	}
-    }
-    # This sorta worries me.  Since the test is setting ENCTYPES to
-    # nothing, the principal has no keys.  That means that nothing is
-    # printed for the keys in the correct case; but it feels too
-    # likely that nothing will be printed in the case of some problem.
-    send "lindex \$p 18\n"
-    expect {
-	-re "({.*})\n$prompt" {set key_data $expect_out(1,string) }
-	-re "\n$prompt" { set key_data {} }
-	timeout {
-	    error_and_restart "$test: timeout getting flags"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting flags"
-	    return
-	}
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-    if {$max_life == 10} {
-	pass "$test"
-    } else {
-	fail "$test: $max_life is not 10"
-    }
-    if {$max_rlife == 20} {
-	pass "$test"
-    } else {
-	fail "$test: $max_rlife is not 20"
-    }
-    if {$expiration == 30} {
-	pass "$test"
-    } else {
-	fail "$test: $expiration is not 30"
-    }
-    if {$flags == ""} {
-	pass "$test"
-    } else {
-	fail "$test: flags $flags are wrong"
-    }
-    if {$key_data == {}} {
-	pass "$test"
-    } else {
-	fail "$test: key_data $key_data is wrong"
-    }
-}
-if {! $RPC} test109
-
-test "init 116"
-proc test116 {} {
-    global test
-
-    delete_principal "$test/a"
-
-    if {! cmd {kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE \
-	    null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	    get_add_handle}} {
-	error_and_restart "$test: couldn't init with admin/get-add"
-    }
-
-    if {! cmd {kadm5_init admin/mod-delete admin $KADM5_ADMIN_SERVICE \
-	    null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	    mod_delete_handle}} {
-	error_and_restart "$test: couldn't init with admin/get-add"
-    }
-
-    one_line_succeed_test {
-	kadm5_get_principal $get_add_handle testuser p \
-		KADM5_PRINCIPAL_NORMAL_MASK
-    }
-    one_line_succeed_test format {
-	kadm5_create_principal $get_add_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test
-    one_line_fail_test { 
-	kadm5_modify_principal $get_add_handle simple_principal testuser \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } "AUTH_MODIFY"
-    one_line_fail_test {
-	kadm5_delete_principal $get_add_handle testuser
-    } "AUTH_DELETE"
-
-    one_line_fail_test {
-	kadm5_get_principal $mod_delete_handle testuser p \
-		KADM5_PRINCIPAL_NORMAL_MASK
-    } "AUTH_GET"
-    one_line_fail_test format {
-	kadm5_create_principal $mod_delete_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} testpass
-    } $test "AUTH_ADD"
-    one_line_succeed_test { 
-	kadm5_modify_principal $mod_delete_handle simple_principal testuser \
-		{KADM5_PRINC_EXPIRE_TIME}
-    }
-    one_line_succeed_test format {
-	kadm5_delete_principal $mod_delete_handle "%s/a"
-    } $test
-
-    if {! cmd {kadm5_destroy $get_add_handle}} {
-	error_and_restart "$test: couldn't close get_add_handle"
-    }
-    if {! cmd {kadm5_destroy $mod_delete_handle}} {
-	error_and_restart "$test: couldn't close mod_delete_handle"
-    }
-}
-if {$RPC} test116
-
-test "init 117"
-proc test117 {} {
-    global test env prompt
-
-    if {catch "exec grep max_life $env(KRB5_KDC_PROFILE)" != 1} {
-	warning \
-	   "$test: max_life in $env(KRB5_KDC_PROFILE), cannot perform test"
-	return
-    }
-
-    if {! (( ! principal_exists "$test/a") ||
-        delete_principal "$test/a")} {
-        error_and_restart "$test: couldn't delete principal \"$test/a\""
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	fail "$test: unexpected failure in init"
-	return
-    }
-
-    if {! cmd format {
-	kadm5_create_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL} "%s/a"
-    } $test $test} {
-	perror "$test: unexpected failure creating principal"
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_MAX_LIFE
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 4\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting max_life"
-	    return
-	}
-    }
-    
-    if {$max_life == 86400} {
-	pass "$test"
-    } else {
-	fail "$test: max_life $max_life should be 86400"
-    }
-
-    if {! cmd {kadm5_destroy $server_handle}} {
-	error_and_restart "$test: couldn't close server_handle"
-    }
-}
-test117
-    
-send "puts \$KADM5_ADMIN_SERVICE\n"
-expect {
-    -re "(\a-zA-Z/@\+)\n$prompt" {
-	set KADM5_ADMIN_SERVICE $expect_out(1,string) 
-    }
-    default {
-	error_and_restart "$test: timeout/eof getting admin_service"
-	return
-    }
-}
-
-send "puts \$KADM5_CHANGEPW_SERVICE\n"
-expect {
-    -re "(\a-zA-Z/@\+)\n$prompt" {
-	set KADM5_CHANGEPW_SERVICE $expect_out(1,string) 
-    }
-    default {
-	error_and_restart "$test: timeout/eof getting changepw_service"
-	return
-    }
-}
-
-test "init 150"
-proc test150 {} {
-    global test KADM5_ADMIN_SERVICE
-
-    kdestroy
-    kinit testuser notathena "-S $KADM5_ADMIN_SERVICE"
-    one_line_succeed_test {
-	kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }
-    kdestroy
-}
-if {$RPC} test150
-
-test "init 151"
-proc test151 {} {
-    global test KADM5_CHANGEPW_SERVICE
-
-    kdestroy
-    kinit testuser notathena "-S $KADM5_CHANGEPW_SERVICE"
-    one_line_succeed_test {
-	kadm5_init_with_creds testuser null $KADM5_CHANGEPW_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }
-    kdestroy
-}
-if {$RPC} test151
-
-test "init 152"
-proc test152 {} {
-    global test KADM5_ADMIN_SERVICE
-
-    kdestroy
-    one_line_fail_test {
-	kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "KRB5_FCC_NOFILE"
-}
-if {$RPC} test152
-
-test "init 153"
-proc test153 {} {
-    global test KADM5_ADMIN_SERVICE
-
-    kinit testuser notathena
-    one_line_fail_test {
-	kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \
-		null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "KRB5_CC_NOTFOUND"
-}
-if {$RPC} test153
-
-test "init 154"
-proc test154 {} {
-    global test env
-
-    set orig $env(KRB5_KDC_PROFILE)
-    set env(KRB5_KDC_PROFILE) /does-not-exist
-    api_exit; api_start
-    set env(KRB5_KDC_PROFILE) $orig
-
-    one_line_fail_test {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } "ENOENT"
-
-    api_exit; lib_start_api
-}
-if {0 && ! $RPC} test154
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/init.exp Deleted

@@ -1,699 +0,0 @@
-load_lib lib.t
-
-# Assumptions:
-# 
-# Principal "admin" exists, with "get", "add", "modify" and "delete"
-#   access bits and password "admin".
-# The string "not-the-password" isn't the password of any user in the database.
-# Database master password is "mrroot".
-
-api_exit
-api_start
-test "init 1"
-
-one_line_fail_test_nochk \
-	{kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-	config_params {KADM5_CONFIG_REALM} {""} \
-	 $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle}
-
-test "init 2"
-
-one_line_fail_test_nochk \
-	{kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-	config_params {KADM5_CONFIG_REALM} {@} \
-	 $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle}
-
-test "init 2.5"
-
-one_line_fail_test_nochk \
-	{kadm5_init admin admin $KADM5_ADMIN_SERVICE \
-	config_params {KADM5_CONFIG_REALM} {BAD.REALM} \
-	 $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle}
-
-test "init 3"
-
-proc test3 {} {
-    global test
-    if {! (principal_exists "$test/a" || create_principal "$test/a")} {
-	error_and_restart "$test: couldn't create principal \"$test/a\""
-	return
-    }
-    one_line_fail_test_nochk format {
-	kadm5_init admin admin "%s/a" null $KADM5_STRUCT_VERSION \
-		$KADM5_API_VERSION_3 server_handle
-    } $test
-}
-if {$RPC} { test3 }
-
-test "init 4"
-
-proc test4 {} {
-    global test
-	if {! ((! principal_exists "$test/a") || 
-         delete_principal "$test/a")} {
-		error_and_restart "$test: couldn't delete principal \"$test/a\""
-		return
-	}
-		
-	one_line_fail_test_nochk format {
-	    kadm5_init admin admin "%s/a" null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	} $test
-}
-if {$RPC} { test4 }
-
-test "init 5"
-
-if {$RPC} {
-    one_line_fail_test_nochk {
-	kadm5_init admin admin admin null $KADM5_STRUCT_VERSION \
-		$KADM5_API_VERSION_3 server_handle
-    }
-}
-
-test "init 6"
-
-proc test6 {} {
-    global test
-
-    send "kadm5_init admin null \$KADM5_ADMIN_SERVICE null \$KADM5_STRUCT_VERSION \$KADM5_API_VERSION_3 server_handle\n"
-
-    expect {
-	-re "assword\^\r\n\*:" { }
-	eof {
-		fail "$test: eof instead of password prompt"
-		api_exit
-		api_start
-		return
-	}
-	timeout {
-	    fail "$test: timeout instead of password prompt"
-	    return
-	}
-    }
-    one_line_succeed_test "admin"
-    if {! cmd {kadm5_destroy $server_handle}} {
-	error_and_restart "$test: couldn't close database"
-    }
-}
-if { $RPC } { test6 } 
-
-test "init 8"
-
-proc test8 {} {
-    global test
-	if {! (principal_exists "$test/a" || create_principal "$test/a")} {
-		error_and_restart "$test: couldn't create principal \"$test/a\""
-		return
-	}
- 	one_line_fail_test_nochk format {
-	    kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	} $test
-}
-if {$RPC} { test8 }
-
-test "init 9"
-
-if {$RPC} {
-    global test
-  one_line_fail_test_nochk {
-      kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE null \
-	      $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	      server_handle
-  }
-}
-
-test "init 10"
-
-proc test10 {} {
-	global test
-#	set prms_id 562
-#	setup_xfail {*-*-*} $prms_id
-	one_line_fail_test_nochk {
-	    kadm5_init null admin $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-}
-test10
-
-#test "init 11"
-#
-#proc test11 {} {
-#	global test
-#	set prms_id 563
-#	setup_xfail {*-*-*} $prms_id
-#	one_line_fail_test_nochk {
-#	    kadm5_init "" admin $KADM5_ADMIN_SERVICE null \
-#		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		    server_handle
-#	}
-#}
-#test11
-
-test "init 12"
-
-proc test12 {} {
-	global test
-    one_line_fail_test_nochk format {
-	kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } $test
-}
-if {$RPC} { test12 }
-
-test "init 13"
-
-proc test13 {} {
-	global test
-    one_line_fail_test_nochk format {
-	kadm5_init "%s/a@SECURE-TEST.OV.COM" admin \
-		$KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \
-		$KADM5_API_VERSION_3 server_handle
-    } $test
-}
-if {$RPC} { test13 }
-
-test "init 14"
-
-proc test14 {} {
-	global test
-    one_line_fail_test_nochk format {
-	kadm5_init "%s/a@BAD.REALM" admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } $test
-}
-if {$RPC} { test14 }
-
-test "init 15"
-
-if {$RPC} {
-    one_line_fail_test_nochk {
-	kadm5_init admin@BAD.REALM admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }
-}
-
-test "init 16"
-
-proc test16 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-test16
-
-test "init 17"
-
-proc test17 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin@SECURE-TEST.OV.COM admin \
-		    $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \
-		    $KADM5_API_VERSION_3 server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-test17
-
-test "init 18"
-
-proc test18 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-test18
-
-test "init 19"
-
-proc test19 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin@SECURE-TEST.OV.COM admin \
-		    $KADM5_ADMIN_SERVICE \
-		    config_params {KADM5_CONFIG_REALM} {SECURE-TEST.OV.COM} \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-test19
-
-test "init 20"
-
-proc test20 {} {
-	global test
-  if {! cmd {
-      kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	      $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	      server_handle
-  }} {
-		error_and_restart "$test: couldn't init database"
-		return
-	}
-	one_line_succeed_test \
-		{kadm5_get_principal $server_handle admin principal KADM5_PRINCIPAL_NORMAL_MASK}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-test20
-
-#test "init 21"
-#
-#proc test21 {} {
-#    global test
-#    if {! cmd {
-#	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-#		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		server_handle
-#    }} {
-#	error_and_restart "$test: couldn't init database"
-#	return
-#    }
-#    one_line_fail_test_nochk {
-#	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-#		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		server_handle
-#    }
-#    if {! cmd {kadm5_destroy $server_handle}} {
-#	error_and_restart "$test: couldn't close database"
-#    }
-#}
-#test21
-
-
-# proc test22 {} {
-# 	global test prompt
-# 	set prompting 0
-# 	send string trim {
-# 	    kadm5_init admin null null null $KADM5_STRUCT_VERSION \
-# 		    $KADM5_API_VERSION_3 server_handle
-# 	}
-# 	send "\n"
-# 	expect {
-# 	    -re ":$" { set prompting 1}
-# 	    -re "\nOK .*$prompt$" { fail "$test: premature success" }
-# 	    -re "\nERROR .*$prompt$" { fail "$test: premature failure" }
-# 		timeout { fail "$test: timeout" }
-# 		eof { fail "$test: eof" }
-# 	}
-# 	if {$prompting} {
-# 	    one_line_succeed_test mrroot
-# 	}
-# 	if {! cmd {kadm5_destroy $server_handle}} {
-# 	    error_and_restart "$test: couldn't close database"
-# 	}
-# }
-# if {! $RPC} { test22 }
-# 
-# test "init 22.5"
-# proc test225 {} {
-# 	global test prompt
-# 	set prompting 0
-# 	send string trim {
-# 	    kadm5_init admin null null null $KADM5_STRUCT_VERSION \
-# 		    $KADM5_API_VERSION_3 server_handle
-# 	}
-# 	send "\n"
-# 	expect {
-# 	    -re ":$" { set prompting 1}
-# 	    -re "\nOK .*$prompt$" { fail "$test: premature success" }
-# 	    -re "\nERROR .*$prompt$" { fail "$test: premature failure" }
-# 		timeout { fail "$test: timeout" }
-# 		eof { fail "$test: eof" }
-# 	}
-# 	if {$prompting} {
-# 	    one_line_succeed_test mrroot
-# 	}
-# 	if {! cmd {kadm5_destroy $server_handle}} {
-# 	    error_and_restart "$test: couldn't close database"
-# 	}
-# }
-# if {! $RPC} { test225 }
-
-test "init 23"
-
-proc test23 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE \
-		    null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-if {! $RPC} { test23 }
-
-test "init 24"
-
-proc test24 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin admin null null $KADM5_STRUCT_VERSION \
-		    $KADM5_API_VERSION_3 server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-if {! $RPC} { test24 }
-
-test "init 25"
-
-proc test25 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin admin foobar null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-if {! $RPC} { test25 }
-
-test "init 26"
-
-#proc test26 {} {
-#	global test
-#
-#	api_exit
-#	api_start
-#	one_line_fail_test_nochk {
-#	    kadm5_get_principal $server_handle admin principal
-#	}
-#}
-#test26
-
-#test "init 27"
-#
-#proc test27 {} {
-#	global test
-#
-#	if {! ((! principal_exists "$test/a") || delete_principal "$test/a")} {
-#		error_and_restart "$test: couldn't delete principal \"$test/a\""
-#		return
-#	}
-#	begin_dump
-#	if {cmd format {
-#	    kadm5_create_principal $server_handle simple_principal \
-#		    "%s/a" {KADM5_PRINCIPAL} "%s/a"
-#	} $test $test} {
-#		fail "$test: unexpected success in add"
-#		return
-#	}
-#	end_dump_compare "no-diffs"
-#}
-#test27
-
-#test "init 28"
-#
-#proc test28 {} {
-#    global test prompt
-#
-#    if {! (principal_exists "$test/a" || create_principal "$test/a")} {
-#	error_and_restart "$test: couldn't create principal \"$test/a\""
-#	return
-#    }
-#    begin_dump
-#    if {! (cmd {
-#	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-#		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-#		server_handle
-#    } && cmd format {
-#	kadm5_get_principal $server_handle "%s/a" principal
-#    } $test)} {
-#	error_and_restart "$test: error getting principal"
-#	return;
-#    }
-#    send "lindex \$principal 8\n"
-#    expect {
-#	-re "\n(\0-9\+).*$prompt$" {set kvno $expect_out(1,string) }
-#	timeout {
-#	    error_and_restart "$test: timeout getting principal kvno"
-#	    return
-#	}
-#	eof {
-#	    error_and_restart "$test: eof getting principal kvno"
-#	    return
-#	}
-#    }
-#    api_exit
-#    api_start
-#    set new_kvno expr "$kvno + 1"
-#    if {cmd format {
-#	kadm5_modify_principal $server_handle \
-#		{"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO}
-#    } $test $new_kvno} {
-#	fail "$test: unexpected success in modify"
-#	return;
-#    }
-#    end_dump_compare "no-diffs"
-#}
-#test28
-
-#test "init 29"
-#
-#proc test29 {} {
-#    global test
-#
-#    if {! (principal_exists "$test/a" || create_principal "$test/a")} {
-#	error_and_restart "$test: couldn't create principal \"$test/a\""
-#	return
-#    }
-#    begin_dump
-#    if {cmd format {
-#	kadm5_delete_principal $server_handle "%s/a"
-#    } $test} {
-#	fail "$test: unexpected success in delete"
-#	return
-#    }
-#    end_dump_compare "no-diffs"
-#}
-#test29
-
-test "init 30"
-proc test30 {} {
-	global test
-	if {cmd {
-	    kadm5_init admin foobar $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}} {
-		error_and_restart "$test: unexpected success"
-		return
-	}
-	one_line_succeed_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-if ${RPC} { test30 }
-
-test "init 31"
-proc test31 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $bad_struct_version_mask $KADM5_API_VERSION_3 \
-		    server_handle
-	} "BAD_STRUCT_VERSION" 
-}
-test31
-
-test "init 32"
-proc test32 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $no_struct_version_mask $KADM5_API_VERSION_3 \
-		    server_handle
-	} "BAD_STRUCT_VERSION" 
-}
-test32
-
-test "init 33"
-proc test33 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $old_struct_version $KADM5_API_VERSION_3 \
-		    server_handle
-	} "OLD_STRUCT_VERSION" 
-}
-test33
-
-test "init 34"
-proc test34 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $new_struct_version $KADM5_API_VERSION_3 \
-		    server_handle
-	} "NEW_STRUCT_VERSION" 
-}
-test34
-
-test "init 35"
-proc test35 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_STRUCT_VERSION $bad_api_version_mask \
-		    server_handle
-	} "BAD_API_VERSION" 
-}
-test35
-
-test "init 36"
-proc test36 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_STRUCT_VERSION $no_api_version_mask \
-		    server_handle
-	} "BAD_API_VERSION" 
-}
-test36
-
-test "init 37"
-proc test37 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_STRUCT_VERSION $old_api_version \
-		    server_handle
-	} "OLD_LIB_API_VERSION" 
-}
-if { $RPC } test37
-
-test "init 38"
-proc test38 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_STRUCT_VERSION $old_api_version \
-		    server_handle
-	} "OLD_SERVER_API_VERSION" 
-}
-if { ! $RPC } test38
-
-test "init 39"
-proc test39 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_STRUCT_VERSION $new_api_version \
-		    server_handle
-	} "NEW_LIB_API_VERSION" 
-}
-if { $RPC } test39
-
-test "init 40"
-proc test40 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_STRUCT_VERSION $new_api_version \
-		    server_handle
-	} "NEW_SERVER_API_VERSION" 
-}
-if { ! $RPC } test40
-
-test "init 41"
-proc test41 {} {
-	global test
-	one_line_fail_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_API_VERSION_3 $KADM5_STRUCT_VERSION \
-		    server_handle
-	} "BAD_"
-}
-test41
-
-test "init 42"
-proc test42 {} {
-	global test
-	one_line_succeed_test {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-	    	    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    server_handle
-	}
-	if {! cmd {kadm5_destroy $server_handle}} {
-		error_and_restart "$test: couldn't close database"
-	}
-}
-test42
-
-
-proc test45_46 {service} {
-    global test kadmin_local env
-
-    spawn $kadmin_local -q "delprinc -force $service"
-    expect {
-	-re "Principal .* deleted." {}
-	default {
-	    perror "kadmin.local delprinc failed\n";
-	}
-    }
-    expect eof
-    wait
-
-    one_line_fail_test concat {kadm5_init admin admin } \
-	    $service \
-	    { null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-	    server_handle} "SECURE_PRINC_MISSING"
-
-    # this leaves the keytab with an incorrect entry
-    spawn $kadmin_local -q "ank -randkey $service"
-    expect eof
-    wait
-
-    # restart the api so it gets a new ccache
-    api_exit
-    api_start
-}
-
-if {$RPC} {
-    test "init 45"
-
-    test45_46 kadmin/admin
-
-    test "init 46"
-
-    test45_46 kadmin/changepw
-}
-
-return ""
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/mod-policy.exp Deleted

@@ -1,711 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "modify-policy 2"
-proc test2 {} {
-    global test
-
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "AUTH_MODIFY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test2 }
-
-test "modify-policy 8"
-proc test8 {} {
-    global test
-#    set prms_id 744
-#    setup_xfail {*-*-*} $prms_id
-
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_modify_policy $server_handle simple_policy "" \
-		{KADM5_PW_MAX_LIFE}
-    } "BAD_POLICY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test8
-
-test "modify-policy 9"
-proc test9 {} {
-    global test
-    global prompt
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test9
-
-test "modify-policy 10"
-proc test10 {} {
-    global test
-    global prompt
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0 0 0 0} \
-		{KADM5_PW_MIN_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 1\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test10
-
-
-test "modify-policy 11"
-proc test11 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test11
-
-test "modify-policy 12"
-proc test12 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0 0 0 0} \
-		{KADM5_PW_MAX_LIFE}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "32\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test12
-
-test "modify-policy 13"
-proc test13 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MIN_LENGTH}
-    } $test "BAD_LENGTH"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test13
-
-test "modify-policy 14"
-proc test14 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0 0 0 0} \
-		{KADM5_PW_MIN_LENGTH}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 3\n"
-    expect {
-	-re "8\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test14
-
-test "modify-policy 15"
-proc test15 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test15
-
-test "modify-policy 16"
-proc test16 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 0} \
-		{KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test16
-
-test "modify-policy 17"
-proc test17 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a")} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0 0 0 0} \
-		{KADM5_PW_MIN_CLASSES}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 4\n"
-    expect {
-	-re "5\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test17
-
-test "modify-policy 18"
-proc test18 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0 0 0 0} \
-		{KADM5_PW_MIN_CLASSES}
-    } $test "BAD_CLASS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test18
-
-test "modify-policy 19"
-proc test19 {} {
-    global test
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_HISTORY_NUM}
-    } $test "BAD_HISTORY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test19
-
-test "modify-policy 20"
-proc test20 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0 0 0 0} \
-		{KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "1\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test20
-
-test "modify-policy 21"
-proc test21 {} {
-    global test
-    global prompt
-    
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0 0 0 0} \
-		{KADM5_PW_HISTORY_NUM}
-    } $test} {
-	fail $test
-	return
-    }
-    if {! cmd format {
-	kadm5_get_policy $server_handle "%s/a" policy
-    } $test} {
-	fail "$test: can not retrieve policy"
-	return
-    }
-    send "lindex \$policy 5\n"
-    expect {
-	-re "10\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test21
-
-test "modify-policy 22"
-proc test22 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "AUTH_MODIFY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test22
-
-test "modify-policy 23"
-proc test23 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "AUTH_MODIFY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} test23
-
-test "modify-policy 26"
-proc test26 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_modify_policy $server_handle simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test26
-
-test "modify-policy 30"
-proc test30 {} {
-    global test
-
-    one_line_fail_test format {
-	kadm5_modify_policy null simple_policy "%s/a" \
-		{KADM5_PW_MAX_LIFE}
-    } $test "BAD_SERVER_HANDLE"
-}
-test30
-
-test "modify-policy 31"
-proc test31 {} {
-    global test
-    if {! ((  policy_exists "$test/a") ||
-	   create_policy "$test/a" )} {
-	    error_and_restart "$test: couldn't create policy \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 0 0 2 0 0} \
-		{KADM5_PW_MAX_FAILURE}
-    } $test
-    one_line_succeed_test format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 90 0} \
-		{KADM5_PW_FAILURE_COUNT_INTERVAL}
-    } $test
-    one_line_succeed_test format {
-	kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 180} \
-		{KADM5_PW_LOCKOUT_DURATION}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test31
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp Deleted

@@ -1,115 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "modify-principal 100-105"
-proc test100_104 {} {
-    global test
-    global prompt
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-
-    set origtest "$test"
-
-    test "modify-principal 100"
-    one_line_succeed_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MAX_RLIFE}
-    } $origtest
-
-    test "modify-principal 101"
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_LAST_SUCCESS}
-    } $origtest "BAD_MASK"
-
-    test "modify-principal 102"
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_LAST_FAILED}
-    } $origtest "BAD_MASK"
-
-#    This is now permitted to reset lockout count
-#    test "modify-principal 103"
-#    one_line_fail_test format {
-#	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-#		{KADM5_FAIL_AUTH_COUNT}
-#    } $origtest "BAD_MASK"
-
-    test "modify-principal 103.5"
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_KEY_DATA}
-    } $origtest "BAD_MASK"
-
-    test "modify-principal 105"
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle \
-            "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{1 1 x}}" \
-		{KADM5_TL_DATA}
-    } $origtest $origtest "BAD_TL_TYPE"
-
-    test "modify-principal 100,104"
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		"{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 88 0 0 0 0 1 {} {{990 6 foobar}}" \
-		{KADM5_MAX_RLIFE KADM5_TL_DATA}
-    } $origtest $origtest} {
-	fail "$test: cannot set MAX_RLIFE or TL_DATA"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal {KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA}
-    } $origtest} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 12\n"
-    expect {
-	-re "(\0-9\+)\n$prompt$" {set rlife $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting rlife"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting rlife"
-	    return
-	}
-    }
-    send "lindex \$principal 19\n"
-    expect {
-	-re "$\{.*\}$\n$prompt$" {set tl $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting tl_data"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting tl_data"
-	    return
-	}
-    }
-    if {($rlife == 88) && ($tl == "{{990 6 foobar}}")} {
-	pass "$test"
-    } else {
-	fail "$test: $rlife should be 88, $tl should be {{990 6 foobar}}"
-    }
-
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test100_104

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/mod-principal.exp Deleted

@@ -1,1606 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-#test "modify-principal 1"
-#proc test1 {} {
-#	global test
-#	one_line_fail_test format {
-#	    kadm5_modify_principal $server_handle simple_principal \
-#		    "%s/a" {KADM5_PW_EXPIRATION}
-#	} $test "NOT_INIT"
-#}
-#test1
-
-test "modify-principal 2"
-proc test2 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test "AUTH_MODIFY"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test2 }
-
-test "modify-principal 4"
-proc test4 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINCIPAL}
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test4
-
-
-test "modify-principal 5"
-proc test5 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_LAST_PWD_CHANGE}
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test5
-
-test "modify-principal 6"
-proc test6 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MOD_TIME}
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test6
-
-test "modify-principal 7"
-proc test7 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MOD_NAME}
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test7
-
-test "modify-principal 8"
-proc test8 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MKVNO}
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test8
-
-test "modify-principal 9"
-proc test9 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_AUX_ATTRIBUTES}
-    } $test "BAD_MASK"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test9
-
-test "modify-principal 10"
-proc test10 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test "UNK_PRINC"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test10
-
-test "modify-principal 11"
-proc test11 {} {
-    global test
-    if {! (( principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test "AUTH_MOD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test11 }
-
-test "modify-principal 12"
-proc test12 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test "AUTH_MOD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test12 }
-
-test "modify-principal 13"
-proc test13 {} {
-    global test
-    if {! (( principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test "AUTH_MOD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test13 }
-
-test "modify-principal 14"
-proc test14 {} {
-    global test
-    if {! (( principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test "AUTH_MOD"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test14 }
-
-test "modify-principal 15"
-proc test15 {} {
-    global test
-    if {! (( principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test15
-
-test "modify-principal 17"
-proc test17 {} {
-    global test
-    if {! (( principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_modify_principal $server_handle princ_w_pol "%s/a" \
-		no-policy {KADM5_POLICY}
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test17
-
-test "modify-principal 21.5"
-proc test21.5 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if { !( create_principal_pol "$test/a" "test-pol")} {
-	error_and_restart "$test: could not create principal \"$test/a\""
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol old_p1}}  {
-	perror "$test: unexpected failure on get policy"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle princ_w_pol "%s/a" \
-		test-pol {KADM5_POLICY}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$old_p1 6\n"
-    expect {
-	-re "(\0-9\+)\n$prompt$" {set old_p1_ref $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting principal kvno (second time)"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting principal kvno (second time)"
-	    return
-	}
-    }
-    
-    if { ! cmd {kadm5_get_policy $server_handle test-pol new_p1}} {
-	perror "$test: unexpected failure on get policy"
-	return
-    }
-    
-    send "lindex \$new_p1 6\n"
-    expect {
-	-re "(\0-9\+)\n$prompt$" {set new_p1_ref $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting principal kvno (second time)"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting principal kvno (second time)"
-	    return
-	}
-    }
-
-    if {$old_p1_ref != $new_p1_ref} {
-	fail "$test: policy reference count changed ($old_p1_ref to $new_p1_ref)"
-	return
-    }
-
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test21.5
-
-test "modify-principal 22"
-proc test22 {} {
-    global test
-    global prompt
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PW_EXPIRATION}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test22
-
-test "modify-principal 23"
-proc test23 {} {
-    global test
-    global prompt
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal_pol "$test/a" test-pol-nopw)} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PW_EXPIRATION}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test23
-
-test "modify-principal 24"
-proc test24 {} {
-    global test
-    global prompt
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal_pol "$test/a" "test-pol" )} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	error_and_restart "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PW_EXPIRATION}
-    } $test} {
-    	fail "$test: could not modify principal"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    if { ! cmd format {
-	kadm5_get_policy $server_handle %s policy
-    } test-pol} {
-	error_and_restart "$test: cannot retrieve policy"
-	return
-    }
-    send "lindex \$principal 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_mod_date $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting mod_date"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_mod_date"
-	    return
-	}
-    }
-
-    send "lindex \$principal 3\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_expire $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_expire"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_expire"
-	    return
-	}
-    }
-
-    send "lindex \$policy 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_max_life"
-	    return
-	}
-    }
-    if { $pw_expire != 0 } {
-	fail "$test: pw_expire $pw_expire should be 0"
-	return
-    } else {
-	pass "$test"
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} { 
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test24
-
-test "modify-principal 25"
-proc test25 {} {
-    global test
-    global prompt
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "1234\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test25
-
-test "modify-principal 26"
-proc test26 {} {
-    global test
-    global prompt
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal_pol "$test/a" "test-pol-nopw" )} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "1234\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test26
-
-test "modify-principal 27"
-proc test27 {} {
-    global test
-    global prompt
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal_pol "$test/a" "test-pol" )} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "1234\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test27
-
-test "modify-principal 28"
-proc test28 {} {
-    global test
-    global prompt
-#    set prms_id 1358
-#    setup_xfail {*-*-*} $prms_id    
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal_pol "$test/a" "test-pol" )} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 999999999 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol policy}} {
-	error_and_restart "$test: cannot retrieve policy"
-	return
-    }
-    send "lindex \$principal 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_mod_date $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_mod_date"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_mod_date"
-	    return
-	}
-    }
-
-    send "lindex \$principal 3\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_expire $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_expire"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_expire"
-	    return
-	}
-    }
-    send "lindex \$policy 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_max_life"
-	    return
-	}
-    }
-    if { $pw_expire != 999999999 } {
-	fail "$test: pw_expire $pw_expire should be 999999999"
-	return
-    }
-    pass "$test"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test28
-
-test "modify-principal 29"
-proc test29 {} {
-    global test
-    global prompt
-    
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if { ! (create_principal_pol "$test/a" test-pol)} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_POLICY_CLR}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test29
-
-test "modify-principal 30"
-proc test30 {} {
-    global test
-    global prompt
-
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal_pol "$test/a" test-pol)} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle princ_w_pol "%s/a" \
-		test-pol-nopw {KADM5_POLICY}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 3\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test30
-
-test "modify-principal 31"
-proc test31 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle princ_w_pol "%s/a" \
-		test-pol {KADM5_POLICY}
-    } $test} {
-	fail "modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol policy}} {
-	error_and_restart "$test: cannot retrieve policy"
-	return
-    }
-    send "lindex \$principal 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_mod_date $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_mod_date"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_mod_date"
-	    return
-	}
-    }
-
-    send "lindex \$principal 3\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_expire $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_expire"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_expire"
-	    return
-	}
-    }
-
-    send "lindex \$policy 2\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" {set pw_max_life $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting pw_max_life"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting pw_max_life"
-	    return
-	}
-    }
-    if { expr "$pw_mod_date + $pw_max_life" != $pw_expire } {
-	fail "$test: pw_expire is wrong"
-	return
-    }
-
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test31
-
-test "modify-principal 32"
-proc test32 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	error_and_restart "$test: couldn't delete principal \"$test/a\""
-	return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 1234 0 0 0 0 0 0 0 0 0 0} \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 1\n"
-    expect {
-	-re "1234\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test32
-
-test "modify-principal 33"
-proc test33 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_ALL_TIX 0 0 0 0} \
-		{KADM5_ATTRIBUTES}
-    } $test} {
-	fail "$test: modified fail"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 7\n"
-    expect {
-	-re "KRB5_KDB_DISALLOW_ALL_TIX.*$prompt$"		{ pass "$test" }
-	timeout							{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test33
-
-test "modify-principal 33.25"
-proc test3325 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 0 0 0 0 KRB5_KDB_REQUIRES_PWCHANGE 0 0 0 0} \
-		{KADM5_ATTRIBUTES}
-    } $test} {
-	fail "$test: modified fail"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 7\n"
-    expect {
-	-re "KRB5_KDB_REQUIRES_PWCHANGE.*$prompt$"		{ pass "$test" }
-	timeout							{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test3325
-
-test "modify-principal 33.5"
-proc test335 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_TGT_BASED 0 0 0 0} \
-		{KADM5_ATTRIBUTES}
-    } $test} {
-	fail "$test: modified fail"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 7\n"
-    expect {
-	-re "KRB5_KDB_DISALLOW_TGT_BASED.*$prompt$"		{ pass "$test" }
-	timeout							{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test335
-
-
-test "modify-principal 34"
-proc test34 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 0 3456 0 0 0 0 0 0 0} {KADM5_MAX_LIFE}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 4\n"
-    expect {
-	-re "3456\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test34
-
-test "modify-principal 35"
-proc test35 {} {
-    global prompt
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 0 0 0 0 0 7 0 0 0} {KADM5_KVNO}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 8\n"
-    expect {
-	-re "7\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test35
-
-test "modify-principal 36"
-proc test36 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if { !( create_principal_pol "$test/a" "test-pol")} {
-	error_and_restart "$test: could not create principal \"$test/a\""
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol pol}}  {
-	perror "$test: unexpected failure on get policy"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle princ_w_pol "%s/a" \
-		test-pol {KADM5_POLICY}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 10\n"
-    expect {
-	-re "test-pol\n$prompt$"	{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    send "lindex \$pol 6\n"
-    expect {
-	-re "(\0-9\+)\n$prompt$" {set oldref $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting principal kvno (second time)"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting principal kvno (second time)"
-	    return
-	}
-    }
-    if { ! cmd {kadm5_get_policy $server_handle test-pol pol2}} {
-	perror "$test: unexpected failure on get policy"
-	return
-    }
-    send "lindex \$pol2 6\n"
-    expect {
-	-re "(\0-9\+)\n$prompt$" {set newref $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting principal kvno (second time)"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting principal kvno (second time)"
-	    return
-	}
-    }
-    if { $oldref != $newref } {
-	fail "$test: policy reference count is wrong"
-	return;
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test36
-
-test "modify-principal 37"
-proc test37 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if { !( create_principal "$test/a")} {
-	error_and_restart "$test: could not create principal \"$test/a\""
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_POLICY_CLR}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test37
-
-test "modify-principal 38"
-proc test38 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 1\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test38
-
-test "modify-principal 39"
-proc test39 {} {
-    global test
-    global prompt
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! (create_principal "$test/a")} {
-	perror "$test: unexpected failure in creating principal"
-	return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle simple_principal "%s/a" \
-		{KADM5_MAX_LIFE}
-    } $test} {
-	fail "$test: modify failed"
-	return
-    }
-    if {! cmd format {
-	kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK
-    } $test} {
-	error_and_restart "$test: could not retrieve principal"
-	return
-    }
-    send "lindex \$principal 4\n"
-    expect {
-	-re "0\n$prompt$"		{ pass "$test" }
-	timeout				{ fail "$test" }
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test39
-
-test "modify-principal 40"
-proc test40 {} {
-    global test
-    global prompt
-    
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test {
-	kadm5_modify_principal $server_handle null \
-		{KADM5_PRINC_EXPIRE_TIME}
-    } "EINVAL"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test40
-
-test "modify-principal 43"
-proc test43 {} {
-	global test
-	one_line_fail_test format {
-	    kadm5_modify_principal null simple_principal \
-		    "%s/a" {KADM5_PW_EXPIRATION}
-	} $test "BAD_SERVER_HANDLE"
-}
-test43
-
-test "modify-principal 44"
-proc test44 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    # setting fail auth count to a non-zero value must fail
-    one_line_fail_test format {
-	kadm5_modify_principal $server_handle \
-		{"%s/a" 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1234 0 0 {} {}} {KADM5_FAIL_AUTH_COUNT}
-    } $test "BAD_SERVER_PARAMS"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test44
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp Deleted

@@ -1,61 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "randkey-principal 100"
-proc test100 {} {
-    global test prompt
-
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal "$test/a"} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-
-    # I'd like to specify a long list of keysalt tuples and make sure that
-    # randkey does the right thing, but we can only use those enctypes that
-    # krbtgt has a key for: 3DES and AES, according to the prototype kdc.conf.
-    if {! cmd format {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test} {
-	perror "$test: unexpected failure in randkey_principal"
-    }
-    send "puts \$num_keys\n"
-    expect {
-	-re "(\0-9\+)\n$prompt" { set num_keys $expect_out(1,string) }
-	timeout {
-	    error_and_restart "$test: timeout getting num_keys"
-	    return
-	}
-	eof {
-	    error_and_restart "$test: eof getting num_keys"
-	    return
-	}
-    }
-
-    # XXX Perhaps I should actually check the key type returned.
-    if {$num_keys == 5} {
-	pass "$test"
-    } else {
-	fail "$test: $num_keys keys, should be 5"
-    }
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test100
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/api.current/randkey-principal.exp Deleted

@@ -1,297 +0,0 @@
-load_lib lib.t
-api_exit
-api_start
-
-test "randkey-principal 1"
-proc test1 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal_pol "$test/a" once-a-min} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    
-    if {! cmd format {
-	kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } $test $test} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test "PASS_TOOSOON"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test1 } 
-
-test "randkey-principal 3"
-proc test3 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal_pol "$test/a" once-a-min} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    
-    if {! cmd format {
-	kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } $test $test} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test "PASS_TOOSOON"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if ${RPC} { test3 } 
-
-test "randkey-principal 13"
-proc test13 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    if {! cmd format {
-	kadm5_modify_principal $server_handle princ_w_pol "%s/a" \
-		once-a-min KADM5_POLICY
-    } $test} {
-	perror "$test: failed modify"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test13
-
-test "randkey-principal 15"
-proc test15 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal_pol "$test/a" once-a-min} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test "AUTH_CHANGEPW"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if { $RPC } { test15 }
-
-test "randkey-principal 28"
-proc test28 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test28
-
-test "randkey-principal 28.25"
-proc test2825 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test "AUTH"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-if {$RPC} { test2825 }
-
-test "randkey-principal 28.5"
-proc test285 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! cmd {
-	kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test285
-
-test "randkey-principal 30"
-proc test30 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't delete principal \"$test/a\""
-	    return
-    }
-    if {! create_principal "$test/a"} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    if {! cmd format {
-	kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } $test $test} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test30
-
-test "randkey-principal 31"
-proc test31 {} {
-    global test
-    if {! (( ! principal_exists "$test/a") ||
-	   delete_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if {! create_principal "$test/a"} {
-	error_and_restart "$test: creating principal"
-	return
-    }
-    
-    if {! cmd format {
-	kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    } $test $test} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_succeed_test format {
-	kadm5_randkey_principal $server_handle "%s/a" keys num_keys
-    } $test
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-test31
-
-test "randkey-principal 33"
-proc test33 {} {
-    global test
-    if {! ((  principal_exists "$test/a") ||
-	   create_principal "$test/a")} {
-	    error_and_restart "$test: couldn't create principal \"$test/a\""
-	    return
-    }
-    if { ! cmd {
-	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		server_handle
-    }} {
-	perror "$test: unexpected failure in init"
-	return
-    }
-    one_line_fail_test format {
-	kadm5_randkey_principal null "%s/a" keys num_keys
-    } $test "BAD_SERVER_HANDLE"
-    if { ! cmd {kadm5_destroy $server_handle}} {
-	perror "$test: unexpected failure in destroy"
-	return
-    }
-}
-
-test33
-
-return ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/config Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/config/unix.exp Deleted

@@ -1,222 +0,0 @@
-source runenv.exp
-
-set prompt "% "
-set stty_init {-onlcr -opost intr \^C kill \^U}
-set kadmin_local $KADMIN_LOCAL
-
-# Backward compatibility until we're using expect 5 everywhere
-if {info exists exp_version_4} {
-	global wait_error_index wait_errno_index wait_status_index
-	set wait_error_index 0
-	set wait_errno_index 1
-	set wait_status_index 1
-} else {
-	set wait_error_index 2
-	set wait_errno_index 3
-	set wait_status_index 3
-}
-
-if { string length $VALGRIND } {
-    rename spawn valgrind_aux_spawn
-    proc spawn { args } {
-	global VALGRIND
-	upvar 1 spawn_id spawn_id
-	set newargs {}
-	set inflags 1
-	set eatnext 0
-	foreach arg $args {
-	    if { $arg == "-ignore" \
-		     || $arg == "-open" \
-		     || $arg == "-leaveopen" } {
-		lappend newargs $arg
-		set eatnext 1
-		continue
-	    }
-	    if string match "-*" $arg {
-		lappend newargs $arg
-		continue
-	    }
-	    if { $eatnext } {
-		set eatnext 0
-		lappend newargs $arg
-		continue
-	    }
-	    if { $inflags } {
-		set inflags 0
-		# Only run valgrind for local programs, not
-		# system ones.
-#&&!string match "/bin/sh" $arg sh is used to start kadmind!
-		if string match "/" string index $arg 0&&!string match "/bin/ls" $arg&&!regexp {/kshd$} $arg {
-		    set newargs concat $newargs $VALGRIND
-		}
-	    }
-	    lappend newargs $arg
-	}
-	set pid eval valgrind_aux_spawn $newargs
-	return $pid
-    }
-}
-
-# Hack around Solaris 9 kernel race condition that causes last output
-# from a pty to get dropped.
-if { $PRIOCNTL_HACK } {
-    catch {exec priocntl -s -c FX -m 30 -p 30 -i pid getpid}
-    rename spawn oldspawn
-    proc spawn { args } {
-	upvar 1 spawn_id spawn_id
-	set newargs {}
-	set inflags 1
-	set eatnext 0
-	foreach arg $args {
-	    if { $arg == "-ignore" \
-		     || $arg == "-open" \
-		     || $arg == "-leaveopen" } {
-		lappend newargs $arg
-		set eatnext 1
-		continue
-	    }
-	    if string match "-*" $arg {
-		lappend newargs $arg
-		continue
-	    }
-	    if { $eatnext } {
-		set eatnext 0
-		lappend newargs $arg
-		continue
-	    }
-	    if { $inflags } {
-		set inflags 0
-		set newargs concat $newargs {priocntl -e -c FX -p 0}
-	    }
-	    lappend newargs $arg
-	}
-	set pid eval oldspawn $newargs
-	return $pid
-    }
-}
-
-# Variables for keeping track of api process state
-set api_pid "0"
-
-proc api_exit {} {
-	global spawn_id
-        global api_pid
-
-#	puts stdout "Starting api_exit (spawn_id $spawn_id)."
-	catch {close} errMsg
-        catch {wait} errMsg
-#       puts stdout "Finishing api_exit for $api_pid."
-        set api_pid "0"
-}
-
-proc api_isrunning {pid} {
-        global api_pid
-    
-#        puts stdout "testing $pid, api_pid is $api_pid"
-        if {$pid == $api_pid} {
-	    return 1;
-	} else {
-	    return 0;
-	}
-}
-
-proc api_version {} {
-}
-
-proc api_start {} {
-	global API 
-	global env
-	global spawn_id
-	global prompt
-        global api_pid
-
-	set pid spawn $API
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF starting API" }
-		timeout { perror "Timeout starting API" }
-	}
-	if {! info exists env(TCLUTIL)} {
-		perror "TCLUTIL environment variable isn't set"
-	}
-	# tcl 8.4 for some reason screws up autodetection of output
-	# EOL translation.  Work around it for now.
-	send "if { \info commands fconfigure\ ne \"\" } { fconfigure stdout -translation lf }\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF starting API" }
-		timeout { perror "Timeout starting API" }
-	}
-	send "source $env(TCLUTIL)\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF starting API" }
-		timeout { perror "Timeout starting API" }
-	}
-	send "set current_struct_version \expr \$KADM5_STRUCT_VERSION &~ \$KADM5_STRUCT_VERSION_MASK\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set current_api_version \expr \$KADM5_API_VERSION_3 &~ \$KADM5_API_VERSION_MASK\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set bad_struct_version_mask \expr 0x65432100 | \$current_struct_version\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set bad_api_version_mask \expr 0x65432100 | \$current_api_version\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set no_api_version_mask \$current_api_version\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set no_struct_version_mask \$current_struct_version\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set old_api_version \expr \$KADM5_API_VERSION_MASK | 0x00\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set old_struct_version \expr \$KADM5_STRUCT_VERSION_MASK | 0x00\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set new_api_version \expr \$KADM5_API_VERSION_MASK | 0xca\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-	send "set new_struct_version \expr \$KADM5_STRUCT_VERSION_MASK | 0xca\\n"
-	expect {
-		-re "$prompt$" {}
-		eof { perror "EOF setting API variables"}
-		timeout { perror "timeout setting API variables"}
-	}
-
-	set api_pid $pid
-#	puts stdout "Finishing api_start (spawn_id $spawn_id, pid $api_pid)."
-	return $pid
-}
-api_start
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/deps Deleted

@@ -1,86 +0,0 @@
-#
-# Generated makefile dependencies follow.
-#
-$(OUTPRE)init-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \
-  $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
-  $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
-  $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
-  $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
-  $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \
-  $(top_srcdir)/include/krb5.h init-test.c
-$(OUTPRE)destroy-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \
-  $(BUILDTOP)/include/kadm5/admin_internal.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \
-  $(BUILDTOP)/include/kadm5/client_internal.h $(BUILDTOP)/include/kadm5/kadm_err.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
-  $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
-  $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
-  $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
-  $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \
-  $(top_srcdir)/include/krb5.h destroy-test.c
-$(OUTPRE)handle-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \
-  $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/admin_internal.h \
-  $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \
-  $(BUILDTOP)/include/kadm5/server_internal.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
-  $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
-  $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
-  $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
-  $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/plugin.h \
-  handle-test.c
-$(OUTPRE)iter-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \
-  $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
-  $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
-  $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
-  $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
-  $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \
-  $(top_srcdir)/include/krb5.h iter-test.c
-$(OUTPRE)setkey-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \
-  $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \
-  $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
-  $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
-  $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
-  $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
-  $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  setkey-test.c
-$(OUTPRE)randkey-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \
-  $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
-  $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
-  $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
-  $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
-  $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \
-  $(top_srcdir)/include/krb5.h randkey-test.c
-$(OUTPRE)lock-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \
-  $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \
-  $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
-  $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
-  $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
-  $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \
-  $(top_srcdir)/include/krb5.h lock-test.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/destroy-test.c Deleted

@@ -1,48 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <kadm5/admin.h>
-#include <com_err.h>
-#include <stdio.h>
-#include <krb5.h>
-#include <sys/socket.h>
-#include <sys/file.h>
-#include <unistd.h>
-#include <netinet/in.h>
-#include <kadm5/client_internal.h>
-#include <string.h>
-
-#define TEST_NUM    25
-
-int main()
-{
-    kadm5_ret_t ret;
-    char   *cp;
-    int    x;
-    void *server_handle;
-    kadm5_server_handle_t handle;
-    krb5_context context;
-
-    ret = kadm5_init_krb5_context(&context);
-    if (ret != 0) {
-        com_err("test", ret, "context init");
-        exit(2);
-    }
-    for(x = 0; x < TEST_NUM; x++) {
-        ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, 0,
-                         KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL,
-                         &server_handle);
-        if(ret != KADM5_OK) {
-            com_err("test", ret, "init");
-            exit(2);
-        }
-        handle = (kadm5_server_handle_t) server_handle;
-        cp = strdup(strchr(handle->cache_name, ':') + 1);
-        kadm5_destroy(server_handle);
-        if(access(cp, F_OK) == 0) {
-            puts("ticket cache not destroyed");
-            exit(2);
-        }
-        free(cp);
-    }
-    krb5_free_context(context);
-    exit(0);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/diff-files Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/diff-files/destroy-1 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/diff-files/no-diffs Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/handle-test.c Deleted

@@ -1,140 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <kadm5/admin.h>
-#include <com_err.h>
-#include <stdio.h>
-#include <krb5.h>
-#include <sys/socket.h>
-#include <sys/file.h>
-#include <unistd.h>
-#include <netinet/in.h>
-#ifdef CLIENT_TEST
-#include <kadm5/client_internal.h>
-#else
-#include <kadm5/server_internal.h>
-#include <kadm5/admin.h>
-#endif
-
-int main(int argc, char *argv)
-{
-    kadm5_ret_t ret;
-    void *server_handle;
-    kadm5_server_handle_t handle;
-    kadm5_server_handle_rec orig_handle;
-    kadm5_policy_ent_rec       pol;
-    kadm5_principal_ent_t    princ;
-    kadm5_principal_ent_rec  kprinc;
-    krb5_keyblock      *key;
-    krb5_principal     tprinc;
-    krb5_context       context;
-
-
-    kadm5_init_krb5_context(&context);
-
-    ret = kadm5_init(context, "admin/none", "admin", KADM5_ADMIN_SERVICE, NULL,
-                     KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL,
-                     &server_handle);
-    if(ret != KADM5_OK) {
-        com_err("test", ret, "init");
-        exit(2);
-    }
-    handle = (kadm5_server_handle_t) server_handle;
-    orig_handle = *handle;
-    handle->magic_number = KADM5_STRUCT_VERSION;
-    krb5_parse_name(context, "testuser", &tprinc);
-    ret = kadm5_get_principal(server_handle, tprinc, &kprinc,
-                              KADM5_PRINCIPAL_NORMAL_MASK);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "get-principal",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_get_policy(server_handle, "pol1", &pol);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "get-policy",
-                error_message(ret));
-        exit(1);
-    }
-
-    princ = &kprinc;
-    ret = kadm5_create_principal(server_handle, princ, KADM5_PRINCIPAL, "pass");
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "create-principal",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_create_policy(server_handle, &pol, KADM5_POLICY);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "create-policy",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_modify_principal(server_handle, princ, KADM5_PW_EXPIRATION);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "modify-principal",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_modify_policy(server_handle, &pol, KADM5_PW_MAX_LIFE);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "modify-policy",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_delete_principal(server_handle, tprinc);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "delete-principal",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_delete_policy(server_handle, "pol1");
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "delete-policy",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_chpass_principal(server_handle, tprinc, "FooBar");
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "chpass",
-                error_message(ret));
-        exit(1);
-    }
-    ret = kadm5_randkey_principal(server_handle, tprinc, &key, NULL);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "randkey",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_rename_principal(server_handle, tprinc, tprinc);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "rename",
-                error_message(ret));
-        exit(1);
-    }
-
-    ret = kadm5_destroy(server_handle);
-    if(ret != KADM5_BAD_SERVER_HANDLE) {
-        fprintf(stderr, "%s -- returned -- %s\n", "destroy",
-                error_message(ret));
-        exit(1);
-    }
-
-    *handle = orig_handle;
-    ret = kadm5_destroy(server_handle);
-    if (ret != KADM5_OK) {
-        fprintf(stderr, "valid %s -- returned -- %s\n", "destroy",
-                error_message(ret));
-        exit(1);
-    }
-
-    krb5_free_principal(context, tprinc);
-    krb5_free_context(context);
-    exit(0);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/init-test.c Deleted

@@ -1,39 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <kadm5/admin.h>
-#include <com_err.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <krb5.h>
-#include <string.h>
-
-int main()
-{
-    kadm5_ret_t ret;
-    void *server_handle;
-    kadm5_config_params params;
-    krb5_context context;
-
-    memset(&params, 0, sizeof(params));
-    params.mask |= KADM5_CONFIG_NO_AUTH;
-    ret = kadm5_init_krb5_context(&context);
-    if (ret != 0) {
-        com_err("init-test", ret, "while initializing krb5 context");
-        exit(1);
-    }
-    ret = kadm5_init(context, "admin", "admin", NULL, &params,
-                     KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL,
-                     &server_handle);
-    if (!ret)
-        (void)kadm5_destroy(server_handle);
-    krb5_free_context(context);
-    if (ret == KADM5_RPC_ERROR) {
-        exit(0);
-    }
-    else if (ret != 0) {
-        com_err("init-test", ret, "while initializing without auth");
-        exit(1);
-    } else {
-        fprintf(stderr, "Unexpected success while initializing without auth!\n");
-        exit(1);
-    }
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/iter-test.c Deleted

@@ -1,51 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <stdio.h>
-#include <kadm5/admin.h>
-#include <string.h>
-
-int main(int argc, char **argv)
-{
-    kadm5_ret_t ret;
-    void *server_handle;
-    char **names;
-    int count, princ, i;
-    krb5_context context;
-
-    if (argc != 3) {
-        fprintf(stderr, "Usage: %s -princ|-pol exp\n", argv0);
-        exit(1);
-    }
-    princ = (strcmp(argv1, "-princ") == 0);
-
-    ret = kadm5_init_krb5_context(&context);
-    if (ret != KADM5_OK) {
-        com_err("iter-test", ret, "while initializing context");
-        exit(1);
-    }
-    ret = kadm5_init("admin", "admin", KADM5_ADMIN_SERVICE, 0,
-                     KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL,
-                     &server_handle);
-    if (ret != KADM5_OK) {
-        com_err("iter-test", ret, "while initializing");
-        exit(1);
-    }
-
-    if (princ)
-        ret = kadm5_get_principals(server_handle, argv2, &names, &count);
-    else
-        ret = kadm5_get_policies(server_handle, argv2, &names, &count);
-
-    if (ret != KADM5_OK) {
-        com_err("iter-test", ret, "while retrieving list");
-        exit(1);
-    }
-
-    for (i = 0; i < count; i++)
-        printf("%d: %s\n", i, namesi);
-
-    kadm5_free_name_list(server_handle, names, count);
-
-    (void) kadm5_destroy(server_handle);
-
-    return 0;
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/lib Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/lib/lib.t Deleted

@@ -1,306 +0,0 @@
-global timeout
-set timeout 60
-
-set lib_pid 0
-
-#
-# The functions in this library used to be responsible for bazillions
-# of wasted api_starts.  Now, they all just use their own library
-# handle so they are not interrupted when the main tests call init or
-# destroy.  They have to keep track of when the api exists and
-# restarts, though, since the lib_handle needs to be re-opened in that
-# case.
-#
-proc lib_start_api {} {
-    global spawn_id lib_pid test
-
-    if {! api_isrunning $lib_pid} {
-	api_exit
-	set lib_pid api_start
-	if {! cmd {
-	    kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
-		    $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-		    lib_handle
-	}} {
-	    perror "$test: unexpected failure in init"
-	    return
-	}
-	verbose "+++ restarted api ($lib_pid) for lib"
-    } else {
-	verbose "+++ api $lib_pid already running for lib"
-    }	
-}
-
-proc cmd {command} {
-    global prompt
-    global spawn_id
-    global test
-
-    send "string trim $command\n"
-    expect {
-	-re "OK .*$prompt$" { return 1 }
-        -re "ERROR .*$prompt$" { return 0 }
-	"wrong # args" { perror "$test: wrong number args"; return 0 }
-        timeout { fail "$test: timeout"; return 0 }
-        eof { fail "$test: eof"; api_exit; lib_start_api; return 0 }
-    }
-}
-
-proc tcl_cmd {command} {
-    global prompt spawn_id test
-
-    send "string trim $command\n"
-    expect {
-	-re "$prompt$" { return 1}
-	"wrong # args" { perror "$test: wrong number args"; return 0 }
-	timeout { error_and_restart "timeout" }
-	eof { api_exit; lib_start_api; return 0 }
-    }
-}
-
-proc one_line_succeed_test {command} {
-    global prompt
-    global spawn_id
-    global test
-
-    send "string trim $command\n"
-    expect {
-	-re "OK .*$prompt$"		{ pass "$test"; return 1 }
-	-re "ERROR .*$prompt$" { 
-		fail "$test: $expect_out(buffer)"; return 0
-	}
-	"wrong # args" { perror "$test: wrong number args"; return 0 }
-	timeout				{ fail "$test: timeout"; return 0 }
-	eof				{ fail "$test: eof"; api_exit; lib_start_api; return 0 }
-    }
-}
-
-proc one_line_fail_test {command code} {
-    global prompt
-    global spawn_id
-    global test
-
-    send "string trim $command\n"
-    expect {
-	-re "ERROR .*$code.*$prompt$"	{ pass "$test"; return 1 }
-	-re "ERROR .*$prompt$"	{ fail "$test: bad failure"; return 0 }
-	-re "OK .*$prompt$"		{ fail "$test: bad success"; return 0 }
-	"wrong # args" { perror "$test: wrong number args"; return 0 }
-	timeout				{ fail "$test: timeout"; return 0 }
-	eof				{ fail "$test: eof"; api_exit; lib_start_api; return 0 }
-    }
-}
-
-proc one_line_fail_test_nochk {command} {
-    global prompt
-    global spawn_id
-    global test
-
-    send "string trim $command\n"
-    expect {
-	-re "ERROR .*$prompt$"	{ pass "$test:"; return 1 }
-	-re "OK .*$prompt$"		{ fail "$test: bad success"; return 0 }
-	"wrong # args" { perror "$test: wrong number args"; return 0 }
-	timeout				{ fail "$test: timeout"; return 0 }
-	eof				{ fail "$test: eof"; api_exit; lib_start_api; return 0 }
-    }
-}
-
-proc resync {} {
-    global prompt spawn_id test
-
-    expect {
-	-re "$prompt$"	{}
-	"wrong # args" { perror "$test: wrong number args"; return 0 }
-	eof { api_exit; lib_start_api }
-    }
-}
-
-proc create_principal {name} {
-    lib_start_api
-
-    set ret cmd format {
-	kadm5_create_principal $lib_handle simple_principal \
-		"%s" {KADM5_PRINCIPAL} "%s"
-    } $name $name
-
-    return $ret
-}
-
-proc create_policy {name} {
-    lib_start_api
-
-    set ret cmd format {
-	    kadm5_create_policy $lib_handle simple_policy "%s" \
-		    {KADM5_POLICY}
-	} $name $name
-
-    return $ret
-}
-
-proc create_principal_pol {name policy} {
-    lib_start_api
-
-    set ret cmd format {
-	    kadm5_create_principal $lib_handle princ_w_pol "%s" \
-		    "%s" {KADM5_PRINCIPAL KADM5_POLICY} "%s"
-    } $name $policy $name
-
-    return $ret
-}
-
-proc delete_principal {name} {
-    lib_start_api
-
-    set ret cmd format {
-	    kadm5_delete_principal $lib_handle "%s"
-    } $name
-
-    return $ret
-}
-
-proc delete_policy {name} {
-    lib_start_api
-
-    set ret cmd format {kadm5_delete_policy $lib_handle "%s"} $name
-
-    return $ret
-}
-
-proc principal_exists {name} {
-#    puts stdout "Starting principal_exists."
-
-    lib_start_api
-
-    set ret cmd format {
-	kadm5_get_principal $lib_handle "%s" principal \
-	  KADM5_PRINCIPAL_NORMAL_MASK
-    } $name
-
-#   puts stdout "Finishing principal_exists."
-
-    return $ret
-}
-
-proc policy_exists {name} {
-    lib_start_api
-
-#    puts stdout "Starting policy_exists."
-
-    set ret cmd format {
-	    kadm5_get_policy $lib_handle "%s" policy
-	} $name
-
-#    puts stdout "Finishing policy_exists."
-
-    return $ret
-}
-
-proc error_and_restart {error} {
-    api_exit
-    api_start
-    perror $error
-}
-
-proc test {name} {
-   global test verbose
-
-   set test $name
-   if {$verbose >= 1} {
-	puts stdout "At $test"
-   }
-}
-
-proc begin_dump {} {
-    global TOP
-    global RPC
-    
-    if { ! $RPC } {
-#	exec $env(SIMPLE_DUMP) > /tmp/dump.before
-    }
-}
-
-proc end_dump_compare {name} {
-    global  file
-    global  TOP
-    global  RPC
-
-    if { ! $RPC } { 
-#	set file $TOP/admin/lib/unit-test/diff-files/$name
-#	exec $env(SIMPLE_DUMP) > /tmp/dump.after
-#	exec $env(COMPARE_DUMP) /tmp/dump.before /tmp/dump.after $file
-    }
-}
-
-proc kinit { princ pass {opts ""} } {
-	global env;
-        global KINIT
-
-	eval spawn $KINIT -5 $opts $princ
-	expect {
-		-re {Password for .*: $}
-		    {send "$pass\n"}
-		timeout {puts "Timeout waiting for prompt" ; close }
-	}
-
-	# this necessary so close(1) in the child will not sleep waiting for
-	# the parent, which is us, to read pending data.
-
-	expect {
-		"when initializing cache" { perror "kinit failed: $expect_out(buffer)" }
-		eof {}
-	}
-	wait
-}
-
-proc kdestroy {} {
-        global KDESTROY
-	global errorCode errorInfo
-	global env
-
-	if {info exists errorCode} {
-		set saveErrorCode $errorCode
-	}
-	if {info exists errorInfo} {
-		set saveErrorInfo $errorInfo
-	}
-	catch "exec $KDESTROY -5 2>/dev/null"
-	if {info exists saveErrorCode} {
-		set errorCode $saveErrorCode
-	} elseif {info exists errorCode} {
-		unset errorCode
-	}
-	if {info exists saveErrorInfo} {
-		set errorInfo $saveErrorInfo
-	} elseif {info exists errorInfo} {
-		unset errorInfo
-	}
-}
-
-proc create_principal_with_keysalts {name keysalts} {
-    global kadmin_local
-
-    spawn $kadmin_local -e "$keysalts"
-    expect {
-	"kadmin.local:" {}
-	default { perror "waiting for kadmin.local prompt"; return 1}
-    }
-    send "ank -pw \"$name\" \"$name\"\n"
-    expect {
-	-re "Principal \"$name.*\" created." {}
-	"kadmin.local:" {
-	    perror "expecting principal created message"; 
-	    return 1
-	}
-	default { perror "waiting for principal created message"; return 1 }
-    }
-    expect {
-	"kadmin.local:" {}
-	default { perror "waiting for kadmin.local prompt"; return 1 }
-    }
-    close
-    wait
-    return 0
-}
-
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/lock-test.c Deleted

@@ -1,105 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <stdio.h>
-#include <krb5.h>
-#include <kadm5/admin.h>
-#include <kdb.h>
-#include <string.h>
-
-char *whoami;
-
-static void usage()
-{
-    fprintf(stderr,
-            "Usage: %s {shared|exclusive|permanent|release|"
-            "get name|wait} ...\n", whoami);
-    exit(1);
-}
-
-int main(int argc, char **argv)
-{
-    krb5_error_code ret;
-    osa_policy_ent_t entry;
-    krb5_context context;
-    kadm5_config_params params;
-    krb5_error_code kret;
-
-    whoami = argv0;
-
-    kret = kadm5_init_krb5_context(&context);
-    if (kret) {
-        com_err(whoami, kret, "while initializing krb5");
-        exit(1);
-    }
-
-    params.mask = 0;
-    ret = kadm5_get_config_params(context, 1, &params, &params);
-    if (ret) {
-        com_err(whoami, ret, "while retrieving configuration parameters");
-        exit(1);
-    }
-    if (! (params.mask & KADM5_CONFIG_ADBNAME)) {
-        com_err(whoami, KADM5_BAD_SERVER_PARAMS,
-                "while retrieving configuration parameters");
-        exit(1);
-    }
-
-    ret = krb5_db_open( context, NULL, KRB5_KDB_OPEN_RW);
-    if (ret) {
-        com_err(whoami, ret, "while opening database");
-        exit(1);
-    }
-
-    argc--; argv++;
-    while (argc) {
-        if (strcmp(*argv, "shared") == 0) {
-            ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_SHARED);
-            if (ret)
-                com_err(whoami, ret, "while getting shared lock");
-            else
-                printf("shared\n");
-        } else if (strcmp(*argv, "exclusive") == 0) {
-            ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE );
-            if (ret)
-                com_err(whoami, ret, "while getting exclusive lock");
-            else
-                printf("exclusive\n");
-        } else if (strcmp(*argv, "permanent") == 0) {
-            ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE );
-            if (ret)
-                com_err(whoami, ret, "while getting permanent lock");
-            else
-                printf("permanent\n");
-        } else if (strcmp(*argv, "release") == 0) {
-            ret = krb5_db_unlock(context);
-            if (ret)
-                com_err(whoami, ret, "while releasing lock");
-            else
-                printf("released\n");
-        } else if (strcmp(*argv, "get") == 0) {
-            argc--; argv++;
-            if (!argc) usage();
-            if ((ret = krb5_db_get_policy(context, *argv, &entry))) {
-                com_err(whoami, ret, "while getting policy");
-            } else {
-                printf("retrieved\n");
-                krb5_db_free_policy(context, entry);
-            }
-        } else if (strcmp(*argv, "wait") == 0) {
-            getchar();
-        } else {
-            fprintf(stderr, "%s: Invalid argument \"%s\"\n",
-                    whoami, *argv);
-            usage();
-        }
-
-        argc--; argv++;
-    }
-
-    ret = krb5_db_fini(context);
-    if (ret) {
-        com_err(whoami, ret, "while closing database");
-        exit(1);
-    }
-
-    return 0;
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/randkey-test.c Deleted

@@ -1,42 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <kadm5/admin.h>
-#include <com_err.h>
-#include <stdio.h>
-#include <krb5.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <string.h>
-
-#define TEST_NUM    1000
-
-int main()
-{
-    kadm5_ret_t ret;
-    krb5_keyblock  *keysTEST_NUM;
-    krb5_principal tprinc;
-    krb5_keyblock  *newkey;
-    krb5_context context;
-    void *server_handle;
-
-    int    x, i;
-
-    kadm5_init_krb5_context(&context);
-
-    krb5_parse_name(context, "testuser", &tprinc);
-    ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
-                     KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL,
-                     &server_handle);
-    if(ret != KADM5_OK) {
-        com_err("test", ret, "init");
-        exit(2);
-    }
-    for(x = 0; x < TEST_NUM; x++) {
-        kadm5_randkey_principal(server_handle, tprinc, &keysx, NULL);
-        for(i = 0; i < x; i++) {
-            if (!memcmp(newkey->contents, keysi->contents, newkey->length))
-                puts("match found");
-        }
-    }
-    kadm5_destroy(server_handle);
-    exit(0);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/setkey-test.c Deleted

@@ -1,246 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <k5-int.h>
-#include <kadm5/admin.h>
-
-#if     HAVE_SRAND48
-#define RAND()          lrand48()
-#define SRAND(a)        srand48(a)
-#define RAND_TYPE       long
-#elif   HAVE_SRAND
-#define RAND()          rand()
-#define SRAND(a)        srand(a)
-#define RAND_TYPE       int
-#elif   HAVE_SRANDOM
-#define RAND()          random()
-#define SRAND(a)        srandom(a)
-#define RAND_TYPE       long
-#else   /* no random */
-need a random number generator
-#endif  /* no random */
-
-krb5_keyblock test1 = {
-    {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0},
-    {-1},
-};
-krb5_keyblock test2 = {
-    {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0},
-    {-1},
-};
-krb5_keyblock test3 = {
-    {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0},
-    {-1},
-};
-
-krb5_keyblock *tests = {
-    test1, test2, test3, NULL
-};
-
-krb5_data tgtname = {
-    0,
-    KRB5_TGS_NAME_SIZE,
-    KRB5_TGS_NAME
-};
-
-krb5_enctype ktypes = { 0, 0 };
-
-extern krb5_kt_ops krb5_ktf_writable_ops;
-
-int
-main(int argc, char **argv)
-{
-    krb5_context context;
-    krb5_keytab kt;
-    krb5_keytab_entry ktent;
-    krb5_encrypt_block eblock;
-    krb5_creds my_creds;
-    krb5_get_init_creds_opt *opt;
-    kadm5_principal_ent_rec princ_ent;
-    krb5_principal princ, server;
-    char pw16;
-    char *whoami, *principal, *authprinc, *authpwd;
-    krb5_data pwdata;
-    void *handle;
-    int ret, test, encnum;
-    unsigned int i;
-
-    whoami = argv0;
-
-    if (argc < 2 || argc > 4) {
-        fprintf(stderr, "Usage: %s principal authuser authpwd\n", whoami);
-        exit(1);
-    }
-    principal = argv1;
-    authprinc = (argc > 2) ? argv2 : argv0;
-    authpwd = (argc > 3) ? argv3 : NULL;
-
-    /*
-     * Setup.  Initialize data structures, open keytab, open connection
-     * to kadm5 server.
-     */
-
-    memset(&context, 0, sizeof(context));
-    kadm5_init_krb5_context(&context);
-
-    ret = krb5_parse_name(context, principal, &princ);
-    if (ret) {
-        com_err(whoami, ret, "while parsing principal name %s", principal);
-        exit(1);
-    }
-
-    if((ret = krb5_build_principal_ext(context, &server,
-                                       krb5_princ_realm(kcontext, princ)->length,
-                                       krb5_princ_realm(kcontext, princ)->data,
-                                       tgtname.length, tgtname.data,
-                                       krb5_princ_realm(kcontext, princ)->length,
-                                       krb5_princ_realm(kcontext, princ)->data,
-                                       0))) {
-        com_err(whoami, ret, "while building server name");
-        exit(1);
-    }
-
-    ret = krb5_kt_default(context, &kt);
-    if (ret) {
-        com_err(whoami, ret, "while opening keytab");
-        exit(1);
-    }
-
-    ret = kadm5_init(context, authprinc, authpwd, KADM5_ADMIN_SERVICE, NULL,
-                     KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL,
-                     &handle);
-    if (ret) {
-        com_err(whoami, ret, "while initializing connection");
-        exit(1);
-    }
-
-    /* these pw's don't need to be secure, just different every time */
-    SRAND((RAND_TYPE)time((void *) NULL));
-    pwdata.data = pw;
-    pwdata.length = sizeof(pw);
-
-    /*
-     * For each test:
-     *
-     * For each enctype in the test, construct a random password/key.
-     * Assign all keys to principal with kadm5_setkey_principal.  Add
-     * each key to the keytab, and acquire an initial ticket with the
-     * keytab (XXX can I specify the kvno explicitly?).  If
-     * krb5_get_init_creds_keytab succeeds, then the keys were set
-     * successfully.
-     */
-    for (test = 0; teststest != NULL; test++) {
-        krb5_keyblock *testp = teststest;
-        kadm5_key_data *extracted;
-        int n_extracted, match;
-        printf("+ Test %d:\n", test);
-
-        for (encnum = 0; testpencnum.magic != -1; encnum++) {
-            for (i = 0; i < sizeof(pw); i++)
-                pwi = (RAND() % 26) + '0'; /* XXX */
-
-            krb5_use_enctype(context, &eblock, testpencnum.enctype);
-            ret = krb5_string_to_key(context, &eblock, &testpencnum,
-                                     &pwdata, NULL);
-            if (ret) {
-                com_err(whoami, ret, "while converting string to key");
-                exit(1);
-            }
-        }
-
-        /* now, encnum == # of keyblocks in testp */
-        ret = kadm5_setkey_principal(handle, princ, testp, encnum);
-        if (ret) {
-            com_err(whoami, ret, "while setting keys");
-            exit(1);
-        }
-
-        ret = kadm5_get_principal(handle, princ, &princ_ent, KADM5_KVNO);
-        if (ret) {
-            com_err(whoami, ret, "while retrieving principal");
-            exit(1);
-        }
-
-        ret = kadm5_get_principal_keys(handle, princ, 0, &extracted,
-                                       &n_extracted);
-        if (ret) {
-            com_err(whoami, ret, "while extracting keys");
-            exit(1);
-        }
-
-        for (encnum = 0; testpencnum.magic != -1; encnum++) {
-            printf("+   enctype %d\n", testpencnum.enctype);
-
-            for (match = 0; match < n_extracted; match++) {
-                if (extractedmatch.key.enctype == testpencnum.enctype)
-                    break;
-            }
-            if (match >= n_extracted) {
-                com_err(whoami, KRB5_WRONG_ETYPE, "while matching enctypes");
-                exit(1);
-            }
-            if (extractedmatch.key.length != testpencnum.length ||
-                memcmp(extractedmatch.key.contents, testpencnum.contents,
-                       testpencnum.length) != 0) {
-                com_err(whoami, KRB5_KDB_NO_MATCHING_KEY, "verifying keys");
-                exit(1);
-            }
-
-            memset(&ktent, 0, sizeof(ktent));
-            ktent.principal = princ;
-            ktent.key = testpencnum;
-            ktent.vno = princ_ent.kvno;
-
-            ret = krb5_kt_add_entry(context, kt, &ktent);
-            if (ret) {
-                com_err(whoami, ret, "while adding keytab entry");
-                exit(1);
-            }
-
-            memset(&my_creds, 0, sizeof(my_creds));
-            my_creds.client = princ;
-            my_creds.server = server;
-
-            ktypes0 = testpencnum.enctype;
-            ret = krb5_get_init_creds_opt_alloc(context, &opt);
-            if (ret) {
-                com_err(whoami, ret, "while allocating gic opts");
-                exit(1);
-            }
-            krb5_get_init_creds_opt_set_etype_list(opt, ktypes, 1);
-            ret = krb5_get_init_creds_keytab(context, &my_creds, princ,
-                                             kt, 0, NULL /* in_tkt_service */,
-                                             opt);
-            krb5_get_init_creds_opt_free(context, opt);
-            if (ret) {
-                com_err(whoami, ret, "while acquiring initial ticket");
-                exit(1);
-            }
-            krb5_free_cred_contents(context, &my_creds);
-
-            /* since I can't specify enctype explicitly ... */
-            ret = krb5_kt_remove_entry(context, kt, &ktent);
-            if (ret) {
-                com_err(whoami, ret, "while removing keytab entry");
-                exit(1);
-            }
-        }
-
-        (void)kadm5_free_kadm5_key_data(context, n_extracted, extracted);
-    }
-
-    ret = krb5_kt_close(context, kt);
-    if (ret) {
-        com_err(whoami, ret, "while closing keytab");
-        exit(1);
-    }
-
-    ret = kadm5_destroy(handle);
-    if (ret) {
-        com_err(whoami, ret, "while closing kadmin connection");
-        exit(1);
-    }
-
-    krb5_free_principal(context, princ);
-    krb5_free_principal(context, server);
-    krb5_free_context(context);
-    return 0;
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/unit-test/site.exp Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/s4u_authdata.c Deleted

@@ -1,596 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/*
- * Copyright 2010 by the Massachusetts Institute of Technology.  All
- * Rights Reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- *
- */
-
-#include "k5-int.h"
-#include "authdata.h"
-#include "auth_con.h"
-#include "int-proto.h"
-
-/*
- * Authdata backend for processing SignedPath. Presently does not handle
- * the equivalent information in MS-PAC, as that would require an NDR
- * interpreter.
- */
-
-struct s4u2proxy_context {
-    int count;
-    krb5_principal *delegated;
-    krb5_boolean authenticated;
-};
-
-static krb5_error_code
-s4u2proxy_init(krb5_context kcontext, void **plugin_context)
-{
-    *plugin_context = NULL;
-    return 0;
-}
-
-static void
-s4u2proxy_flags(krb5_context kcontext,
-                void *plugin_context,
-                krb5_authdatatype ad_type,
-                krb5_flags *flags)
-{
-    *flags = AD_USAGE_KDC_ISSUED;
-}
-
-static void
-s4u2proxy_fini(krb5_context kcontext, void *plugin_context)
-{
-    return;
-}
-
-static krb5_error_code
-s4u2proxy_request_init(krb5_context kcontext,
-                       krb5_authdata_context context,
-                       void *plugin_context,
-                       void **request_context)
-{
-    krb5_error_code code;
-    struct s4u2proxy_context *s4uctx;
-
-    s4uctx = k5alloc(sizeof(*s4uctx), &code);
-    if (s4uctx == NULL)
-        return code;
-
-    s4uctx->count = 0;
-    s4uctx->delegated = NULL;
-    s4uctx->authenticated = FALSE;
-
-    *request_context = s4uctx;
-
-    return 0;
-}
-
-static void
-s4u2proxy_free_internal(krb5_context kcontext,
-                        krb5_authdata_context context,
-                        void *plugin_context,
-                        void *request_context,
-                        void *ptr)
-{
-    krb5_principal *delegated = (krb5_principal *)ptr;
-    int i;
-
-    if (delegated != NULL) {
-        for (i = 0; delegatedi != NULL; i++)
-            krb5_free_principal(kcontext, delegatedi);
-        free(delegated);
-    }
-}
-
-static krb5_error_code
-s4u2proxy_import_authdata(krb5_context kcontext,
-                          krb5_authdata_context context,
-                          void *plugin_context,
-                          void *request_context,
-                          krb5_authdata **authdata,
-                          krb5_boolean kdc_issued,
-                          krb5_const_principal kdc_issuer)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code;
-    krb5_ad_signedpath *sp;
-    krb5_data enc_sp;
-
-    enc_sp.data = (char *)authdata0->contents;
-    enc_sp.length = authdata0->length;
-
-    code = decode_krb5_ad_signedpath(&enc_sp, &sp);
-    if (code != 0)
-        return code;
-
-    s4u2proxy_free_internal(kcontext, context,
-                            plugin_context, request_context,
-                            s4uctx->delegated);
-
-    s4uctx->delegated = sp->delegated;
-    sp->delegated = NULL;
-
-    krb5_free_ad_signedpath(kcontext, sp);
-
-    s4uctx->count = 0;
-
-    if (s4uctx->delegated != NULL) {
-        for (s4uctx->count = 0; s4uctx->delegateds4uctx->count;
-             s4uctx->count++)
-            ;
-    }
-
-    s4uctx->authenticated = FALSE;
-
-    return 0;
-}
-
-static krb5_error_code
-s4u2proxy_export_authdata(krb5_context kcontext,
-                          krb5_authdata_context context,
-                          void *plugin_context,
-                          void *request_context,
-                          krb5_flags usage,
-                          krb5_authdata ***out_authdata)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code;
-    krb5_ad_signedpath sp;
-    krb5_authdata **authdata;
-    krb5_data *data;
-
-    if (s4uctx->count == 0)
-        return 0;
-
-    memset(&sp, 0, sizeof(sp));
-    sp.delegated = s4uctx->delegated;
-
-    authdata = k5calloc(2, sizeof(krb5_authdata *), &code);
-    if (authdata == NULL)
-        return code;
-
-    authdata0 = k5alloc(sizeof(krb5_authdata), &code);
-    if (authdata0 == NULL)
-        return code;
-
-    code = encode_krb5_ad_signedpath(&sp, &data);
-    if (code != 0) {
-        krb5_free_authdata(kcontext, authdata);
-        return code;
-    }
-
-    authdata0->magic = KV5M_AUTHDATA;
-    authdata0->ad_type = KRB5_AUTHDATA_SIGNTICKET;
-    authdata0->length = data->length;
-    authdata0->contents = (krb5_octet *)data->data;
-
-    authdata1 = NULL;
-
-    free(data);
-
-    *out_authdata = authdata;
-
-    return 0;
-}
-
-static krb5_error_code
-s4u2proxy_verify(krb5_context kcontext,
-                 krb5_authdata_context context,
-                 void *plugin_context,
-                 void *request_context,
-                 const krb5_auth_context *auth_context,
-                 const krb5_keyblock *key,
-                 const krb5_ap_req *req)
-{
-    /*
-     * XXX there is no way to verify the SignedPath without the TGS
-     * key. This means that we can never mark this as authenticated.
-     */
-
-    return 0;
-}
-
-static void
-s4u2proxy_request_fini(krb5_context kcontext,
-                       krb5_authdata_context context,
-                       void *plugin_context,
-                       void *request_context)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-
-    if (s4uctx == NULL)
-        return;
-
-    s4u2proxy_free_internal(kcontext, context,
-                            plugin_context, request_context,
-                            s4uctx->delegated);
-    free(s4uctx);
-}
-
-/*
- * Nomenclature defined to be similar to MS-PAC 2.9, for future
- * interoperability
- */
-
-static krb5_data s4u2proxy_transited_services_attr = {
-    KV5M_DATA,
-    sizeof("urn:constrained-delegation:transited-services") - 1,
-    "urn:constrained-delegation:transited-services"
-};
-
-static krb5_error_code
-s4u2proxy_get_attribute_types(krb5_context kcontext,
-                              krb5_authdata_context context,
-                              void *plugin_context,
-                              void *request_context,
-                              krb5_data **out_attrs)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code;
-    krb5_data *attrs;
-    int i = 0;
-
-    if (s4uctx->count == 0)
-        return ENOENT;
-
-    attrs = k5calloc(2, sizeof(krb5_data), &code);
-    if (attrs == NULL)
-        goto cleanup;
-
-    code = krb5int_copy_data_contents(kcontext,
-                                      &s4u2proxy_transited_services_attr,
-                                      &attrsi++);
-    if (code != 0)
-        goto cleanup;
-
-    attrsi.data = NULL;
-    attrsi.length = 0;
-
-    *out_attrs = attrs;
-    attrs = NULL;
-
-cleanup:
-    if (attrs != NULL) {
-        for (i = 0; attrsi.data; i++)
-            krb5_free_data_contents(kcontext, &attrsi);
-        free(attrs);
-    }
-
-    return 0;
-}
-
-static krb5_error_code
-s4u2proxy_get_attribute(krb5_context kcontext,
-                        krb5_authdata_context context,
-                        void *plugin_context,
-                        void *request_context,
-                        const krb5_data *attribute,
-                        krb5_boolean *authenticated,
-                        krb5_boolean *complete,
-                        krb5_data *value,
-                        krb5_data *display_value,
-                        int *more)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code;
-    krb5_principal principal;
-    int i;
-
-    if (display_value != NULL) {
-        display_value->data = NULL;
-        display_value->length = 0;
-    }
-
-    if (!data_eq(*attribute, s4u2proxy_transited_services_attr))
-        return ENOENT;
-
-    i = -(*more) - 1;
-    if (i < 0)
-        return EINVAL;
-    else if (i >= s4uctx->count)
-        return ENOENT;
-
-    principal = s4uctx->delegatedi;
-    assert(principal != NULL);
-
-    code = krb5_unparse_name_flags(kcontext, principal, 0, &value->data);
-    if (code != 0)
-        return code;
-
-    value->length = strlen(value->data);
-
-    if (display_value != NULL) {
-        code = krb5_unparse_name_flags(kcontext, principal,
-                                       KRB5_PRINCIPAL_UNPARSE_DISPLAY,
-                                       &display_value->data);
-        if (code != 0)
-            return code;
-
-        display_value->length = strlen(display_value->data);
-    }
-
-    i++;
-
-    if (i == s4uctx->count)
-        *more = 0;
-    else
-        *more = -(i + 1);
-
-    *authenticated = s4uctx->authenticated;
-    *complete = TRUE;
-
-    return 0;
-}
-
-static krb5_error_code
-s4u2proxy_set_attribute(krb5_context kcontext,
-                        krb5_authdata_context context,
-                        void *plugin_context,
-                        void *request_context,
-                        krb5_boolean complete,
-                        const krb5_data *attribute,
-                        const krb5_data *value)
-{
-    /* Only the KDC can set this attribute. */
-    if (!data_eq(*attribute, s4u2proxy_transited_services_attr))
-        return ENOENT;
-
-    return EPERM;
-}
-
-static krb5_error_code
-s4u2proxy_export_internal(krb5_context kcontext,
-                          krb5_authdata_context context,
-                          void *plugin_context,
-                          void *request_context,
-                          krb5_boolean restrict_authenticated,
-                          void **ptr)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code;
-    int i;
-    krb5_principal *delegated;
-
-    *ptr = NULL;
-
-    if (s4uctx->count == 0)
-        return ENOENT;
-
-    if (restrict_authenticated)
-        return ENOENT;
-
-    delegated = k5calloc(s4uctx->count + 1, sizeof(krb5_principal), &code);
-    if (delegated == NULL)
-        return code;
-
-    for (i = 0; i < s4uctx->count; i++) {
-        code = krb5_copy_principal(kcontext, s4uctx->delegatedi,
-                                   &delegatedi);
-        if (code != 0)
-            goto cleanup;
-    }
-
-    delegatedi = NULL;
-
-    *ptr = delegated;
-    delegated = NULL;
-
-cleanup:
-    s4u2proxy_free_internal(kcontext, context,
-                            plugin_context, request_context,
-                            delegated);
-
-    return code;
-}
-
-static krb5_error_code
-s4u2proxy_size(krb5_context kcontext,
-               krb5_authdata_context context,
-               void *plugin_context,
-               void *request_context,
-               size_t *sizep)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code = 0;
-    int i;
-
-    *sizep += sizeof(krb5_int32); /* version */
-    *sizep += sizeof(krb5_int32); /* princ count */
-
-    for (i = 0; i < s4uctx->count; i++) {
-        code = k5_size_principal(s4uctx->delegatedi, sizep);
-        if (code != 0)
-            return code;
-    }
-
-    *sizep += sizeof(krb5_int32); /* authenticated flag */
-
-    return code;
-}
-
-static krb5_error_code
-s4u2proxy_externalize(krb5_context kcontext,
-                      krb5_authdata_context context,
-                      void *plugin_context,
-                      void *request_context,
-                      krb5_octet **buffer,
-                      size_t *lenremain)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code = 0;
-    size_t required = 0;
-    krb5_octet *bp;
-    size_t remain;
-    int i = 0;
-
-    bp = *buffer;
-    remain = *lenremain;
-
-    s4u2proxy_size(kcontext, context, plugin_context,
-                   request_context, &required);
-
-    if (required > remain)
-        return ENOMEM;
-
-    krb5_ser_pack_int32(1, &bp, &remain); /* version */
-    krb5_ser_pack_int32(s4uctx->count, &bp, &remain); /* princ count */
-
-    for (i = 0; i < s4uctx->count; i++) {
-        code = k5_externalize_principal(s4uctx->delegatedi, &bp, &remain);
-        if (code != 0)
-            return code;
-    }
-
-    krb5_ser_pack_int32(s4uctx->authenticated, &bp, &remain); /* authenticated */
-
-    *buffer = bp;
-    *lenremain = remain;
-
-    return 0;
-}
-
-static krb5_error_code
-s4u2proxy_internalize(krb5_context kcontext,
-                      krb5_authdata_context context,
-                      void *plugin_context,
-                      void *request_context,
-                      krb5_octet **buffer,
-                      size_t *lenremain)
-{
-    struct s4u2proxy_context *s4uctx = (struct s4u2proxy_context *)request_context;
-    krb5_error_code code;
-    krb5_int32 ibuf;
-    krb5_octet *bp;
-    size_t remain;
-    int count;
-    krb5_principal *delegated = NULL;
-
-    bp = *buffer;
-    remain = *lenremain;
-
-    /* version */
-    code = krb5_ser_unpack_int32(&ibuf, &bp, &remain);
-    if (code != 0)
-        goto cleanup;
-
-    if (ibuf != 1) {
-        code = EINVAL;
-        goto cleanup;
-    }
-
-    /* count */
-    code = krb5_ser_unpack_int32(&count, &bp, &remain);
-    if (code != 0)
-        goto cleanup;
-
-    if (count > 65535)
-        return ERANGE; /* let's set some reasonable limits here */
-    else if (count > 0) {
-        int i;
-
-        delegated = k5calloc(count + 1, sizeof(krb5_principal), &code);
-        if (delegated == NULL)
-            goto cleanup;
-
-        for (i = 0; i < count; i++) {
-            code = k5_internalize_principal(&delegatedi, &bp, &remain);
-            if (code != 0)
-                goto cleanup;
-        }
-
-        delegatedi = NULL;
-    }
-
-    code = krb5_ser_unpack_int32(&ibuf, &bp, &remain);
-    if (code != 0)
-        goto cleanup;
-
-    s4u2proxy_free_internal(kcontext, context,
-                            plugin_context, request_context,
-                            s4uctx->delegated);
-
-    s4uctx->count = count;
-    s4uctx->delegated = delegated;
-    s4uctx->authenticated = (ibuf != 0);
-
-    delegated = NULL;
-
-    *buffer = bp;
-    *lenremain = remain;
-
-cleanup:
-    s4u2proxy_free_internal(kcontext, context,
-                            plugin_context, request_context,
-                            delegated);
-
-    return code;
-}
-
-static krb5_error_code
-s4u2proxy_copy(krb5_context kcontext,
-               krb5_authdata_context context,
-               void *plugin_context,
-               void *request_context,
-               void *dst_plugin_context,
-               void *dst_request_context)
-{
-    struct s4u2proxy_context *srcctx = (struct s4u2proxy_context *)request_context;
-    struct s4u2proxy_context *dstctx = (struct s4u2proxy_context *)dst_request_context;
-    krb5_error_code code;
-
-    code = s4u2proxy_export_internal(kcontext, context,
-                                     plugin_context, request_context,
-                                     FALSE, (void **)&dstctx->delegated);
-    if (code != 0 && code != ENOENT)
-        return code;
-
-    dstctx->count = srcctx->count;
-    dstctx->authenticated = srcctx->authenticated;
-
-    return 0;
-}
-
-static krb5_authdatatype s4u2proxy_ad_types = { KRB5_AUTHDATA_SIGNTICKET, 0 };
-
-krb5plugin_authdata_client_ftable_v0 k5_s4u2proxy_ad_client_ftable = {
-    "constrained-delegation",
-    s4u2proxy_ad_types,
-    s4u2proxy_init,
-    s4u2proxy_fini,
-    s4u2proxy_flags,
-    s4u2proxy_request_init,
-    s4u2proxy_request_fini,
-    s4u2proxy_get_attribute_types,
-    s4u2proxy_get_attribute,
-    s4u2proxy_set_attribute,
-    NULL, /* delete_attribute_proc */
-    s4u2proxy_export_authdata,
-    s4u2proxy_import_authdata,
-    s4u2proxy_export_internal,
-    s4u2proxy_free_internal,
-    s4u2proxy_verify,
-    s4u2proxy_size,
-    s4u2proxy_externalize,
-    s4u2proxy_internalize,
-    s4u2proxy_copy
-};

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_kdf_constants.c Deleted

@@ -1,59 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* plugins/preauth/pkinit/pkinit_kdf_constants.c */
-/*
- * Copyright (C) 2011 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * pkinit_kdf_test.c -- Structures and constants for implementation of
- * pkinit algorithm agility.  Includes definitions of algorithm identifiers
- * for SHA-1, SHA-256 and SHA-512.
- */
-
-#include "pkinit.h"
-
-/* statically declare OID constants for all three algorithms */
-const krb5_octet krb5_pkinit_sha1_oid8 =
-{0x2B,0x06,0x01,0x05,0x02,0x03,0x06,0x01};
-const size_t krb5_pkinit_sha1_oid_len = 8;
-const krb5_octet krb5_pkinit_sha256_oid8 =
-{0x2B,0x06,0x01,0x05,0x02,0x03,0x06,0x02};
-const size_t krb5_pkinit_sha256_oid_len = 8;
-const krb5_octet krb5_pkinit_sha512_oid 8 =
-{0x2B,0x06,0x01,0x05,0x02,0x03,0x06,0x03};
-const size_t krb5_pkinit_sha512_oid_len = 8;
-
-#define oid_as_data(var, oid_base)                      \
-    const krb5_data var =                               \
-    {0, sizeof oid_base, (char *)oid_base}
-oid_as_data(sha1_id, krb5_pkinit_sha1_oid);
-oid_as_data(sha256_id, krb5_pkinit_sha256_oid);
-oid_as_data(sha512_id, krb5_pkinit_sha512_oid);
-#undef oid_as_data
-
-krb5_data const * const supported_kdf_alg_ids = {
-    &sha256_id,
-    &sha1_id,
-    &sha512_id,
-    NULL
-};

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/Makefile.in Deleted

@@ -1,42 +0,0 @@
-mydir=tests$(S)dejagnu
-BUILDTOP=$(REL)..$(S)..
-RUNTEST = @RUNTEST@ $(DEJAFLAGS)
-RUNTESTFLAGS =
-
-SRCS=$(srcdir)/t_inetd.c
-
-all: t_inetd
-
-install:
-
-check: check-runtest-@HAVE_RUNTEST@
-
-check-runtest-no:
-	@echo "+++"
-	@echo "+++ WARNING: tests/dejagnu tests not run."
-	@echo "+++ runtest is unavailable."
-	@echo "+++"
-	@echo 'Skipped dejagnu tests: runtest not found' >> $(SKIPTESTS)
-
-# Set VALGRIND at run time, that may be changed when running 'make'.
-check-runtest-yes: t_inetd site.exp
-	$(RUNTEST) --tool krb VALGRIND="$(VALGRIND)" $(RUNTESTFLAGS)
-
-t_inetd: t_inetd.o $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o t_inetd t_inetd.o $(KRB5_BASE_LIBS)
-
-clean:
-	$(RM) t_inetd t_inetd.o site.exp runenv.vars runenv.vals
-
-clean-unix::
-	$(RM) -rf tmpdir dbg.log krb.log krb.sum
-
-runenv.vals: Makefile
-	$(RUN_SETUP); for i in $(RUN_VARS); do \
-		eval echo "{$$i=\$$$$i}"; done > runenv.vals
-
-site.exp: runenv.vals Makefile
-	echo "set runvarlist list `cat runenv.vals | tr '\n' ' '`" | \
-		sed -e 's%=\.%='`pwd`'/.%g' > site.exp
-	echo "set PRIOCNTL_HACK @PRIOCNTL_HACK@" >> site.exp
-

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/config Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/config/default.exp Deleted

@@ -1,2094 +0,0 @@
-# Basic expect script for Kerberos tests.
-# This is a DejaGnu test script.
-# Written by Ian Lance Taylor, Cygnus Support, <ian@cygnus.com>.
-# This script is automatically run by DejaGnu before running any of
-# the Kerberos test scripts.
-
-# This file provides several functions which deal with a local
-# Kerberos database.  We have to do this such that we don't interfere
-# with any existing Kerberos database.  We will create all the files
-# in the directory $tmppwd, which will have been created by the
-# testsuite default script.  We will use $REALMNAME as our Kerberos
-# realm name, defaulting to KRBTEST.COM.
-
-set timeout 100
-set stty_init {erase \^h kill \^u}
-set env(TERM) dumb
-
-set des3_krbtgt 0
-
-if { string length $VALGRIND } {
-    rename spawn valgrind_aux_spawn
-    proc spawn { args } {
-	global VALGRIND
-	upvar 1 spawn_id spawn_id
-	set newargs {}
-	set inflags 1
-	set eatnext 0
-	foreach arg $args {
-	    if { $arg == "-ignore" \
-		     || $arg == "-open" \
-		     || $arg == "-leaveopen" } {
-		lappend newargs $arg
-		set eatnext 1
-		continue
-	    }
-	    if string match "-*" $arg {
-		lappend newargs $arg
-		continue
-	    }
-	    if { $eatnext } {
-		set eatnext 0
-		lappend newargs $arg
-		continue
-	    }
-	    if { $inflags } {
-		set inflags 0
-		# Only run valgrind for local programs, not
-		# system ones.
-#&&!string match "/bin/sh" $arg sh is used to start kadmind!
-		if string match "/" string index $arg 0&&!string match "/bin/ls" $arg&&!regexp {/kshd$} $arg {
-		    set newargs concat $newargs $VALGRIND
-		}
-	    }
-	    lappend newargs $arg
-	}
-	set pid eval valgrind_aux_spawn $newargs
-	return $pid
-    }
-}
-
-# Hack around Solaris 9 kernel race condition that causes last output
-# from a pty to get dropped.
-if { $PRIOCNTL_HACK } {
-    catch {exec priocntl -s -c FX -m 30 -p 30 -i pid getpid}
-    rename spawn oldspawn
-    proc spawn { args } {
-	upvar 1 spawn_id spawn_id
-	set newargs {}
-	set inflags 1
-	set eatnext 0
-	foreach arg $args {
-	    if { $arg == "-ignore" \
-		     || $arg == "-open" \
-		     || $arg == "-leaveopen" } {
-		lappend newargs $arg
-		set eatnext 1
-		continue
-	    }
-	    if string match "-*" $arg {
-		lappend newargs $arg
-		continue
-	    }
-	    if { $eatnext } {
-		set eatnext 0
-		lappend newargs $arg
-		continue
-	    }
-	    if { $inflags } {
-		set inflags 0
-		set newargs concat $newargs {priocntl -e -c FX -p 0}
-	    }
-	    lappend newargs $arg
-	}
-	set pid eval oldspawn $newargs
-	return $pid
-    }
-}
-
-# The names of the individual passes must be unique; lots of things
-# depend on it.  The PASSES variable may not contain comments; only
-# small pieces get evaluated, so comments will do strange things.
-
-# Most of the purpose of using multiple passes is to exercise the
-# dependency of various bugs on configuration file settings,
-# particularly with regards to encryption types.
-
-set passes {
-    {
-	des3
-	mode=udp
-	des3_krbtgt=1
-	{supported_enctypes=des3-cbc-sha1:normal}
-	{dummy=verbose -log "DES3 TGT, DES3 enctype"}
-    }
-    {
-	aes-only
-	mode=udp
-	des3_krbtgt=0
-	{supported_enctypes=aes256-cts-hmac-sha1-96:normal}
-	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96}
-	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96}
-	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96}
-	{allow_weak_crypto(kdc)=false}
-	{allow_weak_crypto(replica)=false}
-	{allow_weak_crypto(client)=false}
-	{allow_weak_crypto(server)=false}
-	{master_key_type=aes256-cts-hmac-sha1-96}
-	{dummy=verbose -log "AES enctypes"}
-    }
-    {
-	aes-sha2-only
-	mode=udp
-	des3_krbtgt=0
-	{supported_enctypes=aes256-sha2:normal}
-	{permitted_enctypes(kdc)=aes256-sha2}
-	{permitted_enctypes(replica)=aes256-sha2}
-	{permitted_enctypes(client)=aes256-sha2}
-	{permitted_enctypes(server)=aes256-sha2}
-	{allow_weak_crypto(kdc)=false}
-	{allow_weak_crypto(replica)=false}
-	{allow_weak_crypto(client)=false}
-	{allow_weak_crypto(server)=false}
-	{master_key_type=aes256-sha2}
-	{dummy=verbose -log "aes256-sha2 enctype"}
-    }
-    {
-	camellia-only
-	mode=udp
-	des3_krbtgt=0
-	{supported_enctypes=camellia256-cts:normal}
-	{permitted_enctypes(kdc)=camellia256-cts}
-	{permitted_enctypes(replica)=camellia256-cts}
-	{permitted_enctypes(client)=camellia256-cts}
-	{permitted_enctypes(server)=camellia256-cts}
-	{allow_weak_crypto(kdc)=false}
-	{allow_weak_crypto(replica)=false}
-	{allow_weak_crypto(client)=false}
-	{allow_weak_crypto(server)=false}
-	{master_key_type=camellia256-cts}
-	{dummy=verbose -log "Camellia-256 enctype"}
-    }
-    {
-	aes-des3
-	mode=udp
-	des3_krbtgt=0
-	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
-	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-	{master_key_type=aes256-cts-hmac-sha1-96}
-	{dummy=verbose -log "AES + DES3 + DES enctypes"}
-    }
-    {
-	aes-des3tgt
-	mode=udp
-	des3_krbtgt=1
-	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
-	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-	{master_key_type=aes256-cts-hmac-sha1-96}
-	{dummy=verbose -log "AES enctypes, DES3 TGT"}
-    }
-    {
-	all-enctypes
-	mode=udp
-	des3_krbtgt=0
-	{allow_weak_crypto(kdc)=false}
-	{allow_weak_crypto(replica)=false}
-	{allow_weak_crypto(client)=false}
-	{allow_weak_crypto(server)=false}
-	{dummy=verbose -log "all default enctypes"}
-    }
-}
-
-# This shouldn't be necessary on dejagnu-1.4 and later, but 1.3 seems
-# to need it because its runtest.exp doesn't deal with PASS at all.
-if info exists PASS {
-    foreach pass $passes {
-	if { lsearch -exact $PASS lindex $pass 0 >= 0 } {
-	    lappend MULTIPASS $pass
-	}
-    }
-} else {
-    set MULTIPASS $passes
-}
-
-set last_passname_conf ""
-set last_passname_db ""
-
-# We do everything in a temporary directory.
-if !info exists TMPDIR {
-    set tmppwd "pwd/tmpdir"
-    if !file isdirectory $tmppwd {
-	catch "exec mkdir $tmppwd" status
-    }
-} else {
-    set tmppwd $TMPDIR
-}
-verbose "tmppwd=$tmppwd"
-
-# On Ultrix, use /bin/sh5 in preference to /bin/sh.
-if !info exists BINSH {
-    if file exists /bin/sh5 {
-	set BINSH /bin/sh5
-    } else {
-	set BINSH /bin/sh
-    }
-}
-
-# For security, we must not use generally known passwords.  This is
-# because some of the tests may be run as root.  If the passwords were
-# generally know, then somebody could work out the appropriate
-# Kerberos ticket to use, and come in when, say, the telnetd daemon
-# was being tested by root.  The window for doing this is very very
-# small, so the password does not have to be perfect, it just can't be
-# constant.
-if !info exists KEY {
-    catch {exec $BINSH -c "echo $$"} KEY
-    verbose "KEY is $KEY"
-    set keyfile open $tmppwd/KEY w
-    puts $keyfile "$KEY"
-    close $keyfile
-}
-
-# Clear away any files left over from a previous run.
-# We can't use them now because we don't know the right KEY.
-# krb5.conf might change if running tests on another host
-file delete $tmppwd/krb5.conf $tmppwd/kdc.conf $tmppwd/replica.conf \
-    $tmppwd/krb5.client.conf $tmppwd/krb5.server.conf \
-    $tmppwd/krb5.kdc.conf $tmppwd/krb5.replica.conf
-
-proc delete_db {} {
-    global tmppwd
-    # Master and replica db files
-    file delete $tmppwd/kdc-db $tmppwd/kdc-db.ok $tmppwd/kdc-db.kadm5 \
-	$tmppwd/kdc-db.kadm5.lock $tmppwd/kdc-db.mdb $tmppwd/kdc-db.mdb-lock \
-	$tmppwd/kdc-db.lockout.mdb $tmppwd/kdc-db.lockout.mdb-lock \
-	$tmppwd/kdc-db.ulog \
-	$tmppwd/replica-db $tmppwd/replica-db.ok $tmppwd/replica-db.kadm5 $tmppwd/replica-db.kadm5.lock \
-	$tmppwd/replica-db~ $tmppwd/replica-db~.ok $tmppwd/replica-db~.kadm5 $tmppwd/replica-db~.kadm5.lock
-    # Creating a new database invalidates the keytab and ccache.
-    file delete $tmppwd/keytab $tmppwd/tkt
-}
-
-delete_db
-
-# Put the installed kerberos directories on PATH.
-# This needs to be fixed for V5.
-# set env(PATH) $env(PATH):/usr/kerberos/bin:/usr/kerberos/etc
-# verbose "PATH=$env(PATH)"
-
-# Some of the tests expect $env(USER) to be set.
-if !info exists env(USER) {
-    if info exists env(LOGNAME) {
-	set env(USER) $env(LOGNAME)
-    } else {
-	if info exists logname {
-	    set env(USER) $logname
-	} else {
-	    catch "exec whoami" env(USER)
-	}
-    }
-}
-
-# set the realm. The user can override this on the runtest line.
-if !info exists REALMNAME {
-    set REALMNAME "KRBTEST.COM"
-}
-verbose "Test realm is $REALMNAME"
-
-# Find some programs we need.  We use the binaries from the build tree
-# if they exist.  If they do not, then they must be in PATH.  We
-# expect $objdir to be ...tests/dejagnu.
-
-foreach i {
-    {KDB5_UTIL $objdir/../../kadmin/dbutil/kdb5_util}
-    {KRB5KDC $objdir/../../kdc/krb5kdc}
-    {KADMIND $objdir/../../kadmin/server/kadmind}
-    {KADMIN $objdir/../../kadmin/cli/kadmin}
-    {KADMIN_LOCAL $objdir/../../kadmin/cli/kadmin.local}
-    {KINIT $objdir/../../clients/kinit/kinit}
-    {KTUTIL $objdir/../../kadmin/ktutil/ktutil}
-    {KLIST $objdir/../../clients/klist/klist}
-    {KDESTROY $objdir/../../clients/kdestroy/kdestroy}
-    {T_INETD $objdir/t_inetd}
-    {KPROPLOG $objdir/../../kprop/kproplog}
-    {KPASSWD $objdir/../../clients/kpasswd/kpasswd}
-    {KPROPD $objdir/../../kprop/kpropd}
-    {KPROP $objdir/../../kprop/kprop}
-} {
-    set varname lindex $i 0
-    if !info exists $varname {
-	eval set varval lindex $i 1
-	set varval findfile $varval
-	set $varname $varval
-	verbose "$varname=$varval"
-    } {
-	eval set varval \$$varname
-	verbose "$varname already set to $varval"
-    }
-}
-
-verbose "setting up onexit handler (old handler=exit -onexit)"
-exit -onexit concat {
-    verbose "calling stop_kerberos_daemons (onexit handler)"
-    stop_kerberos_daemons;
-} exit -onexit
-
-# run_once
-
-# Many tests are independent of the actual enctypes used, which is
-# what our passes are (currently) all about.  Use this to prevent
-# multiple invocations.  If a test depends on, say, the master key
-# type but nothing else, you could also use the master key type in the
-# tag name, and avoid redundant tests in additional passes using the
-# same master key type.
-
-proc run_once { tag body } {
-    global run_once_tags
-    if !info exists run_once_tags($tag) {
-	set run_once_tags($tag) 1
-	uplevel 1 $body
-    }
-}
-
-# check_exit_status
-# Check the exit status of a spawned program (using the caller's value
-# of spawn_id).  Returns 1 if the program succeeded, 0 if it failed.
-
-proc check_exit_status { testname } {
-    upvar 1 spawn_id spawn_id
-
-    verbose "about to wait ($testname)"
-    set status_list wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $status_list ($testname)"
-    catch "close -i $spawn_id"
-    if { lindex $status_list 2 != 0 || lindex $status_list 3 != 0 } {
-	verbose -log "exit status: $status_list"
-	fail "$testname"
-	return 0
-    } else {
-	return 1
-    }
-}
-
-#
-# ENVSTACK
-#
-
-# These procedures implement an environment variable stack.  They use
-# the global variable $envvars_tosave for the purpose of identifying
-# which environment variables to save.  They also track which ones are
-# unset at any particular point.  The stack pointer is $envstackp,
-# which is an integer.  The arrays $envstack$envstackp and
-# $unenvstack$envstackp store respectively the set of old environment
-# variables/values pushed onto the stack and the set of old unset
-# environment variables for a given value of $envstackp.
-
-# Changing the value of $envvars_tosave after performing the first
-# push operation may result in strangeness.
-
-#
-# envstack_push
-#
-# Push set of current environment variables.
-#
-proc envstack_push { } {
-    global env
-    global envvars_tosave
-    global envstackp
-    global envstack$envstackp
-    global unenvstack$envstackp
-
-    verbose "envstack_push: starting, sp=$envstackp"
-    foreach i $envvars_tosave {
-	if info exists env($i) {
-	    verbose "envstack_push: saving $i=$env($i)"
-	    set envstack${envstackp}($i) $env($i)
-	} {
-	    verbose "envstack_push: marking $i as unset"
-	    set unenvstack${envstackp}($i) unset
-	}
-    }
-    incr envstackp
-    verbose "envstack_push: exiting, sp=$envstackp"
-}
-
-#
-# envstack_pop
-#
-# Pop set of current environment variables.
-#
-proc envstack_pop { } {
-    global env
-    global envstackp
-
-    verbose "envstack_pop: starting, sp=$envstackp"
-    incr envstackp -1
-    global envstack$envstackp	# YUCK!!! no obvious better way though...
-    global unenvstack$envstackp
-    if {$envstackp < 0} {
-	perror "envstack_pop: stack underflow!"
-	return
-    }
-    if info exists envstack$envstackp {
-	foreach i array names envstack$envstackp {
-	    if info exists env($i) {
-		verbose "envstack_pop: $i was $env($i)"
-	    }
-	    eval set env($i) \$envstack${envstackp}($i)
-	    verbose "envstack_pop: restored $i to $env($i)"
-	}
-	unset envstack$envstackp
-    }
-    if info exists unenvstack$envstackp {
-	foreach i array names unenvstack$envstackp {
-	    if info exists env($i) {
-		verbose "envstack_pop: $i was $env($i)"
-		unset env($i)
-		verbose "envstack_pop: $i unset"
-	    } {
-		verbose "envstack_pop: ignoring already unset $i"
-	    }
-	}
-	unset unenvstack$envstackp
-    }
-    verbose "envstack_pop: exiting, sp=$envstackp"
-}
-
-#
-# Initialize the envstack
-#
-set envvars_tosave {
-    KRB5_CONFIG KRB5CCNAME KRB5_CLIENT_KTNAME KRB5RCACHEDIR KRB5_KDC_PROFILE
-    GSS_MECH_CONFIG
-}
-set krb5_init_vars list 
-# XXX -- fix me later!
-foreach i $runvarlist {
-    verbose "processing $i"
-    if {regexp "^(\^=\*)=(.*)" $i foo evar evalue} {
-	verbose "adding $evar to savelist"
-	lappend envvars_tosave $evar
-	verbose "savelist $envvars_tosave"
-	lappend krb5_init_vars $i
-    }
-    # Make sure we don't get confused by translated messages
-    # or localized times.
-    lappend envvars_tosave "LC_ALL"
-    lappend krb5_init_vars "LC_ALL=C"
-}
-set envstackp 0
-envstack_push
-
-# setup_runtime_flags
-# Sets the proper flags for shared libraries. 
-# Configuration is through a site.exp and the runvarlist variable
-# Returns 1 if variables were already set, otherwise 0
-proc setup_runtime_env { } {
-    global env
-    global krb5_init_vars
-
-    # Set the variables
-    foreach i $krb5_init_vars {
-	regexp "^(\^=\*)=(.*)" $i foo evar evalue
-	set env($evar) "$evalue"
-	verbose "$evar=$evalue"
-    }
-    return 0
-}
-
-# get_hostname
-# This procedure sets the global variable hostname to the local
-# hostname as seen by krb5_sname_to_principal.  Returns 1 on success,
-# 0 on failure.
-
-proc get_hostname { } {
-    global hostname
-    global tmppwd
-
-    if {info exists hostname} {
-	return 1
-    }
-
-    envstack_push
-    setup_runtime_env
-    catch "exec hostname >$tmppwd/hostname" exec_output
-    envstack_pop
-    if !string match "" $exec_output {
-	verbose -log $exec_output
-	perror "can't get hostname"
-	return 0
-    }
-    set file open $tmppwd/hostname r
-    if {  gets $file hostname  == -1 } {
-	perror "no output from hostname"
-	return 0
-    }
-    close $file
-    file delete $tmppwd/hostname
-
-    set hostname string tolower $hostname
-
-    return 1
-}
-
-# modify_principal name options...
-
-proc modify_principal { name args } {
-    global KADMIN_LOCAL
-    global REALMNAME
-
-    envstack_push
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    envstack_pop
-    expect_after {
-	eof {
-	    fail "modprinc (kadmin.local)"
-	    return 0
-	}
-	timeout {
-	    fail "modprinc (kadmin.local)"
-	    return 0
-	}
-    }
-    expect "kadmin.local: "
-    send "modprinc $args $name\r"
-    expect -re "modprinc \^\n\r\* $name"
-    expect -re "Principal .* modified."
-    send "quit\r"
-    expect eof
-    catch expect_after
-    if !check_exit_status "kadmin.local modprinc" {
-	perror "kadmin.local modprinc exited abnormally"
-    }
-    return 1
-}
-
-# kdc listens on +0..+3, depending whether we're testing reachable or not
-# client tries +1 and +6
-# kadmind +4
-# kpasswd +5
-# (nothing) +6
-# application servers (krlogind, telnetd, krshd, ftpd, etc) +8
-# iprop +9 (if enabled)
-# kpropd +10
-if info exists PORTBASE {
-    set portbase $PORTBASE
-} else {
-    set portbase 3085
-}
-
-set ulog 0
-
-# setup_kerberos_files
-# This procedure will create some Kerberos files which must be created
-# manually before trying to run any Kerberos programs.  Returns 1 on
-# success, 0 on failure.
-
-proc setup_kerberos_files { } {
-    global REALMNAME
-    global hostname
-    global tmppwd
-    global supported_enctypes
-    global last_passname_conf
-    global multipass_name
-    global master_key_type
-    global mode
-    global portbase
-    global ulog
-
-    if !get_hostname { 
-	return 0
-    }
-
-    setup_krb5_conf client
-    setup_krb5_conf server
-    setup_krb5_conf kdc
-    setup_krb5_conf replica
-
-    # Create a kdc.conf file.
-    if { !file exists $tmppwd/kdc.conf \
-	    || $last_passname_conf != $multipass_name } {
-	set conffile open $tmppwd/kdc.conf w
-	puts $conffile "\kdcdefaults\"
-	puts $conffile "	kdc_listen = $portbase,expr 1 + $portbase,expr 2 + $portbase"
-	puts $conffile "	kdc_tcp_listen = $portbase,expr 1 + $portbase,expr 2 + $portbase"
-	puts $conffile ""
-	puts $conffile "\realms\"
-	puts $conffile "	$REALMNAME = \{"
-	# Testing with a colon in the name exercises default handling
-	# for pathnames.
-	puts $conffile "		key_stash_file = $tmppwd/stash:foo"
-	puts $conffile "		acl_file = $tmppwd/acl"
-	puts $conffile "		kadmind_port = expr 4 + $portbase"
-	puts $conffile "		kpasswd_port = expr 5 + $portbase"
-	puts $conffile "		max_life = 1:00:00"
-	puts $conffile "		max_renewable_life = 3:00:00"
-	if info exists master_key_type {
-	    puts $conffile "		master_key_type = $master_key_type"
-	}
-	puts $conffile "		master_key_name = master/key"
-	if info exists supported_enctypes {
-	    puts $conffile "		supported_enctypes = $supported_enctypes"
-	}
-	if { $mode == "tcp" } {
-	    puts $conffile "		kdc_listen = expr 3 + $portbase"
-	    puts $conffile "		kdc_tcp_listen = expr 1 + $portbase,expr 3 + $portbase"
-	} else {
-	    puts $conffile "		kdc_listen = expr 1 + $portbase"
-	    puts $conffile "		kdc_tcp_listen = expr 3 + $portbase"
-	}
-	puts $conffile "		default_principal_expiration = 2037.12.31.23.59.59"
-	puts $conffile "		default_principal_flags = -postdateable forwardable"
-	puts $conffile "		dict_file = $tmppwd/dictfile"
-	if { $ulog != 0 } {
-	    puts $conffile "		iprop_enable = true"
-	    puts $conffile "		iprop_port = expr 9 + $portbase"
-	    puts $conffile "		iprop_logfile = $tmppwd/db.ulog"
-	} else {
-	    puts $conffile "# no ulog"
-	}
-	puts $conffile "	\}"
-	puts $conffile ""
-	close $conffile
-    }
-
-    # Create a config file for the replica KDC (kpropd only, no normal
-    # KDC processes).
-    if { !file exists $tmppwd/replica.conf \
-	    || $last_passname_conf != $multipass_name } {
-	set conffile open $tmppwd/replica.conf w
-	puts $conffile "\kdcdefaults\"
-	puts $conffile "	kdc_listen = $portbase,expr 1 + $portbase,expr 2 + $portbase"
-	puts $conffile "	kdc_tcp_listen = $portbase,expr 1 + $portbase,expr 2 + $portbase"
-	puts $conffile ""
-	puts $conffile "\realms\"
-	puts $conffile "	$REALMNAME = \{"
-	# Testing with a colon in the name exercises default handling
-	# for pathnames.
-	puts $conffile "		key_stash_file = $tmppwd/replica-stash"
-	puts $conffile "		acl_file = $tmppwd/replica-acl"
-	puts $conffile "		kadmind_port = expr 4 + $portbase"
-	puts $conffile "		kpasswd_port = expr 5 + $portbase"
-	puts $conffile "		max_life = 1:00:00"
-	puts $conffile "		max_renewable_life = 3:00:00"
-	if info exists master_key_type {
-	    puts $conffile "		master_key_type = $master_key_type"
-	}
-	puts $conffile "		master_key_name = master/key"
-	if info exists supported_enctypes {
-	    puts $conffile "		supported_enctypes = $supported_enctypes"
-	}
-	if { $mode == "tcp" } {
-	    puts $conffile "		kdc_listen = expr 3 + $portbase"
-	    puts $conffile "		kdc_tcp_listen = expr 1 + $portbase,expr 3 + $portbase"
-	} else {
-	    puts $conffile "		kdc_listen = expr 1 + $portbase"
-	    puts $conffile "		kdc_tcp_listen = expr 3 + $portbase"
-	}
-	puts $conffile "		default_principal_expiration = 2037.12.31.23.59.59"
-	puts $conffile "		default_principal_flags = -postdateable forwardable"
-	puts $conffile "		dict_file = $tmppwd/dictfile"
-	if { $ulog != 0 } {
-	    puts $conffile "		iprop_enable = true"
-	    puts $conffile "		iprop_port = expr 9 + $portbase"
-	    puts $conffile "		iprop_logfile = $tmppwd/replica-db.ulog"
-	} else {
-	    puts $conffile "# no ulog"
-	}
-	puts $conffile "	\}"
-	puts $conffile ""
-	close $conffile
-    }
-
-    # Create ACL file.
-    set aclfile open $tmppwd/acl w
-    puts $aclfile "krbtest/admin@$REALMNAME *"
-    puts $aclfile "kiprop/$hostname@$REALMNAME p"
-    close $aclfile
-
-    # Create dictfile file.
-    if !file exists $tmppwd/dictfile {
-	set dictfile open $tmppwd/dictfile w
-	puts $dictfile "weak_password"
-	close $dictfile
-    }
-
-    set last_passname_conf $multipass_name
-    return 1
-}
-
-proc reset_kerberos_files { } {
-    global tmppwd
-    file delete $tmppwd/kdc.conf $tmppwd/replica.conf \
-	$tmppwd/krb5.client.conf $tmppwd/krb5.server.conf \
-	$tmppwd/krb5.kdc.conf
-    setup_kerberos_files
-}
-
-proc setup_krb5_conf { {type client} } {
-    global tmppwd
-    global hostname
-    global REALMNAME
-    global last_passname_conf
-    global multipass_name
-    global default_tgs_enctypes
-    global default_tkt_enctypes
-    global permitted_enctypes
-    global allow_weak_crypto
-    global mode
-    global portbase
-    global srcdir
-    global env
-
-    set pkinit_certs findfile "pwd/$srcdir/pkinit-certs" "pwd/$srcdir/pkinit-certs" "$srcdir/pkinit-certs"
-    # Create a krb5.conf file.
-    if { !file exists $tmppwd/krb5.$type.conf \
-	    || $last_passname_conf != $multipass_name } {
-	set conffile open $tmppwd/krb5.$type.conf w
-	puts $conffile "\libdefaults\"
-	puts $conffile "	default_realm = $REALMNAME"
-	puts $conffile "	dns_lookup_kdc = false"
-	puts $conffile "        dns_canonicalize_hostname = fallback"
-	puts $conffile "	qualify_shortname = \"\""
-	if info exists allow_weak_crypto($type) {
-	    puts $conffile "	allow_weak_crypto = $allow_weak_crypto($type)"
-	} else {
-	    puts $conffile "	allow_weak_crypto = true"
-	}
-	puts $conffile "	pkinit_anchors = FILE:$pkinit_certs/ca.pem"
-	if info exists default_tgs_enctypes($type) {
-	    puts $conffile \
-		    "	default_tgs_enctypes = $default_tgs_enctypes($type)"
-	}
-	if info exists default_tkt_enctypes($type) {
-	    puts $conffile \
-		    "	default_tkt_enctypes = $default_tkt_enctypes($type)"
-	}
-	if info exists permitted_enctypes($type) {
-	    puts $conffile \
-		    "	permitted_enctypes = $permitted_enctypes($type)"
-	}
-	if { $mode == "tcp" } {
-	    puts $conffile "	udp_preference_limit = 1"
-	}
-	puts $conffile "	plugin_base_dir = $tmppwd/../../../plugins"
-	puts $conffile ""
-	puts $conffile "\realms\"
-	puts $conffile "	$REALMNAME = \{"
-	# There's probably nothing listening here.  It would be a good
-	# test for the handling of a non-responsive KDC address.  However,
-	# on some systems, like Tru64, we often wind up with the client's
-	# socket bound to this address, causing our request to appear in
-	# our incoming queue as if it were a response, which causes test
-	# failures.  If we were running the client and KDC on different
-	# hosts, this would be okay....
-	#puts $conffile "		kdc = $hostname:expr 6 + $portbase"
-	puts $conffile "		pkinit_identity = FILE:$pkinit_certs/kdc.pem,$pkinit_certs/privkey.pem"
-	puts $conffile "		pkinit_anchors = FILE:$pkinit_certs/ca.pem"
-	puts $conffile "		kdc = $hostname:expr 1 + $portbase"
-	puts $conffile "		admin_server = $hostname:expr 4 + $portbase"
-	puts $conffile "		kpasswd_server = $hostname:expr 5 + $portbase"
-	puts $conffile "		database_module = db"
-	puts $conffile "	\}"
-	puts $conffile ""
-	puts $conffile "\domain_realm\"
-	puts $conffile "	$hostname = $REALMNAME"
-	puts $conffile ""
-	puts $conffile "\logging\"
-	puts $conffile "	admin_server = FILE:$tmppwd/kadmind5.log"
-	puts $conffile "	kdc = FILE:$tmppwd/kdc.log"
-	puts $conffile "	default = FILE:$tmppwd/others.log"
-	puts $conffile ""
-	puts $conffile "\dbmodules\"
-	puts $conffile "	db_module_dir = $tmppwd/../../../plugins/kdb"
-	puts $conffile "	db = {"
-	if info exists env(K5TEST_LMDB) {
-	    puts $conffile "		db_library = klmdb"
-	    puts $conffile "		nosync = true"
-	} else {
-	    puts $conffile "		db_library = db2"
-	}
-	puts $conffile "		database_name = $tmppwd/$type-db"
-	puts $conffile "	}"
-	close $conffile
-    }
-}
-
-# Save the original values of the environment variables we are going
-# to muck with.
-
-# XXX deal with envstack later.
-
-if info exists env(KRB5_CONFIG) {
-    set orig_krb5_conf $env(KRB5_CONFIG)
-} else {
-    catch "unset orig_krb5_config"
-}
-
-if info exists env(KRB5CCNAME) {
-    set orig_krb5ccname $env(KRB5CCNAME)
-} else {
-    catch "unset orig_krb5ccname"
-}
-
-if info exists env(KRB5_CLIENT_KTNAME) {
-    set orig_krb5clientktname $env(KRB5_CLIENT_KTNAME)
-} else {
-    catch "unset orig_krb5clientktname"
-}
-
-if  info exists env(KRB5RCACHEDIR) {
-    set orig_krb5rcachedir $env(KRB5RCACHEDIR)
-} else {
-    catch "unset orig_krb5rcachedir"
-}
-
-if  info exists env(GSS_MECH_CONFIG) {
-    set orig_gss_mech_config $env(GSS_MECH_CONFIG)
-} else {
-    catch "unset orig_gss_mech_config"
-}
-
-# setup_kerberos_env
-# Set the environment variables needed to run Kerberos programs.
-
-proc setup_kerberos_env { {type client} } {
-    global REALMNAME
-    global env
-    global tmppwd
-    global hostname
-    global krb5_init_vars
-    global portbase
-
-    # Set the environment variable KRB5_CONFIG to point to our krb5.conf file.
-    # All the Kerberos tools check KRB5_CONFIG.
-    # Actually, V5 doesn't currently use this.
-    set env(KRB5_CONFIG) $tmppwd/krb5.$type.conf
-    verbose "KRB5_CONFIG=$env(KRB5_CONFIG)"
-
-    # Direct the Kerberos programs at a local ticket file.
-    set env(KRB5CCNAME) $tmppwd/tkt
-    verbose "KRB5CCNAME=$env(KRB5CCNAME)"
-
-    # Direct the Kerberos programs at a local client keytab.
-    set env(KRB5_CLIENT_KTNAME) $tmppwd/client_keytab
-    verbose "KRB5_CLIENT_KTNAME=$env(KRB5_CLIENT_KTNAME)"
-
-    # Direct the Kerberos server at a cache file stored in the
-    # temporary directory.
-    set env(KRB5RCACHEDIR) $tmppwd
-    verbose "KRB5RCACHEDIR=$env(KRB5RCACHEDIR)"
-
-    # Direct the GSS library at a nonexistent file in the temporary
-    # directory, to avoid interference from system configuration.
-    set env(GSS_MECH_CONFIG) $tmppwd/mech.conf
-    verbose "GSS_MECH_CONFIG=$env(GSS_MECH_CONFIG)"
-
-    # Get the run time environment variables... (including LD_LIBRARY_PATH)
-    setup_runtime_env
-
-    # Set our kdc config file, if needed.
-    switch $type {
-	client	-
-	server	{ catch {unset env(KRB5_KDC_PROFILE)} }
-	kdc	{ set env(KRB5_KDC_PROFILE) $tmppwd/kdc.conf }
-	replica	{ set env(KRB5_KDC_PROFILE) $tmppwd/replica.conf }
-	default	{ error "unknown config file type $type" }
-    }
-    if info exists env(KRB5_KDC_PROFILE) {
-	verbose "KRB5_KDC_PROFILE=$env(KRB5_KDC_PROFILE)"
-    }
-
-    # Create an environment setup script.  (For convenience)
-    if !file exists $tmppwd/$type-env.sh {
-	set envfile open $tmppwd/$type-env.sh w
-	puts $envfile "KRB5_CONFIG=$env(KRB5_CONFIG)"
-	puts $envfile "KRB5CCNAME=$env(KRB5CCNAME)"
-	puts $envfile "KRB5_CLIENT_KTNAME=$env(KRB5_CLIENT_KTNAME)"
-	puts $envfile "KRB5RCACHEDIR=$env(KRB5RCACHEDIR)"
-	puts $envfile "GSS_MECH_CONFIG=$env(GSS_MECH_CONFIG)"
-	if info exists env(KRB5_KDC_PROFILE) {
-	    puts $envfile "KRB5_KDC_PROFILE=$env(KRB5_KDC_PROFILE)"
-	} else {
-	    puts $envfile "unset KRB5_KDC_PROFILE"
-	}
-	puts $envfile "export KRB5_CONFIG KRB5CCNAME KRB5RCACHEDIR"
-	puts $envfile "export KRB5_KDC_PROFILE KRB5_CLIENT_KTNAME"
-	puts $envfile "export GSS_MECH_CONFIG"
-	foreach i $krb5_init_vars {
-		regexp "^(\^=\*)=(.*)" $i foo evar evalue
-		puts $envfile "$evar=$env($evar)"
-		puts $envfile "export $evar"
-	}
-	close $envfile
-    }
-    if !file exists $tmppwd/$type-env.csh {
-	set envfile open $tmppwd/$type-env.csh w
-	puts $envfile "setenv KRB5_CONFIG $env(KRB5_CONFIG)"
-	puts $envfile "setenv KRB5CCNAME $env(KRB5CCNAME)"
-	puts $envfile "setenv KRB5_CLIENT_KTNAME $env(KRB5_CLIENT_KTNAME)"
-	puts $envfile "setenv KRB5RCACHEDIR $env(KRB5RCACHEDIR)"
-	puts $envfile "setenv GSS_MECH_CONFIG $env(GSS_MECH_CONFIG)"
-	if info exists env(KRB5_KDC_PROFILE) {
-	    puts $envfile "setenv KRB5_KDC_PROFILE $env(KRB5_KDC_PROFILE)"
-	} else {
-	    puts $envfile "unsetenv KRB5_KDC_PROFILE"
-	}
-	foreach i $krb5_init_vars {
-		regexp "^(\^=\*)=(.*)" $i foo evar evalue
-		puts $envfile "setenv $evar $env($evar)"
-	}
-	close $envfile
-    }
-    return 1
-}
-
-# setup_kerberos_db
-# Initialize the Kerberos database.  If the argument is non-zero, call
-# pass at relevant points.  Returns 1 on success, 0 on failure.
-
-proc setup_kerberos_db { standalone } {
-    global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY
-    global tmppwd hostname
-    global spawn_id
-    global des3_krbtgt
-    global multipass_name last_passname_db
-
-    set failall 0
-
-    if {!$standalone && file exists $tmppwd/kdc-db.ok \
-	&& $last_passname_db == $multipass_name} {
-	return 1
-    }
-
-    delete_db
-
-    envstack_push
-    if { !setup_kerberos_files || !setup_kerberos_env kdc } {
-	set failall 1
-    }
-
-    # Set up a common expect_after for use in multiple places.
-    set def_exp_after {
-	timeout {
-	    set test "$test (timeout)"
-	    break
-	}
-	eof {
-	    set test "$test (eof)"
-	    break
-	}
-    }
-
-    set test "kdb5_util create"
-    set body {
-	if $failall {
-	    break
-	}
-	#exec xterm
-	verbose "starting $test"
-	spawn $KDB5_UTIL -r $REALMNAME create -W
-	expect_after $def_exp_after
-
-	expect "Enter KDC database master key:"
-
-	set test "kdb5_util create (verify)"
-	send "masterkey$KEY\r"
-	expect "Re-enter KDC database master key to verify:"
-
-	set test "kdb5_util create"
-	send "masterkey$KEY\r"
-	expect {
-	    -re "\Cc\ouldn't" {
-		expect eof
-		break
-	    }
-	    "Cannot find/read stored" exp_continue
-	    "Warning: proceeding without master key" exp_continue
-	    eof { }
-	}
-	catch expect_after
-	if !check_exit_status kdb5_util {
-	    break
-	}
-    }
-    set ret catch $body
-    catch expect_after
-    if $ret {
-	set failall 1
-	if $standalone {
-	    fail $test
-	}
-    } else {
-	if $standalone {
-	    pass $test
-	}
-    }
-
-    # Stash the master key in a file.
-    set test "kdb5_util stash"
-    set body {
-	if $failall {
-	    break
-	}
-	spawn $KDB5_UTIL  -r $REALMNAME stash
-	verbose "starting $test"
-	expect_after $def_exp_after
-	expect "Enter KDC database master key:"
-	send "masterkey$KEY\r"
-	expect eof
-	catch expect_after
-	if !check_exit_status kdb5_util {
-	    break
-	}
-    }
-    set ret catch $body
-    catch "expect eof"
-    catch expect_after
-    if $ret {
-	set failall 1
-	if $standalone {
-	    fail $test
-	} else {
-	    delete_db
-	}
-    } else {
-	if $standalone {
-	    pass $test
-	}
-    }
-
-    # Add an admin user.
-    set test "kadmin.local ank krbtest/admin"
-    set body {
-	if $failall {
-	    break
-	}
-	spawn $KADMIN_LOCAL -r $REALMNAME
-	verbose "starting $test"
-	expect_after $def_exp_after
-
-	expect "kadmin.local: "
-	send "ank krbtest/admin@$REALMNAME\r"
-	# It echos...
-	expect "ank krbtest/admin@$REALMNAME\r"
-	expect "Enter password for principal \"krbtest/admin@$REALMNAME\":"
-	send "adminpass$KEY\r"
-	expect "Re-enter password for principal \"krbtest/admin@$REALMNAME\":"
-	send "adminpass$KEY\r"
-	expect {
-	    "Principal \"krbtest/admin@$REALMNAME\" created" { }
-	    "Principal or policy already exists while creating*" { }
-	}
-	expect "kadmin.local: "
-	send "quit\r"
-	expect eof
-	catch expect_after
-	if !check_exit_status kadmin_local {
-	    break
-	}
-    }
-    set ret catch $body
-    catch "expect eof"
-    catch expect_after
-    if $ret {
-	set failall 1
-	if $standalone {
-	    fail $test
-	} else {
-	    delete_db
-	}
-    } else {
-	if $standalone {
-	    pass $test
-	}
-    }
-
-    # Add an incremental-propagation service.
-    set test "kadmin.local ank krbtest/fast"
-    set body {
-	if $failall {
-	    break
-	}
-	spawn $KADMIN_LOCAL -r $REALMNAME
-	verbose "starting $test"
-	expect_after $def_exp_after
-
-	expect "kadmin.local: "
-	send "ank +requires_preauth krbtest/fast@$REALMNAME\r"
-	expect "Enter password for principal \"krbtest/fast@$REALMNAME\":"
-	send "adminpass$KEY\r"
-	expect "Re-enter password for principal \"krbtest/fast@$REALMNAME\":"
-	send "adminpass$KEY\r"
-	expect {
-	    "Principal \"krbtest/fast@$REALMNAME\" created" { }
-	    "Principal or policy already exists while creating*" { }
-	}
-	expect "kadmin.local: "
-	send "quit\r"
-	expect eof
-	catch expect_after
-	if !check_exit_status kadmin_local {
-	    break
-	}
-    }
-    set ret catch $body
-    catch "expect eof"
-    catch expect_after
-    if $ret {
-	set failall 1
-	if $standalone {
-	    fail $test
-	} else {
-	    delete_db
-	}
-    } else {
-	if $standalone {
-	    pass $test
-	}
-    }
-
-    if $des3_krbtgt {
-	# Set the TGT key to DES3.
-	set test "kadmin.local TGT to DES3"
-	set body {
-	    if $failall {
-		break
-	    }
-	    spawn $KADMIN_LOCAL -r $REALMNAME -e des3-cbc-sha1:normal
-	    verbose "starting $test"
-	    expect_after $def_exp_after
-
-	    expect "kadmin.local: "
-	    send "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r"
-	    # It echos...
-	    expect "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r"
-	    expect {
-		"Key for \"krbtgt/$REALMNAME@$REALMNAME\" randomized." { }
-	    }
-	    expect "kadmin.local: "
-	    send "quit\r"
-	    expect eof
-	    catch expect_after
-	    if !check_exit_status kadmin_local {
-		break
-	    }
-	}
-	set ret catch $body
-	catch "expect eof"
-	catch expect_after
-	if $ret {
-	    set failall 1
-	    if $standalone {
-		fail $test
-	    } else {
-		delete_db
-	    }
-	} else {
-	    if $standalone {
-		pass $test
-	    }
-	}
-    }
-    envstack_pop
-
-    # create the admin database lock file
-    catch "exec touch $tmppwd/adb.lock"
-
-    set last_passname_db $multipass_name
-    return 1
-}
-
-# setup_replica_db
-# Initialize the replica Kerberos database.  Returns 1 on success, 0 on
-# failure.
-
-proc setup_replica_db { } {
-    global REALMNAME
-    global KDB5_UTIL
-    global KADMIN_LOCAL
-    global KEY
-    global tmppwd
-    global spawn_id
-
-    set failall 0
-
-    envstack_push
-    if { !setup_kerberos_files || !setup_kerberos_env replica } {
-	set failall 1
-    }
-
-    # Set up a common expect_after for use in multiple places.
-    set def_exp_after {
-	timeout {
-	    set test "$test (timeout)"
-	    break
-	}
-	eof {
-	    set test "$test (eof)"
-	    break
-	}
-    }
-
-    set test "replica kdb5_util create "
-    set body {
-	if $failall {
-	    break
-	}
-	#exec xterm
-	verbose "starting $test"
-	spawn $KDB5_UTIL -r $REALMNAME create -W
-	expect_after $def_exp_after
-
-	expect "Enter KDC database master key:"
-
-	set test "replica kdb5_util create (verify)"
-	send "masterkey$KEY\r"
-	expect "Re-enter KDC database master key to verify:"
-
-	set test "replica kdb5_util create"
-	send "masterkey$KEY\r"
-	expect {
-	    -re "\Cc\ouldn't" {
-		expect eof
-		break
-	    }
-	    "Cannot find/read stored" exp_continue
-	    "Warning: proceeding without master key" exp_continue
-	    eof { }
-	}
-	catch expect_after
-	if !check_exit_status kdb5_util {
-	    break
-	}
-    }
-    set ret catch $body
-    catch expect_after
-    if $ret {
-	set failall 1
-    }
-
-    # Stash the master key in a file.
-    set test "replica kdb5_util stash"
-    set body {
-	if $failall {
-	    break
-	}
-	spawn $KDB5_UTIL  -r $REALMNAME stash
-	verbose "starting $test"
-	expect_after $def_exp_after
-	expect "Enter KDC database master key:"
-	send "masterkey$KEY\r"
-	expect eof
-	catch expect_after
-	if !check_exit_status kdb5_util {
-	    break
-	}
-    }
-    set ret catch $body
-    catch "expect eof"
-    catch expect_after
-    if $ret {
-	set failall 1
-	delete_db
-    }
-
-    if !$failall {
-	# create the admin database lock file
-	catch "exec touch $tmppwd/replica-adb.lock"
-    }
-
-    return expr !$failall
-}
-
-proc start_kpropd {} {
-    global kpropd_pid kpropd_spawn_id KPROPD T_INETD KDB5_UTIL portbase tmppwd
-    global spawn_id
-
-    envstack_push
-    setup_kerberos_env replica
-    spawn $KPROPD -S -d -t -P expr 10 + $portbase -s $tmppwd/keytab -f $tmppwd/incoming-replica-datatrans -p $KDB5_UTIL -a $tmppwd/kpropd-acl
-    set kpropd_pid exp_pid
-    set kpropd_spawn_id $spawn_id
-    envstack_pop
-}
-
-# start_kerberos_daemons
-# A procedure to build a Kerberos database and start up the kerberos
-# and kadmind daemons.  This sets the global variables kdc_pid,
-# kdc_spawn_id, kadmind_pid, and kadmind_spawn_id.  The procedure
-# stop_kerberos_daemons should be used to stop the daemons.  If the
-# argument is non-zero, call pass at relevant points.  Returns 1 on
-# success, 0 on failure.
-
-proc start_kerberos_daemons { standalone } {
-    global REALMNAME
-    global KRB5KDC
-    global KADMIND
-    global KEY
-    global kdc_pid
-    global kdc_spawn_id
-    global kadmind_pid
-    global kadmind_spawn_id
-    global tmppwd
-    global env
-    global timeout
-
-    if !setup_kerberos_db 0 {
-	return 0
-    }
-
-    if {$standalone} {
-        file delete $tmppwd/krb.log $tmppwd/kadmind.log $tmppwd/krb5kdc_rcache
-    }
-
-    # Start up the kerberos daemon
-    # Why are we doing all this with the log file you may ask.
-    #   We need a handle on when the server starts. If we log the output
-    #   of the server to say stderr, then if we stop looking for output,
-    #   buffers will fill and the server will stop working....
-    #   So, we look to see when a line is added to the log file and then
-    #   check it..
-    # The same thing is done a little later for the kadmind
-    set kdc_lfile $tmppwd/kdc.log
-    set kadmind_lfile $tmppwd/kadmind5.log
-    set kdc_pidfile $tmppwd/kdc.pid
-    set kadmind_pidfile $tmppwd/kadmind.pid
-
-    envstack_push
-    setup_kerberos_env kdc
-    # Nuke pid file - to test if setup
-    file delete $kdc_pidfile
-    spawn $KRB5KDC -r $REALMNAME -n -P $kdc_pidfile
-    envstack_pop
-    set kdc_pid exp_pid
-    set kdc_spawn_id $spawn_id
-
-    expect {
-	"starting" { }
-	eof {
-	    if {$standalone} {
-		verbose -log "krb5kdc failed to start"
-		fail "krb5kdc"
-	    } else {
-		perror "krb5kdc failed to start"
-	    }
-	    stop_kerberos_daemons
-	    return 0
-	}
-    }
-
-    if (!file exists $kdc_pidfile) {
-	fail "krb5kdc pidfile"
-	stop_kerberos_daemons
-	return 0
-    }
-    set f open $kdc_pidfile "r"
-    if {gets $f foundpid < 0 || !string equal $kdc_pid $foundpid} {
-	fail "krb5kdc pid file contents"
-	close $f
-	stop_kerberos_daemons
-	return 0
-    }
-    close $f
-
-    if {$standalone} {
-	pass "krb5kdc"
-    }
-
-    # Give the kerberos daemon a few seconds to get set up.
-#    sleep 2
-
-    #
-    # Save setting of KRB5_KTNAME. We do not want to override kdc.conf
-    # file during kadmind startup. (this is in case user has KRB5_KTNAME
-    # set before starting make check)
-    #
-    if info exists env(KRB5_KTNAME) {
-	set start_save_ktname $env(KRB5_KTNAME)
-    }
-    catch "unset env(KRB5_KTNAME)"
-
-    # Start up the kadmind daemon
-    envstack_push
-    setup_kerberos_env kdc
-    file delete $kadmind_pidfile
-    spawn $KADMIND -r $REALMNAME -W -nofork -P $kadmind_pidfile
-    envstack_pop
-    set kadmind_pid exp_pid
-    set kadmind_spawn_id $spawn_id
-
-    # Restore KRB5_KTNAME
-    if info exists start_save_ktname {
-        set env(KRB5_KTNAME) $start_save_ktname
-        unset start_save_ktname
-    }
-
-    expect {
-	"Seeding random number" exp_continue
-	"No principal in keytab matches desired name" {
-	    dump_db
-	    exp_continue
-	}
-	"starting" { }
-	eof {
-	    verbose -log "kadmind failed to start"
-	    if {$standalone} {
-		fail "kadmind"
-	    } else {
-		perror "kadmind failed to start"
-	    }
-	    stop_kerberos_daemons
-	    return 0
-	}
-    }
-
-    if (!file exists $kadmind_pidfile) {
-	fail "kadmind pidfile"
-	stop_kerberos_daemons
-	return 0
-    }
-    set f open $kadmind_pidfile "r"
-    if {gets $f foundpid < 0 || !string equal $kadmind_pid $foundpid} {
-	fail "kadmind pid file contents"
-	close $f
-	stop_kerberos_daemons
-	return 0
-    }
-    close $f
-
-    if {$standalone} {
-	pass "kadmind"
-    }
-
-    # Give the kadmind daemon a few seconds to get set up.
-#    sleep 2
-
-    return 1
-}
-
-# stop_kerberos_daemons
-# Stop the kerberos daemons.  Returns 1 on success, 0 on failure.
-
-proc stop_kerberos_daemons { } {
-    global kdc_pid
-    global kdc_spawn_id
-    global kadmind_pid
-    global kadmind_spawn_id
-
-    verbose "entered stop_kerberos_daemons"
-
-    if info exists kdc_pid {
-	if catch "exec kill $kdc_pid" msg {
-	    verbose "kill kdc: $msg"
-	}
-	if catch "expect -i $kdc_spawn_id eof" msg {
-	    verbose "expect kdc eof: $msg"
-	}
-	set kdc_list wait -i $kdc_spawn_id
-	verbose "wait -i $kdc_spawn_id returned $kdc_list (kdc)"
-	unset kdc_pid
-	unset kdc_list
-    }
-
-    if info exists kadmind_pid {
-	if catch "exec kill $kadmind_pid" msg {
-	    verbose "kill kadmind: $msg"
-	}
-	if catch "expect -i $kadmind_spawn_id eof" msg {
-	    verbose "expect kadmind eof: $msg"
-	}
-	set kadmind_list wait -i $kadmind_spawn_id
-	verbose "wait -i $kadmind_spawn_id returned $kadmind_list (kadmind5)"
-	unset kadmind_pid
-	unset kadmind_list
-    }
-
-    verbose "exiting stop_kerberos_daemons"
-
-    return 1
-}
-
-# add_kerberos_key
-# Add an key to the Kerberos database.  start_kerberos_daemons must be
-# called before this procedure.  If the standalone argument is
-# non-zero, call pass at relevant points.  Returns 1 on success, 0 on
-# failure.
-
-proc add_kerberos_key { kkey standalone } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    # Use kadmin to add an key.
-    set test "kadmin ank $kkey"
-    set body {
-	envstack_push
-	setup_kerberos_env client
-	spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank $kkey@$REALMNAME"
-	envstack_pop
-	verbose "starting $test"
-	expect_after {
-	    "Cannot contact any KDC" {
-		set test "$test (lost KDC)"
-		break
-	    }
-	    timeout {
-		set test "$test (timeout)"
-		break
-	    }
-	    eof {
-		set test "$test (eof)"
-		break
-	    }
-	}
-	expect -re "assword\^\r\n\*: *"
-	send "adminpass$KEY\r"
-	expect "Enter password for principal \"$kkey@$REALMNAME\":"
-	send "$kkey"
-	send "$KEY\r"
-	expect "Re-enter password for principal \"$kkey@$REALMNAME\":"
-	send "$kkey"
-	send "$KEY\r"
-	expect {
-	    "Principal \"$kkey@$REALMNAME\" created" { }
-	    "Principal or policy already exists while creating*" { }
-	}
-	expect eof
-	if !check_exit_status kadmin {
-	    break
-	}
-    }
-    set ret catch $body
-    catch "expect eof"
-    catch expect_after
-    if $ret {
-	if $standalone {
-	    fail $test
-	}
-	return 0
-    } else {
-	if $standalone {
-	    pass $test
-	}
-	return 1
-    }
-}
-
-# dump_db
-proc dump_db { } {
-    global KADMIN_LOCAL
-    global REALMNAME
-
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    expect_after {
-	eof {
-	    perror "failed to get debugging dump of database (eof)"
-	}
-	timeout {
-	    perror "failed to get debugging dump of database (timeout)"
-	}
-    }
-    expect "kadmin.local: "
-    send "getprincs\r"
-    expect "kadmin.local: "
-    send "quit\r"
-    expect eof
-    catch expect_after
-}
-
-# add_random_key
-# Add a key with a random password to the Kerberos database.
-# start_kerberos_daemons must be called before this procedure.  If the
-# standalone argument is non-zero, call pass at relevant points.
-# Returns 1 on success, 0 on failure.
-
-proc add_random_key { kkey standalone } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    # Use kadmin to add an key.
-    set test "kadmin ark $kkey"
-    set body {
-	envstack_push
-	setup_kerberos_env client
-	spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank -randkey $kkey@$REALMNAME"
-	envstack_pop
-	expect_after {
-	    timeout {
-		set test "$test (timeout)"
-		break
-	    }
-	    eof {
-		set test "$test (eof)"
-		break
-	    }
-	}
-	expect -re "assword\^\r\n\*: *"
-	send "adminpass$KEY\r"
-	expect {
-	    "Principal \"$kkey@$REALMNAME\" created" { }
-	    "Principal or policy already exists while creating*" { }
-	}
-	expect eof
-	if !check_exit_status kadmin {
-	    break
-	}
-    }
-    if catch $body {
-	catch expect_after
-	if $standalone {
-	    fail $test
-	}
-	return 0
-    } else {
-	catch expect_after
-	if $standalone {
-	    pass $test
-	}
-	return 1
-    }
-}
-
-# setup_keytab
-# Set up a keytab file.  start_kerberos_daemons and add_random_key
-# $id/$hostname must be called before this procedure.  If the
-# argument is non-zero, call pass at relevant points.  Returns 1 on
-# success, 0 on failure. If the id field is not provided, host is used.
-
-proc setup_keytab { standalone {id host} } {
-    global REALMNAME
-    global KADMIN_LOCAL
-    global KEY
-    global tmppwd
-    global hostname
-    global spawn_id
-    global last_service
-
-    if {!$standalone && file exists $tmppwd/keytab && $last_service == $id} {
-	return 1
-    }
-
-    file delete $tmppwd/keytab $tmppwd/keytab.old
-
-    if !get_hostname {
-	return 0
-    }
-
-    file delete $hostname-new-keytab
-
-    envstack_push
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    envstack_pop
-    expect_after {
-	-re "(.*)\r\nkadmin.local:  " {
-	    fail "kadmin.local keytab (unmatched output: $expect_out(1,string))"
-	    if {!$standalone} {
-		file delete $tmppwd/keytab
-	    }
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin.local keytab"
-	    if {!$standalone} {
-		file delete $tmppwd/keytab
-	    }
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin.local keytab"
-	    if {!$standalone} {
-		file delete $tmppwd/keytab
-	    }
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect "kadmin.local:  "
-    send "xst -k $hostname-new-keytab $id/$hostname kiprop/$hostname\r"
-    expect "xst -k $hostname-new-keytab $id/$hostname kiprop/$hostname\r\n"
-    expect {
-	-re ".*Entry for principal $id/$hostname.* added to keytab WRFILE:$hostname-new-keytab." { }
-	-re "\r\nkadmin.local:  " {
-	    if {$standalone} {
-		fail "kadmin.local keytab"
-	    } else {
-		file delete $tmppwd/keytab
-	    }
-	    catch expect_after
-	    return 0
-	}
-    }
-    expect "kadmin.local:  "
-    send "quit\r"
-    expect eof
-    catch expect_after
-    if !check_exit_status "kadmin.local keytab" {
-	if {!$standalone} {
-	    file delete $tmppwd/keytab
-	}
-	return 0
-    }
-
-    catch "exec mv -f $hostname-new-keytab $tmppwd/keytab" exec_output
-    if !string match "" $exec_output {
-	verbose -log "$exec_output"
-	perror "can't mv new keytab"
-	return 0
-    }
-
-    if {$standalone} {
-	pass "kadmin.local keytab"
-    }
-
-    # Make the keytab file globally readable in case we are using a
-    # root shell and the keytab is NFS mounted.
-    catch "exec chmod a+r $tmppwd/keytab"
-
-    # Remember what we just extracted
-    set last_service $id
-
-    return 1
-}
-
-# kinit
-# Use kinit to get a ticket.  If the argument is non-zero, call pass
-# at relevant points.  Returns 1 on success, 0 on failure.
-
-proc kinit { name pass standalone } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-
-    # Use kinit to get a ticket.
-	#
-	# For now always get forwardable tickets. Later when we need to make
-	# tests that distinguish between forwardable tickets and otherwise
-	# we should but another option to this proc. --proven
-	#
-    spawn $KINIT -5 -f $name@$REALMNAME
-    expect {
-	"Password for $name@$REALMNAME:" {
-	    verbose "kinit started"
-	}
-	timeout {
-	    fail "kinit"
-	    return 0
-	}
-	eof {
-	    fail "kinit"
-	    return 0
-	}
-    }
-    send "$pass\r"
-    expect eof
-    if !check_exit_status kinit {
-	return 0
-    }
-
-    if {$standalone} {
-	pass "kinit"
-    }
-
-    return 1
-}
-
-proc kinit_renew { name pass standalone } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-
-    spawn $KINIT -5 -f $name@$REALMNAME
-    expect {
-	"Password for $name@$REALMNAME:" {
-	    verbose "kinit started"
-	}
-	timeout {
-	    fail "kinit"
-	    return 0
-	}
-	eof {
-	    fail "kinit"
-	    return 0
-	}
-    }
-    send "$pass\r"
-    expect eof
-    if !check_exit_status kinit {
-	return 0
-    }
-
-    spawn $KINIT -R
-    expect eof
-    if !check_exit_status "kinit_renew" {
-	return 0
-    }
-
-    return 1
-}
-
-# Retrieve a ticket using FAST armor
-proc kinit_fast { name pass standalone } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-    global env
-
-    # Use kinit to get a ticket.
-	#
-    spawn $KINIT -5 -f -T $env(KRB5CCNAME) $name@$REALMNAME
-    expect {
-	"Password for $name@$REALMNAME:" {
-	    verbose "kinit started"
-	}
-	timeout {
-	    fail "kinit_fast"
-	    return 0
-	}
-	eof {
-	    fail "kinit_fast"
-	    return 0
-	}
-    }
-    send "$pass\r"
-    expect eof
-    if !check_exit_status kinit {
-	return 0
-    }
-
-    if {$standalone} {
-	pass "kinit_fast"
-    }
-
-    return 1
-}
-
-proc kinit_anonymous { name  } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-
-    # Use kinit to get a ticket.
-    #
-    spawn $KINIT -5 -f -n $name@$REALMNAME
-    expect {
-	"Password for $name@$REALMNAME:" {
-	    fail "kinit_anonymous (password requested)"
-	    return 0
-	}
-	timeout {
-	    fail "kinit_anonymous (timeout)"
-	    return 0
-	}
-	eof { }
-    }
-    if !check_exit_status kinit {
-	fail "kinit anonymous"
-    }
-
-    pass "kinit anonymous"
-    return 1
-}
-
-proc kinit_kt { name keytab standalone testname } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-
-    # Use kinit to get a ticket.
-	#
-	# For now always get forwardable tickets. Later when we need to make
-	# tests that distinguish between forwardable tickets and otherwise
-	# we should but another option to this proc. --proven
-	#
-    spawn $KINIT -5 -f -k -t $keytab $name@$REALMNAME
-    expect {
-	timeout {
-	    fail "kinit $testname"
-	    return 0
-	}
-	eof { }
-    }
-    if !check_exit_status "kinit $testname" {
-	return 0
-    }
-
-    if {$standalone} {
-	pass "kinit $testname"
-    }
-
-    return 1
-}
-
-# List tickets.  Requires client and server names, and test name.
-# Checks that klist exist status is zero.
-# Records pass or fail, and returns 1 or 0.
-proc do_klist { myname servname testname } {
-    global KLIST
-    global tmppwd
-
-    spawn $KLIST -5 -e
-    expect {
-	-re "Ticket cache:\ 	\*(.+:)?$tmppwd/tkt.*Default principal:\ 	\*$myname.*$servname\r\n" {
-	    verbose "klist started"
-	}
-	timeout {
-	    fail $testname
-	    return 0
-	}
-	eof {
-	    fail $testname
-	    return 0
-	}
-    }
-
-    expect eof
-
-    if !check_exit_status $testname {
-	return 0
-    }
-    pass $testname
-    return 1
-}
-
-proc do_klist_kt { keytab testname } {
-    global KLIST
-    global tmppwd
-
-    spawn $KLIST -5 -e -k $keytab
-    expect {
-	-re "Keytab name:\ 	\*(.+:)?.*KVNO Principal\r\n---- -*\r\n" {
-	    verbose "klist started"
-	}
-	timeout {
-	    fail $testname
-	    return 0
-	}
-	eof {
-	    fail $testname
-	    return 0
-	}
-    }
-    set more 1
-    while {$more} {
-	expect {
-	    -re { *0-90-9* *a-zA-Z/@.-* $/a-zA-Z 0-9-*$ *\r\n} {
-		verbose -log "key: $expect_out(buffer)"
-	    }
-	    eof { set more 0 }
-	}
-    }
-
-    if !check_exit_status $testname {
-	return 0
-    }
-    pass $testname
-    return 1
-}
-
-proc do_klist_err { testname } {
-    global KLIST
-    global spawn_id
-
-    spawn $KLIST -5
-    # Might say "credentials cache" or "credentials cache file".
-    expect {
-	-re "klist: No credentials cache found.*\r\n" {
-	    verbose "klist started"
-	}
-	timeout {
-	    fail $testname
-	    return 0
-	}
-	eof {
-	    fail $testname
-	    return 0
-	}
-    }
-    # We can't use check_exit_status, because we expect an exit status
-    # of 1.
-    catch "expect eof"
-    set status_list wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $status_list ($testname)"
-    if { lindex $status_list 2 != 0 } {
-	fail "$testname (bad exit status) $status_list"
-	return 0
-    } else { if { lindex $status_list 3 != 1 } {
-	fail "$testname (bad exit status) $status_list"
-	return 0
-    } else {
-	pass $testname
-    } }
-    return 1
-}
-
-proc do_kdestroy { testname } {
-    global KDESTROY
-    global spawn_id
-
-    spawn $KDESTROY -5
-    if !check_exit_status $testname {
-	fail $testname
-	return 0
-    }
-    pass $testname
-    return 1
-}
-
-proc xst { keytab name } {
-    global KADMIN_LOCAL
-    global REALMNAME
-
-    envstack_push
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    envstack_pop
-    catch expect_after
-    expect_after {
-	-re "(.*)\r\nkadmin.local:  " {
-	    fail "kadmin.local xst $keytab (unmatched output: $expect_out(1,string)"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin.local xst $keytab (timeout)"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin.local xst $keytab (eof)"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect "kadmin.local:  "
-    send "xst -k $keytab $name\r"
-    expect -re "xst -k \^\r\n\*\r\n.*Entry for principal .* added to keytab WRFILE:.*\r\nkadmin.local:  "
-    send "quit\r"
-    expect eof
-    catch expect_after
-    if !check_exit_status "kadmin.local $keytab" {
-	perror "kadmin.local xst $keytab exited abnormally"
-	return 0
-    }
-    return 1
-}
-
-# helpful sometimes for debugging the test suite
-proc export_debug_envvars { } {
-    global env
-    foreach i {KDB5_UTIL KRB5KDC KADMIND KADMIN KADMIN_LOCAL KINIT KTUTIL KLIST KPASSWD REALMNAME GSSCLIENT KPROPLOG} {
-	global $i
-	if info exists $i { set env($i) set $i }
-    }
-}
-proc spawn_xterm { } {
-    export_debug_envvars
-    exec "xterm"
-}
-proc spawn_shell { } {
-    export_debug_envvars
-    spawn "sh"
-    exp_interact
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/deps Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/gssapi.exp Deleted

@@ -1,332 +0,0 @@
-# Test for the GSS-API.
-# This is a DejaGnu test script.
-# This script tests that the GSS-API tester functions correctly.
-
-# This mostly just calls procedures in test/dejagnu/config/default.exp.
-
-if !info exists KDESTROY {
-    set KDESTROY findfile $objdir/../../clients/kdestroy/kdestroy
-}
-
-if !info exists GSSCLIENT {
-    set GSSCLIENT findfile $objdir/../../appl/gss-sample/gss-client
-}
-
-if !info exists GSSSERVER {
-    set GSSSERVER findfile $objdir/../../appl/gss-sample/gss-server
-}
-
-# Set up the Kerberos files and environment.
-if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-    return
-}
-
-# Initialize the Kerberos database.  The argument tells
-# setup_kerberos_db that it is being called from here.
-if !setup_kerberos_db 0 {
-    return
-}
-
-#
-# Like kinit in default.exp, but allows us to specify a different ccache.
-#
-proc our_kinit { name pass ccache } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-
-    # Use kinit to get a ticket.
-    spawn $KINIT -f -5 -c $ccache $name@$REALMNAME
-    expect {
-	"Password for $name@$REALMNAME:" {
-	    verbose "kinit started"
-	}
-	timeout {
-	    fail "kinit"
-	    return 0
-	}
-	eof {
-	    fail "kinit"
-	    return 0
-	}
-    }
-    send "$pass\r"
-    # This last expect seems useless, but without it the test hangs on
-    # AIX.
-    expect {
-        "\r" { }
-    }
-    expect eof
-    if !check_exit_status kinit {
-	return 0
-    }
-
-    return 1
-}
-
-#
-# Destroys a particular ccache.
-#
-proc our_kdestroy { ccache } {
-    global KDESTROY
-    global spawn_id
-
-    spawn $KDESTROY -c $ccache
-    if !check_exit_status "kdestroy" {
-	return 0
-    }
-    return 1
-}
-
-#
-# Stops the gss-server.
-#
-proc stop_gss_server { } {
-    global gss_server_pid
-    global gss_server_spawn_id
-
-    if info exists gss_server_pid {
-	catch "close -i $gss_server_spawn_id"
-	catch "exec kill $gss_server_pid"
-	wait -i $gss_server_spawn_id
-	unset gss_server_pid
-    }
-}
-
-#
-# Restore environment variables possibly set.
-#
-proc gss_restore_env { } {
-    global env
-    global gss_save_ccname
-    global gss_save_ktname
-
-    catch "unset env(KRB5CCNAME)"
-    if info exists gss_save_ccname {
-	set env(KRB5CCNAME) $gss_save_ccname
-	unset gss_save_ccname
-    }
-    catch "unset env(KRB5_KTNAME)"
-    if info exists gss_save_ktname {
-	set env(KRB5_KTNAME) $gss_save_ktname
-	unset gss_save_ktname
-    }
-}
-
-proc run_client {test tkfile client} {
-    global env
-    global hostname
-    global GSSCLIENT
-    global spawn_id
-    global gss_server_spawn_id
-    global REALMNAME
-    global portbase
-
-    set env(KRB5CCNAME) $tkfile
-    verbose "KRB5CCNAME=$env(KRB5CCNAME)"
-    verbose "spawning gssclient, identity=$client"
-    spawn $GSSCLIENT -d -port expr 8 + $portbase $hostname gssservice@$hostname "message from $client"
-    set got_client 0
-    set got_server 0
-    expect_after {
-	-i $spawn_id
-	timeout {
-	    if {!$got_client} {
-		verbose -log "client timeout"
-		fail $test
-		catch "expect_after"
-		return
-	    }
-	}
-	eof {
-	    if {!$got_client} {
-		verbose -log "client eof"
-		fail $test
-		catch "expect_after"
-		return
-	    }
-	}
-	-i $gss_server_spawn_id
-	timeout {
-	    if {!$got_server} {
-		verbose -log "server timeout"
-		fail $test
-		catch "expect_after"
-		return
-	    }
-	}
-	eof {
-	    if {!$got_server} {
-		verbose -log "server eof"
-		fail $test
-		catch "expect_after"
-		return
-	    }
-	}
-    }
-    expect {
-	-i $gss_server_spawn_id
-	"Accepted connection: \"$client@$REALMNAME\"" exp_continue
-	"Received message: \"message from $client\"" {
-	    set got_server 1
-	    if {!$got_client} {
-		exp_continue
-	    }
-	}
-	-i $spawn_id
-	"Signature verified" {
-	    set got_client 1
-	    if {!$got_server} {
-		exp_continue
-	    }
-	}
-    }
-    catch "expect_after"
-    if !check_exit_status $test {
-	# check_exit_staus already calls fail for us
-	return
-    }
-    pass $test
-}
-
-proc doit { } {
-    global REALMNAME
-    global env
-    global KLIST
-    global KDESTROY
-    global KEY
-    global GSSTEST
-    global GSSSERVER
-    global GSSCLIENT
-    global hostname
-    global tmppwd
-    global spawn_id
-    global timeout
-    global gss_server_pid
-    global gss_server_spawn_id
-    global gss_save_ccname
-    global gss_save_ktname
-    global portbase
-
-    # Start up the kerberos and kadmind daemons.
-    if !start_kerberos_daemons 0 {
-	perror "failed to start kerberos daemons"
-    }
-
-    # Use kadmin to add a key for us.
-    if !add_kerberos_key gsstest0 0 {
-	perror "failed to set up gsstest0 key"
-    }
-
-    # Use kadmin to add a key for us.
-    if !add_kerberos_key gsstest1 0 {
-	perror "failed to set up gsstest1 key"
-    }
-
-    # Use kadmin to add a key for us.
-    if !add_kerberos_key gsstest2 0 {
-	perror "failed to set up gsstest2 key"
-    }
-
-    # Use kadmin to add a key for us.
-    if !add_kerberos_key gsstest3 0 {
-	perror "failed to set up gsstest3 key"
-    }
-
-    # Use kadmin to add a service key for us.
-    if !add_random_key gssservice/$hostname 0 {
-	perror "failed to set up gssservice/$hostname key"
-    }
-
-    # Use kdb5_edit to create a keytab entry for gssservice
-    if !setup_keytab 0 gssservice {
-	perror "failed to set up gssservice keytab"
-    }
-
-    catch "exec rm -f $tmppwd/gss_tk_0 $tmppwd/gss_tk_1 $tmppwd/gss_tk_2 $tmppwd/gss_tk_3"
-
-    # Use kinit to get a ticket.
-    if !our_kinit gsstest0 gsstest0$KEY $tmppwd/gss_tk_0 {
-	perror "failed to kinit gsstest0"
-    }
-
-    # Use kinit to get a ticket.
-    if !our_kinit gsstest1 gsstest1$KEY $tmppwd/gss_tk_1 {
-	perror "failed to kinit gsstest1"
-    }
-
-    # Use kinit to get a ticket.
-    if !our_kinit gsstest2 gsstest2$KEY $tmppwd/gss_tk_2 {
-	perror "failed to kinit gsstest2"
-    }
-
-    # Use kinit to get a ticket.
-    if !our_kinit gsstest3 gsstest3$KEY $tmppwd/gss_tk_3 {
-	perror "failed to kinit gsstest3"
-    }
-
-    #
-    # Save settings of KRB5CCNAME and KRB5_KTNAME
-    #
-    if info exists env(KRB5CCNAME) {
-	set gss_save_ccname $env(KRB5CCNAME)
-    }
-    if info exists env(KRB5_KTNAME) {
-	set gss_save_ktname $env(KRB5_KTNAME)
-    }
-
-    #
-    # set KRB5CCNAME and KRB5_KTNAME
-    #
-    set env(KRB5_KTNAME) FILE:$tmppwd/keytab
-    verbose "KRB5_KTNAME=$env(KRB5_KTNAME)"
-
-    # Now start the gss-server.
-    spawn $GSSSERVER -export -logfile $tmppwd/gss-server.log -verbose -port expr 8 + $portbase gssservice@$hostname
-    set gss_server_pid exp_pid
-    set gss_server_spawn_id $spawn_id
-
-    expect {
-	"starting" { }
-	eof        { perror "gss-server failed to start" }
-    }
-
-    run_client gssclient0 $tmppwd/gss_tk_0 gssclient0
-    run_client gssclient1 $tmppwd/gss_tk_1 gssclient1
-    run_client gssclient2 $tmppwd/gss_tk_2 gssclient2
-    run_client gssclient3 $tmppwd/gss_tk_3 gssclient3
-
-    stop_gss_server
-    gss_restore_env
-
-    if !our_kdestroy $tmppwd/gss_tk_0 {
-	perror "failed kdestroy gss_tk_0" 0
-    }
-
-    if !our_kdestroy $tmppwd/gss_tk_1 {
-	perror "failed kdestroy gss_tk_1" 0
-    }
-
-    if !our_kdestroy $tmppwd/gss_tk_2 {
-	perror "failed kdestroy gss_tk_2" 0
-    }
-
-    if !our_kdestroy $tmppwd/gss_tk_3 {
-	perror "failed kdestroy gss_tk_3" 0
-    }
-
-    catch "exec rm -f $tmppwd/gss_tk_0 $tmppwd/gss_tk_1 $tmppwd/gss_tk_2 $tmppwd/gss_tk_3"
-
-    return
-}
-
-set status catch doit msg
-
-stop_gss_server
-gss_restore_env
-stop_kerberos_daemons
-
-if { $status != 0 } {
-    perror "error in gssapi.exp" 0
-    perror $msg 0
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/kadmin.exp Deleted

@@ -1,1133 +0,0 @@
-# Kerberos kadmin test.
-# This is a DejaGnu test script.
-# This script tests Kerberos kadmin5 using kadmin.local as verification.
-
-#++
-# kadmin_add	- Test add new v5 principal function of kadmin.
-#
-# Adds principal $pname with password $password.  Returns 1 on success.
-#--
-proc kadmin_add { pname password } {
-    global REALMNAME
-    global KADMIN
-    global KADMIN_LOCAL
-    global KEY
-    global spawn_id
-    global tmppwd
-
-    set good 0
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin add $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin add $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin add $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*:" {
-	send "adminpass$KEY\r"
-    }
-    expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
-    expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
-    expect "Principal \"$pname@$REALMNAME\" created." { set good 1 }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin add)"
-    catch "close -i $spawn_id"
-    if { $good == 1 } {
-	#
-	# use kadmin.local to verify that a principal was created and that its
-	# salt types are 0 (normal).
-	#
-	envstack_push
-	setup_kerberos_env kdc
-	spawn $KADMIN_LOCAL -r $REALMNAME
-	envstack_pop
-	expect_after {
-	    -i $spawn_id
-	    timeout {
-		fail "kadmin add $pname"
-		catch "expect_after"
-		return 0
-	    }
-	    eof {
-		fail "kadmin add $pname"
-		catch "expect_after"
-		return 0
-	    }
-	}
-	set good 0
-	expect "kadmin.local: " { send "getprinc $pname\r" }
-	expect "Principal: $pname@$REALMNAME" { set good 1 }
-	expect "Expiration date:" { verbose "got expiration date" }
-	expect "Last password change:" { verbose "got last pwchange" }
-	expect "Password expiration date:" { verbose "got pwexpire date" }
-	expect "Maximum ticket life:" { verbose "got max life" }
-	expect "Maximum renewable life:" { verbose "got max rlife" }
-	expect "Last modified:" { verbose "got last modified" }
-	expect "Last successful authentication:" { verbose "last succ auth" }
-	expect "Last failed authentication:" { verbose "last pw failed" }
-	expect "Failed password attempts:" { verbose "num failed attempts" }
-	expect "Number of keys:" { verbose "num keys"} 
-	expect {
-		"Key: " { verbose "Key listed" 
-			exp_continue
-		}
-		"Attributes:" { verbose "attributes" }
-	}
-	expect "kadmin.local: " { send "q\r" }
-
-	expect_after
-	expect eof
-	set k_stat wait -i $spawn_id
-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
-	catch "close -i $spawn_id"
-	if { $good == 1 } {
-	    pass "kadmin add $pname"
-	    return 1
-	}
-	else {
-	    fail "kadmin add $pname"
-	    return 0
-	}
-    }
-    else {
-	fail "kadmin add $pname"
-	return 0
-    }
-}
-
-#++
-# kadmin_add_rnd	- Test add new v5 principal with random key function.
-#
-# Adds principal $pname with random key.  Returns 1 on success.
-#--
-proc kadmin_add_rnd { pname { flags "" } } {
-    global REALMNAME
-    global KADMIN
-    global KADMIN_LOCAL
-    global KEY
-    global spawn_id
-    global tmppwd
-
-    set good 0
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank -randkey $flags $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin add rnd $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin add_rnd $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin add_rnd $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect "Principal \"$pname@$REALMNAME\" created." { set good 1 }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin add_rnd)"
-    catch "close -i $spawn_id"
-    if { $good == 1 } {
-	#
-	# use kadmin.local to verify that a principal was created and that its
-	# salt types are 0 (normal).
-	#
-	envstack_push
-	setup_kerberos_env kdc
-	spawn $KADMIN_LOCAL -r $REALMNAME
-	envstack_pop
-	expect_after {
-	     -i $spawn_id
-	    timeout {
-		fail "kadmin add_rnd $pname"
-		catch "expect_after"
-		return 0
-	    }
-	    eof {
-		fail "kadmin add_rnd $pname"
-		catch "expect_after"
-		return 0
-	    }
-	}
-	set good 0
-	expect "kadmin.local:" { send "getprinc $pname\r" }
-	expect "Principal: $pname@$REALMNAME" { set good 1 }
-	expect "kadmin.local:" { send "q\r" }
-	expect_after
-	expect eof
-	set k_stat wait -i $spawn_id
-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
-	catch "close -i $spawn_id"
-	if { $good == 1 } {
-	    pass "kadmin add_rnd $pname"
-	    return 1
-	}
-	else {
-	    fail "kadmin add_rnd $pname"
-	    return 0
-	}
-    }
-    else {
-	fail "kadmin add_rnd $pname"
-	return 0
-    }
-}
-
-#++
-# kadmin_show	- Test show principal function of kadmin.
-# 
-# Retrieves entry for $pname.  Returns 1 on success.
-#--
-proc kadmin_show { pname } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principal $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin show $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin show $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin show $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *"
-    send "adminpass$KEY\r"
-    expect -re "\r.*Principal: $pname@$REALMNAME.*Key: .*Attributes:.*Policy: .*\r"
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin show)"
-    catch "close -i $spawn_id"
-    pass "kadmin show $pname"
-    return 1
-}
-
-#++
-# kadmin_cpw	- Test change password function of kadmin
-#
-# Change password of $pname to $password.  Returns 1 on success.
-#--
-proc kadmin_cpw { pname password } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin cpw $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin cpw $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin cpw $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-
-    expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
-    expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
-    # When in doubt, jam one of these in there.
-    expect "\r"
-    expect "Password for \"$pname@$REALMNAME\" changed."
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin cpw)"
-    catch "close -i $spawn_id"
-    pass "kadmin cpw $pname"
-    return 1
-}
-
-#++
-# kadmin_cpw_rnd	- Test change random key function of kadmin.
-#
-# Changes principal $pname's key to a new random key.  Returns 1 on success.
-#--
-proc kadmin_cpw_rnd { pname } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw -randkey $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin cpw_rnd $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin cpw_rnd $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin cpw_rnd $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    # When in doubt, jam one of these in there.
-    expect "\r"
-    expect "Key for \"$pname@$REALMNAME\" randomized."
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin cpw_rnd)"
-    catch "close -i $spawn_id"
-    pass "kadmin cpw_rnd $pname"
-    return 1
-}
-
-#++
-# kadmin_modify	- Test modify principal function of kadmin.
-#
-# Modifies principal $pname with flags $flags.  Returns 1 on success.
-#--
-proc kadmin_modify { pname flags } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modprinc $flags $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin modify $pname ($flags) lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin modify $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin modify $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *"
-    send "adminpass$KEY\r"
-    # When in doubt, jam one of these in there.
-    expect "\r"
-    expect "Principal \"$pname@$REALMNAME\" modified."
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin modify)"
-    catch "close -i $spawn_id"
-    pass "kadmin modify $pname"
-    return 1
-}
-
-
-#++
-# kadmin_list	- Test list database function of kadmin.
-#
-# Lists the database and verifies that output matches regular expression
-# "(.*@$REALMNAME)*".  Returns 1 on success.
-#--
-proc kadmin_list {  } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    # "*" would match everything
-    # "*n" should match a few like kadmin/admin but see ticket 5667
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principals *n"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin ldb lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	"Communication failure" {
-	    fail "kadmin ldb got RPC error"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin ldb"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin ldb"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect -re "$.*@$REALMNAME\r\n$+"
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin list)"
-    catch "close -i $spawn_id"
-    pass "kadmin ldb"
-    return 1
-}
-
-#++
-# kadmin_extract	- Test extract service key function of kadmin.
-#
-# Extracts service key for service name $name instance $instance.  Returns
-# 1 on success.
-#--
-proc kadmin_extract { instance name } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-    global tmppwd
-
-    catch "exec rm -f $tmppwd/keytab"
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "xst -k $tmppwd/keytab $name/$instance"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin xst $instance $name lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin xst $instance $name"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin xst $instance $name"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin xst)"
-    catch "close -i $spawn_id"
-    catch "exec rm -f $instance-new-keytab"
-    pass "kadmin xst $instance $name"
-    return 1
-}
-
-#++
-# kadmin_delete	- Test delete principal function of kadmin.
-#
-# Deletes principal $pname.  Returns 1 on success.
-#--
-proc kadmin_delete { pname } {
-    global REALMNAME
-    global KADMIN
-    global KADMIN_LOCAL
-    global KEY
-    global spawn_id
-    global tmppwd
-
-    set good 0
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin_delete $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin delprinc $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin delprinc $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect "Principal \"$pname@$REALMNAME\" deleted." { set good 1 }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)"
-    catch "close -i $spawn_id"
-    if { $good == 1 } {
-	#
-	# use kadmin.local to verify that the old principal is not present.
-	#
-	envstack_push
-	setup_kerberos_env kdc
-	spawn $KADMIN_LOCAL -r $REALMNAME
-	envstack_pop
-	expect_after {
-	    -i $spawn_id
-	    timeout {
-		fail "kadmin delprinc $pname"
-		catch "expect_after"
-		return 0
-	    }
-	    eof {
-		fail "kadmin delprinc $pname"
-		catch "expect_after"
-		return 0
-	    }
-	}
-	set good 0
-	expect "kadmin.local: " { send "getprinc $pname\r" }
-	expect "Principal does not exist while retrieving \"$pname@$REALMNAME\"." { set good 1 }
-	expect "kadmin.local: " { send "quit\r" }
-	expect_after
-	expect eof
-	set k_stat wait -i $spawn_id
-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
-	catch "close -i $spawn_id"
-	if { $good == 1 } {
-	    pass "kadmin delprinc $pname"
-	    return 1
-	}
-	else {
-	    fail "kadmin delprinc $pname"
-	    return 0
-	}
-    }
-    else {
-	fail "kadmin delprinc $pname"
-	return 0
-    }
-}
-
-#++
-# kadmin_delete	- Test delete principal function of kadmin.
-#
-# Deletes principal $pname.  Returns 1 on success.
-#--
-proc kadmin_delete_locked_down { pname } {
-    global REALMNAME
-    global KADMIN
-    global KADMIN_LOCAL
-    global KEY
-    global spawn_id
-    global tmppwd
-
-    #
-    # First test that we fail, then unlock and retry
-    #
-
-    set good 0
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin_delete $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin delprinc $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin delprinc $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect "delete_principal: Operation requires ``delete'' privilege while deleting principal \"$pname@$REALMNAME\"" { set good 1 }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)"
-    catch "close -i $spawn_id"
-    if { $good == 1 } {
-	#
-	# use kadmin.local to remove lockdown.
-	#
-	envstack_push
-	setup_kerberos_env kdc
-	spawn $KADMIN_LOCAL -r $REALMNAME
-	envstack_pop
-	expect_after {
-	    -i $spawn_id
-	    timeout {
-		fail "kadmin delprinc $pname"
-		catch "expect_after"
-		return 0
-	    }
-	    eof {
-		fail "kadmin delprinc $pname"
-		catch "expect_after"
-		return 0
-	    }
-	}
-	set good 0
-	expect "kadmin.local: " { send "modprinc -lockdown_keys $pname\r" }
-	expect "Principal \"$pname@$REALMNAME\" modified." { set good 1 }
-	expect "kadmin.local: " { send "quit\r" }
-	expect_after
-	expect eof
-	set k_stat wait -i $spawn_id
-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
-	catch "close -i $spawn_id"
-	if { $good == 1 } {
-            set good 0
-            if {kadmin_delete $pname} { set good 1 }
-        }
-	if { $good == 1 } {
-	    pass "kadmin delprinc $pname"
-	    return 1
-	}
-	else {
-	    fail "kadmin delprinc $pname"
-	    return 0
-	}
-    }
-    else {
-	fail "kadmin delprinc $pname"
-	return 0
-    }
-}
-
-#++
-# kpasswd_cpw	- Test password changing using kpasswd.
-#
-# Change $princ's password from $opw to $npw.  Returns 1 on success.
-#--
-proc kpasswd_cpw { princ opw npw } {
-    global KPASSWD
-    global REALMNAME
-
-    spawn $KPASSWD $princ
-    expect_after {
-	timeout {
-	    fail "kpasswd $princ $npw"
-#	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kpasswd $princ $npw"
-#	    catch "expect_after"
-	    return 0
-	}
-    }
-
-#    expect "Changing password for $princ."
-#    expect "Old password:" { send "$opw\r" }
-#    expect "New password:" { send "$npw\r" }
-#    expect "New password (again):" { send "$npw\r" }
-    expect "Password for $princ@$REALMNAME:" { send "$opw\r" }
-    expect "Enter new password:"  { send "$npw\r" }
-    expect "Enter it again:"      { send "$npw\r" }
-#    expect "Kerberos password changed."
-    expect "Password changed."
-    expect_after
-    expect eof
-
-    if !check_exit_status "kpasswd" {
-	fail "kpasswd $princ $npw"
-	return 0
-    }
-    pass "kpasswd $princ $npw"
-    return 1
-}
-
-#++
-# kadmin_addpol	- Test add new policy function of kadmin.
-#
-# Adds policy $pname.  Returns 1 on success.
-#--
-proc kadmin_addpol { pname } {
-    global REALMNAME
-    global KADMIN
-    global KADMIN_LOCAL
-    global KEY
-    global spawn_id
-    global tmppwd
-
-    set good 0
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "addpol $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin addpol $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin addpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin addpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)"
-    catch "close -i $spawn_id"
-    #
-    # use kadmin.local to verify that a policy was created
-    #
-    envstack_push
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    envstack_pop
-    expect_after {
-        -i $spawn_id
-        timeout {
-	    fail "kadmin addpol $pname"
-	    catch "expect_after"
-	    return 0
-        }
-        eof {
-	    fail "kadmin addpol $pname"
-	    catch "expect_after"
-	    return 0
-        }
-    }
-    set good 0
-    expect "kadmin.local: " { send "getpol $pname\r" }
-    expect "Policy: $pname" { set good 1 }
-    expect "Maximum password life:" { verbose "got max pw life" }
-    expect "Minimum password life:" { verbose "got min pw life" }
-    expect "Minimum password length:" { verbose "got min pw length" }
-    expect "Minimum number of password character classes:" {
-        verbose "got min pw character classes" }
-    expect "Number of old keys kept:" { verbose "got num old keys kept" }
-    expect "kadmin.local: " { send "q\r" }
-
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)"
-    catch "close -i $spawn_id"
-    if { $good == 1 } {
-        pass "kadmin addpol $pname"
-        return 1
-    }
-    else {
-        fail "kadmin addpol $pname"
-        return 0
-    }
-}
-
-#++
-# kadmin_delpol	- Test delete policy function of kadmin.
-#
-# Deletes policy $pname.  Returns 1 on success.
-#--
-proc kadmin_delpol { pname } {
-    global REALMNAME
-    global KADMIN
-    global KADMIN_LOCAL
-    global KEY
-    global spawn_id
-    global tmppwd
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delpol -force $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin_delpol $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin delpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin delpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin delpol)"
-    catch "close -i $spawn_id"
-    #
-    # use kadmin.local to verify that the old policy is not present.
-    #
-    envstack_push
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    envstack_pop
-    expect_after {
-        -i $spawn_id
-        timeout {
-	    fail "kadmin delpol $pname"
-	    catch "expect_after"
-	    return 0
-        }
-        eof {
-	    fail "kadmin delpol $pname"
-	    catch "expect_after"
-	    return 0
-        }
-    }
-    set good 0
-    expect "kadmin.local: " { send "getpol $pname\r" }
-    expect "Policy does not exist while retrieving policy \"$pname\"." {
-	set good 1
-    }
-    expect "kadmin.local: " { send "quit\r" }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)"
-    catch "close -i $spawn_id"
-    if { $good == 1 } {
-        pass "kadmin delpol $pname"
-        return 1
-    }
-    else {
-        fail "kadmin delpol $pname"
-        return 0
-    }
-}
-
-#++
-# kadmin_listpols	- Test list policy database function of kadmin.
-#
-# Lists the policies.  Returns 1 on success.
-#--
-proc kadmin_listpols {  } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policies *"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin lpols lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin lpols"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin lpols"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *" {
-	send "adminpass$KEY\r"
-    }
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin listpols)"
-    catch "close -i $spawn_id"
-    pass "kadmin lpols"
-    return 1
-}
-
-#++
-# kadmin_modpol	- Test modify policy function of kadmin.
-#
-# Modifies policy $pname with flags $flags.  Returns 1 on success.
-#--
-proc kadmin_modpol { pname flags } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modpol $flags $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin modpol $pname ($flags) lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin modpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin modpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *"
-    send "adminpass$KEY\r"
-    # When in doubt, jam one of these in there.
-    expect "\r"
-    # Sadly, kadmin doesn't print a confirmation message for policy operations.
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin modpol)"
-    catch "close -i $spawn_id"
-    pass "kadmin modpol $pname"
-    return 1
-}
-
-#++
-# kadmin_showpol	- Test show policy function of kadmin.
-# 
-# Retrieves entry for $pname.  Returns 1 on success.
-#--
-proc kadmin_showpol { pname } {
-    global REALMNAME
-    global KADMIN
-    global KEY
-    global spawn_id
-
-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policy $pname"
-    expect_after {
-	"Cannot contact any KDC" {
-	    fail "kadmin showpol $pname lost KDC"
-	    catch "expect_after"
-	    return 0
-	}
-	timeout {
-	    fail "kadmin showpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-	eof {
-	    fail "kadmin showpol $pname"
-	    catch "expect_after"
-	    return 0
-	}
-    }
-    expect -re "assword\^\r\n\*: *"
-    send "adminpass$KEY\r"
-    expect -re "\r.*Policy: $pname.*Number of old keys kept: .*\r"
-    expect_after
-    expect eof
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin showpol)"
-    catch "close -i $spawn_id"
-    pass "kadmin showpol $pname"
-    return 1
-}
-
-#++
-# kdestroy
-#--
-proc kdestroy { } {
-    global KDESTROY
-
-    spawn $KDESTROY -5
-    if !check_exit_status "kdestroy" {
-	return 0
-    }
-    return 1
-}
-
-# Wrap the tests in a procedure, so that we can kill the daemons if
-# we get some sort of error.
-
-proc kadmin_test { } {
-    global hostname
-
-    # Start up the kerberos and kadmind daemons
-    if {!start_kerberos_daemons 0 } {
-	return
-    }
-
-    # Test basic kadmin functions.
-    if {!kadmin_add v5principal/instance1 v5principal \
-	|| !kadmin_addpol standardpol \
-	|| !kadmin_showpol standardpol \
-	|| !kadmin_listpols \
-	|| !kadmin_modpol standardpol "-minlength 5" \
-	|| !kadmin_add v4principal/instance2 v4principal \
-	|| !kadmin_add_rnd v5random \
-	|| !kadmin_show v5principal/instance1 \
-	|| !kadmin_show v4principal/instance2 \
-	|| !kadmin_show v5random \
-	|| !kadmin_cpw v5principal/instance1 faroutman \
-	|| !kadmin_cpw v4principal/instance2 honkydory \
-	|| !kadmin_cpw_rnd v5random \
-	|| !kadmin_modify v5random -allow_tix \
-	|| !kadmin_modify v5random +allow_tix \
-	|| !kadmin_modify v5random "-policy standardpol" \
-	|| !kadmin_list \
-	|| !kadmin_extract instance1 v5principal \
-	|| !kadmin_delete v5random \
-	|| !kadmin_delete v4principal/instance2 \
-	|| !kadmin_delete v5principal/instance1 \
-	|| !kadmin_delpol standardpol} {
-	return
-    }
-
-# You cannot extract a v4 key...
-#	|| !kadmin_extractv4 instance2 v4principal \
-
-    # now test kpasswd
-    if {!kadmin_add testprinc/instance thisisatest \
-	    || !kpasswd_cpw testprinc/instance thisisatest anothertest \
-	    || !kpasswd_cpw testprinc/instance anothertest goredsox \
-	    || !kadmin_delete testprinc/instance} {
-	return
-    }
-
-    # now test that we can kinit with principals/passwords.
-    # We defer kdestroying until after kpasswd at least once to test FAST automatic use in kpasswd
-    if {!kadmin_add testprinc1/instance thisisatest \
-	    || !kinit testprinc1/instance thisisatest 0 \
-	    || !kpasswd_cpw testprinc1/instance thisisatest anothertest \
-	    || !kdestroy \
-	    || !kinit testprinc1/instance anothertest 0 \
-	    || !kdestroy \
-	    || !kpasswd_cpw testprinc1/instance anothertest goredsox \
-	    || !kinit testprinc1/instance goredsox 0 \
-	    || !kdestroy \
-	    || !kadmin_cpw testprinc1/instance betterwork \
-	    || !kinit testprinc1/instance betterwork 0 \
-	    || !kdestroy \
-	    || !kadmin_delete testprinc1/instance} {
-	return
-    }
-
-    # now test modify changes.
-    if {!kadmin_add testuser longtestpw \
-	    || !kinit testuser longtestpw 0 \
-	    || !kdestroy \
-	    || !kadmin_modify testuser "-maxlife \"2500 seconds\"" \
-	    || !kinit testuser longtestpw 0 \
-	    || !kdestroy \
-	    || !kadmin_delete testuser} {
-	return
-    }
-
-    # now test that reducing the history number doesn't make kadmind vulnerable.
-    if {!kadmin_addpol crashpol \
-	    || !kadmin_modpol crashpol "-history 5" \
-	    || !kadmin_add crash first \
-	    || !kadmin_modify crash "-policy crashpol" \
-	    || !kadmin_cpw crash second \
-	    || !kadmin_cpw crash third \
-	    || !kadmin_cpw crash fourth \
-	    || !kadmin_modpol crashpol "-history 3" \
-	    || !kadmin_cpw crash fifth \
-	    || !kadmin_delete crash \
-	    || !kadmin_delpol crashpol} {
-	return
-    }
-
-    # test retrieval of large number of principals
-    # bug 2877
-    for { set i 0 } { $i < 200 } { incr i } {
-	if { !kadmin_add "foo$i" foopass } {
-	    return
-	}
-    }
-
-    if { !kadmin_list } {
-	return
-    }
-
-    # test fallback to kadmin/hostname
-    if {!kadmin_add_rnd kadmin/$hostname \
-	    || !kadmin_delete_locked_down kadmin/admin \
-	    || !kadmin_list \
-	    || !kadmin_add_rnd kadmin/admin -allow_tgs_req \
-	    || !kadmin_list} {
-	return
-    }
-
-    verbose "kadmin_test succeeded"
-}
-
-run_once kadmin {
-    # Set up the kerberos database.
-    if {!get_hostname \
-	    || !setup_kerberos_files \
-	    || !setup_kerberos_env \
-	    || !setup_kerberos_db 0} {
-	return
-    }
-
-    # Run the test.
-    set status catch kadmin_test msg
-
-    # Shut down the kerberos daemons and the rsh daemon.
-    stop_kerberos_daemons
-
-    if { $status != 0 } {
-	send_error "ERROR: error in kadmin.exp\n"
-	send_error "$msg\n"
-	exit 1
-    }
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/kprop.exp Deleted

@@ -1,158 +0,0 @@
-# Password-changing Kerberos test.
-# This is a DejaGnu test script.
-
-# We are about to start up a couple of daemon processes.  We do all
-# the rest of the tests inside a proc, so that we can easily kill the
-# processes when the procedure ends.
-
-proc setup_replica {} {
-    global tmppwd hostname REALMNAME env
-    file delete $tmppwd/replica-stash $tmppwd/replica-acl
-    file copy -force $tmppwd/stash:foo $tmppwd/replica-stash
-    file copy -force $tmppwd/acl $tmppwd/replica-acl
-    if !file exists $tmppwd/kpropdacl {
-	set aclfile open $tmppwd/kpropd-acl w
-	puts $aclfile "host/$hostname@$REALMNAME"
-	close $aclfile
-    }
-    file copy -force $tmppwd/adb.lock $tmppwd/replica-adb.lock
-    if info exists env(K5TEST_LMDB) {
-	set suffixes { .mdb .mdb-lock .lockout.mdb .lockout.mdb-lock }
-    } else {
-	set suffixes { {} .kadm5 .kadm5.lock .ok }
-    }
-    foreach suffix $suffixes {
-	file copy -force $tmppwd/kdc-db$suffix $tmppwd/replica-db$suffix
-    }
-}
-
-proc scan_kpropd_output {} {
-    global kpropd_spawn_id kpropd_pid
-
-    # See if kpropd logged anything.  It should exit after processing
-    # one kprop connection.
-    expect {
-	-i $kpropd_spawn_id
-	eof {
-	    wait -i $kpropd_spawn_id
-	    unset kpropd_spawn_id kpropd_pid
-	}
-	timeout { }
-	-re "Connection from \a-zA-Z.-\*" { exp_continue }
-	-re "krb5_recvauth" { exp_continue }
-	-re "authenticated client" { exp_continue }
-	-re "calling kdb5_util to load database\r\n" { exp_continue }
-	-re "Child PID is \0-9\*\r\n" { exp_continue }
-	-re "Rejected connection" {
-	    fail "kprop (rejected)"
-	}
-    }
-}
-
-proc doit { } {
-    global KLIST KDESTROY
-    global REALMNAME KEY
-    global KADMIN_LOCAL KTUTIL KDB5_UTIL KPROPLOG KPROP kpropd_spawn_id
-    global hostname tmppwd spawn_id timeout
-    global KRBIV supported_enctypes portbase mode ulog des3_krbtgt
-
-    # Delete any db, ulog files
-    delete_db
-
-    # Initialize the Kerberos database.  The argument tells
-    # setup_kerberos_db that it is being called from here.
-    if !setup_kerberos_db 0 {
-	return
-    }
-    setup_replica
-    if !start_kerberos_daemons 0 {
-	return
-    }
-    if !add_random_key host/$hostname 0 {
-	fail "kprop (host key)"
-	return
-    }
-    if !setup_keytab 0 {
-	fail "kprop (keytab)"
-	return
-    }
-
-    # Get kprop server up and running.
-    envstack_push
-    setup_kerberos_env replica
-    start_kpropd
-    envstack_pop
-
-    # Use kadmin to add a key.
-    if !add_kerberos_key wakawaka 0 {
-	return
-    }
-
-    # Dump primary database.
-    envstack_push
-    setup_kerberos_env kdc
-    spawn $KDB5_UTIL dump $tmppwd/replica_datatrans
-    expect eof
-    if !check_exit_status "kprop (kdb5_util dump)" { return }
-
-    # Just in case kpropd is a little slow in starting up...
-    sleep 1
-
-    # Try a propagation.
-    spawn $KPROP -f $tmppwd/replica_datatrans -P expr 10 + $portbase -s $tmppwd/keytab $hostname
-    expect eof
-    set kprop_exit check_exit_status "kprop (exit status)"
-    # log output for debugging
-    scan_kpropd_output
-    if !$kprop_exit { return }
-
-    # Examine new database.
-    setup_kerberos_env replica
-    spawn $KADMIN_LOCAL -r $REALMNAME -q listprincs
-    expect {
-	wakawaka@ {
-	    expect eof
-	}
-	eof {
-	    fail "kprop (updated replica data)"
-	    return
-	}
-	timeout {
-	    fail "kprop (examining new db)"
-	    return
-	}
-    }
-    pass "kprop"
-}
-
-run_once kprop {
-    catch "unset kpropd_pid"
-    catch "unset kpropd_spawn_id"
-
-    # Set up the Kerberos files and environment.
-    if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-	return
-    }
-
-    set status catch doit msg
-
-    stop_kerberos_daemons
-
-    # if kpropd is running, kill it
-    if info exists kpropd_pid {
-	catch {
-	    exec kill $kpropd_pid
-	    expect -i $kpropd_spawn_id eof
-	    wait -i $kpropd_spawn_id
-	    unset kpropd_pid kpropd_spawn_id
-	}
-    }
-
-    delete_db
-
-    if { $status != 0 } {
-	send_error "ERROR: error in kprop.exp\n"
-	send_error "$msg\n"
-	exit 1
-    }
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/princexpire.exp Deleted

@@ -1,105 +0,0 @@
-proc doit { } {
-    global REALMNAME
-    global KLIST
-    global KINIT
-    global KDESTROY
-    global KEY
-    global KADMIN_LOCAL
-    global KTUTIL
-    global hostname
-    global tmppwd
-    global spawn_id
-    global supported_enctypes
-    global KRBIV
-    global portbase
-    global mode
-
-    set princ "expiredprinc"
-
-    # Start up the kerberos and kadmind daemons.
-    if !start_kerberos_daemons 0 {
-	return 1
-    }
-
-    # Use kadmin to add a key.
-    if !add_kerberos_key $princ 0 {
-	return 1
-    }
-
-    setup_kerberos_env kdc
-
-    set test "kadmin.local modprinc -expire"
-    spawn $KADMIN_LOCAL -q "modprinc -expire \"2 days ago\" $princ"
-    catch expect_after
-    expect {
-	timeout {
-	    fail $test
-	}
-	eof {
-	    pass $test
-	}
-    }
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat ($test)"
-    catch "close -i $spawn_id"
-
-    set test "kadmin.local -pwexpire"
-    spawn $KADMIN_LOCAL -q "modprinc -pwexpire \"2 days ago\" $princ"
-    catch expect_after
-    expect {
-	timeout {
-	    fail $test
-	}
-	eof {
-	    pass $test
-	}
-    }
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat ($test)"
-    catch "close -i $spawn_id"
-
-    setup_kerberos_env client
-    spawn $KINIT -5 -k -t /dev/null $princ
-    expect {
-	"entry in database has expired" {
-	    pass $test
-	}
-	"Password has expired" {
-	    fail "$test (inappropriate password expiration message)"
-	}
-	timeout {
-	    expect eof
-	    fail "$test (timeout)"
-	    return 0
-	}
-	eof {
-	    fail "$test (eof)"
-	    return 0
-	}
-    }
-    expect eof
-    return 0
-}
-
-run_once princexpire {
-    # Set up the Kerberos files and environment.
-    if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-	return
-    }
-    # Initialize the Kerberos database.  The argument tells
-    # setup_kerberos_db that it is not being called from
-    # standalone.exp.
-    if !setup_kerberos_db 0 {
-	return
-    }
-
-    set status catch doit msg
-
-    stop_kerberos_daemons
-
-    if { $status != 0 } {
-	send_error "ERROR: error in pwchange.exp\n"
-	send_error "$msg\n"
-	exit 1
-    }
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/pwchange.exp Deleted

@@ -1,145 +0,0 @@
-# Password-changing Kerberos test.
-# This is a DejaGnu test script.
-
-# We are about to start up a couple of daemon processes.  We do all
-# the rest of the tests inside a proc, so that we can easily kill the
-# processes when the procedure ends.
-
-proc kinit_expecting_pwchange { name pass newpass } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-
-    # Use kinit to get a ticket.
-	#
-	# For now always get forwardable tickets. Later when we need to make
-	# tests that distinguish between forwardable tickets and otherwise
-	# we should but another option to this proc. --proven
-	#
-    spawn $KINIT -5 -f $name@$REALMNAME
-    expect {
-	"Password for $name@$REALMNAME:" {
-	    verbose "kinit started"
-	}
-	timeout {
-	    fail "kinit"
-	    return 0
-	}
-	eof {
-	    fail "kinit"
-	    return 0
-	}
-    }
-    send "$pass\r"
-    expect {
-	"Enter new password: " { }
-	timeout {
-	    fail "kinit (new password prompt)"
-	    return 0
-	}
-	eof {
-	    fail "kinit (new password prompt)"
-	    return 0
-	}
-    }
-    send "$newpass\r"
-    expect {
-	" again: " { }
-	timeout {
-	    fail "kinit (new password prompt2)"
-	    return 0
-	}
-	eof {
-	    fail "kinit (new password prompt2)"
-	    return 0
-	}
-    }
-    send "$newpass\r"
-    expect eof
-    if !check_exit_status kinit {
-	return 0
-    }
-
-    return 1
-}
-
-proc doit { } {
-    global REALMNAME
-    global KLIST
-    global KDESTROY
-    global KEY
-    global KADMIN_LOCAL
-    global KTUTIL
-    global hostname
-    global tmppwd
-    global spawn_id
-    global supported_enctypes
-    global KRBIV
-    global portbase
-    global mode
-
-    # Start up the kerberos and kadmind daemons.
-    if !start_kerberos_daemons 0 {
-	return
-    }
-
-    # Use kadmin to add a key.
-    if !add_kerberos_key pwchanger 0 {
-	return
-    }
-
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -q "modprinc +needchange pwchanger"
-    catch expect_after
-    expect {
-	timeout {
-	    fail "kadmin.local modprinc +needchange"
-	}
-	eof {
-	    pass "kadmin.local modprinc +needchange"
-	}
-    }
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin modprinc +needchange)"
-    catch "close -i $spawn_id"
-
-    setup_kerberos_env client
-    if !kinit_expecting_pwchange pwchanger pwchanger$KEY floople {
-	return
-    }
-    pass "kinit (password change)"
-    if !kinit pwchanger floople 0 {
-	return
-    }
-    pass "kinit (new password)"
-
-    # Destroy the ticket.
-    spawn $KDESTROY -5
-    if !check_exit_status "kdestroy" {
-	return
-    }
-    pass "kdestroy"
-}
-
-run_once pwchange {
-    # Set up the Kerberos files and environment.
-    if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-	return
-    }
-
-    # Initialize the Kerberos database.  The argument tells
-    # setup_kerberos_db that it is being called from here.
-    if !setup_kerberos_db 0 {
-	return
-    }
-
-    set status catch doit msg
-
-    stop_kerberos_daemons
-
-    if { $status != 0 } {
-	send_error "ERROR: error in pwchange.exp\n"
-	send_error "$msg\n"
-	exit 1
-    }
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/pwhist.exp Deleted

@@ -1,217 +0,0 @@
-# password history tests
-
-# one *non-interactive* kadmin.local request
-proc onerq { rq pname str {flags ""} } {
-    global REALMNAME
-    global KADMIN_LOCAL
-
-    spawn $KADMIN_LOCAL -r $REALMNAME -q "$rq $flags $pname"
-    expect_after {
-	timeout {
-	    verbose "kadmin.local $rq $flags $pname timed out"
-	    catch expect_after
-	    kill exp_pid
-	    close
-	    expect eof
-	    wait
-	    return 0
-	} eof {
-	    verbose "kadmin.local $rq $flags $pname got EOF"
-	    catch expect_after
-	    wait
-	    return 0
-	}
-    }
-    expect $str
-    expect_after
-    expect eof
-    wait
-    return 1
-}
-
-proc addprinc { pname pw } {
-    global REALMNAME
-
-    return onerq addprinc $pname \
-		"Principal \"$pname@$REALMNAME\" created." "-pw $pw"
-}
-
-proc delprinc { pname } {
-    global REALMNAME
-    return onerq delprinc $pname \
-		"Principal \"$pname@$REALMNAME\" deleted." "-force"
-}
-
-proc cpw { pname pw } {
-    global REALMNAME
-
-    return onerq cpw $pname \
-		"Password for \"$pname@$REALMNAME\" changed." "-pw $pw"
-}
-
-proc modprinc { pname flags } {
-    global REALMNAME
-
-    return onerq modprinc $pname \
-		"Principal \"$pname@$REALMNAME\" modified." $flags
-}
-
-proc addpol { pname } {
-    if !onerq addpol $pname "" {
-	return 0
-    }
-    return onerq getpol $pname "Policy: $pname"
-}
-
-proc delpol { pname } {
-    onerq delpol $pname "" -force
-    return onerq getpol $pname \
-		"Policy does not exist while retrieving policy \"$pname\"."
-}
-
-proc modpol { pname flags } {
-    return onerq modpol $pname "" $flags
-}
-
-# Mandatory command must return true.
-# Issues a break in its parent on failure.
-proc mustrun { cmd } {
-    if !eval $cmd {
-	perror "mandatory command failed: $cmd"
-	uplevel break
-    }
-}
-
-# Fail test if command fails.
-# Issues a break in its parent on failure.
-proc chkpass { cmd } {
-    upvar test test
-    if !eval $cmd {
-	verbose "unexpected failure: $cmd"
-	fail $test
-	uplevel break
-    }
-}
-
-# Fail test if command succeeds.
-# Issues a break in its parent on failure.
-proc chkfail { cmd } {
-    upvar test test
-    if eval $cmd {
-	verbose "unexpected success: $cmd"
-	fail $test
-	uplevel break
-    }
-}
-
-# wrapper to run command (actually usually sequence of commands)
-#
-# If any part of CMD throws an exception, set failall, otherwise pass.
-# If failall is already true, report unresolved.
-proc wraptest { test cmd } {
-    upvar failall failall
-    if $failall {
-	unresolved $test
-	return
-    }
-    if catch $cmd {
-	set failall 1
-    } else {
-	pass $test
-    }
-}
-
-run_once pwhist {
-    # Set up the kerberos database.
-    if {!get_hostname \
-	    || !setup_kerberos_files \
-	    || !setup_kerberos_env kdc \
-	    || !setup_kerberos_db 0} {
-	return
-    }
-
-    set failall 0
-    wraptest "nkeys=1, nhist=3" {
-	mustrun { addpol crashpol }
-	mustrun { modpol crashpol "-history 3"}
-	mustrun { addprinc crash 1111 }
-	mustrun { modprinc crash "-policy crashpol" }
-	chkpass { cpw crash 2222 }
-	chkfail { cpw crash 2222 }
-	chkfail { cpw crash 1111 }
-    }
-    verbose {old_keys  1111 -> }
-
-    # The following will result in reading/writing past array bounds if
-    # add_to_history() is not patched.
-    #
-    # NOTE: A pass from this test does not mean the bug isn't present;
-    # check with Purify, valgrind, etc.
-    wraptest "array bounds ok on nkeys=1, nhist 3->2" {
-	mustrun { modpol crashpol "-history 2" }
-	chkpass { cpw crash 3333 }
-    }
-    verbose {old_keys  ->2222 }
-
-    wraptest "verify nhist=2" {
-	mustrun { delprinc crash }
-	mustrun { addprinc crash 1111 }
-	mustrun { modprinc crash "-policy crashpol" }
-	chkpass { cpw crash 2222 }
-	chkfail { cpw crash 2222 }
-	chkfail { cpw crash 1111 }
-    }
-    verbose {old_keys  ->1111 }
-
-    # The following will fail if growing the history array causes an extra
-    # key to be lost due to failure to shift entries.
-    wraptest "grow nhist 2->3" {
-	mustrun { modpol crashpol "-history 3" }
-	chkpass { cpw crash 3333 }
-	chkfail { cpw crash 3333 }
-	chkfail { cpw crash 2222 }
-	chkfail { cpw crash 1111 }
-    }
-    verbose {old_keys  2222 ->1111 }
-
-    wraptest "grow nhist 3->4" {
-	mustrun { modpol crashpol "-history 4" }
-	chkfail { cpw crash 3333 }
-	chkfail { cpw crash 2222 }
-	chkfail { cpw crash 1111 }
-	chkpass { cpw crash 4444 }
-	chkfail { cpw crash 3333 }
-	chkfail { cpw crash 2222 }
-	chkfail { cpw crash 1111 }
-    }
-    verbose {old_keys  2222 3333 ->1111 }
-    wraptest "shrink nhist 4->3" {
-	mustrun { modpol crashpol "-history 3" }
-	chkfail { cpw crash 4444 }
-	chkfail { cpw crash 3333 }
-	chkfail { cpw crash 2222 }
-	chkfail { cpw crash 1111 }
-	chkpass { cpw crash 5555 }
-    }
-    verbose {old_keys  4444 ->3333 }
-    wraptest "verify nhist=3" {
-	chkfail { cpw crash 5555 }
-	chkfail { cpw crash 4444 }
-	chkfail { cpw crash 3333 }
-	chkpass { cpw crash 2222 }
-    }
-    verbose {old_keys  ->4444 5555 }
-    wraptest "shrink nhist 3->2" {
-	mustrun { modpol crashpol "-history 2" }
-	chkfail { cpw crash 2222 }
-	chkfail { cpw crash 5555 }
-	chkfail { cpw crash 4444 }
-	chkpass { cpw crash 3333 }
-    }
-    verbose {old_keys  ->2222 }
-
-    delprinc crash
-    delpol crashpol
-
-    stop_kerberos_daemons
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/sample.exp Deleted

@@ -1,217 +0,0 @@
-# Test for the sample clients
-# This is a DejaGnu test script.
-# This script tests that sample user-user communication works.
-
-# This mostly just calls procedures in test/dejagnu/config/default.exp.
-
-if !info exists KLIST {
-    set KLIST findfile $objdir/../../clients/klist/klist
-}
-
-if !info exists KDESTROY {
-    set KDESTROY findfile $objdir/../../clients/kdestroy/kdestroy
-}
-
-if !info exists SSERVER {
-    set SSERVER findfile $objdir/../../appl/sample/sserver/sserver
-}
-if !info exists SCLIENT {
-    set SCLIENT findfile $objdir/../../appl/sample/sclient/sclient
-}
-
-# Set up the Kerberos files and environment.
-if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-    return
-}
-
-# Initialize the Kerberos database.  The argument tells
-# setup_kerberos_db that it is being called from here.
-if !setup_kerberos_db 0 {
-    return
-}
-
-proc start_sserver_daemon { inetd } {
-    global spawn_id
-    global sserver_pid
-    global sserver_spawn_id
-    global SSERVER
-    global T_INETD
-    global tmppwd
-    global portbase
-
-    # if inetd = 0, then we are running stand-alone
-    if !{$inetd} {
-	    # Start the sserver
-	    spawn $SSERVER -p expr 8 + $portbase -S $tmppwd/keytab
-	    set sserver_pid exp_pid
-	    set sserver_spawn_id $spawn_id
-
-	    verbose "sserver_spawn is $sserver_spawn_id" 1
-
-	    # Give sserver some time to start
-	    sleep 2
-    } else {
-	    # Start the sserver
-	    spawn $T_INETD expr 8 + $portbase $SSERVER sserver -S $tmppwd/keytab
-	    set sserver_pid exp_pid
-	    set sserver_spawn_id $spawn_id
-
-	    verbose "sserver_spawn (t_inetd) is $sserver_spawn_id" 1
-
-	    expect {
-		-ex "Ready!"	{ }
-		eof		{ error "couldn't start t_inetd helper" }
-	    }
-    }
-
-    return 1
-}
-
-
-proc stop_sserver_daemon { } {
-    global sserver_pid
-    global sserver_spawn_id
-
-    if info exists sserver_pid {
-	catch "close -i $sserver_spawn_id"
-	catch "exec kill $sserver_pid"
-	wait -i $sserver_spawn_id
-	unset sserver_pid
-    }
-
-    return 1
-}
-
-proc stop_check_sserver_daemon { } {
-    global sserver_spawn_id
-    global sserver_pid
-
-    # Check the exit status of sserver - should exit here
-    set status_list wait -i $sserver_spawn_id
-    verbose "wait -i $sserver_spawn_id returned $status_list (sserver)"
-    catch "close -i $sserver_spawn_id"
-    if { lindex $status_list 2 != 0 || lindex $status_list 3 != 0 } {
-	send_log "exit status: $status_list\n"
-	verbose "exit status: $status_list"
-	fail "sserver"
-    } else {
-	pass "sserver"
-    }
-    # In either case the server shutdown
-    unset sserver_pid
-}
-
-proc test_sclient { msg } {
-    global REALMNAME
-    global SCLIENT
-    global hostname
-    global spawn_id
-    global portbase
-
-    # Test the client
-    spawn $SCLIENT $hostname expr 8 + $portbase
-    verbose "sclient_spawn is  $spawn_id" 1
-
-    expect {
-	"sendauth succeeded, reply is:" {
-		verbose "Start proper message"
-	}
-	timeout {
-		fail $msg 
-		return 0
-	}
-	eof {
-		fail $msg 
-		return 0
-	}	
-     }
-
-    expect {
-	"You are krbtest/admin@$REALMNAME\r" {
-		verbose "received valid sample message"}
-	eof {
-		fail $msg 
-		return 0
-	    }
-    }
-    # This last expect seems useless, but without it the test hangs on
-    # NETBSD.
-    expect {
-        "\r" { }
-    }
-
-    if !check_exit_status "ssample" {
-	return 0
-    }
-
-    return 1
-}
-# We are about to start up a couple of daemon processes.  We do all
-# the rest of the tests inside a proc, so that we can easily kill the
-# processes when the procedure ends.
-
-proc doit { } {
-    global hostname
-    global KEY
-    global sserver_pid
-    global sserver_spawn_id
-
-    # Start up the kerberos and kadmind daemons.
-    if !start_kerberos_daemons 0 {
-	return
-    }
-
-    # Use kadmin to add an host key.
-    if !add_random_key sample/$hostname 1 {
-	return
-    }
-
-    # Use ksrvutil to create a keytab entry for sample
-    if !setup_keytab 1 sample {
-	return
-    }
-
-    # Use kinit to get a ticket.
-    if !kinit krbtest/admin adminpass$KEY 1 {
-	return
-    }
-
-    run_once sample_standalone {
-	if !start_sserver_daemon 0  {
-	    return 
-	}
-
-	if !test_sclient sclient {
-	    return
-	}
-    
-	pass "sample - standalone"
-
-	stop_check_sserver_daemon
-    }
-    
-    if !start_sserver_daemon 1  {
-	return 
-    }
-
-    if !test_sclient sclient-inetd {
-	return
-    }
-    
-    pass "sample - inetd"
-
-    stop_check_sserver_daemon
-    return
-}
-
-set status catch doit msg
-
-stop_sserver_daemon
-
-stop_kerberos_daemons
-
-if { $status != 0 } {
-    send_error "ERROR: error in sample.exp\n"
-    send_error "$msg\n"
-    exit 1
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/simple.exp Deleted

@@ -1,216 +0,0 @@
-# Test for the simple clients
-# This is a DejaGnu test script.
-# This script tests that krb-safe and krb-priv messages work.
-
-# This mostly just calls procedures in test/dejagnu/config/default.exp.
-
-if !info exists KLIST {
-    set KLIST findfile $objdir/../../clients/klist/klist
-}
-
-if !info exists KDESTROY {
-    set KDESTROY findfile $objdir/../../clients/kdestroy/kdestroy
-}
-
-if !info exists SIM_SERVER {
-    set SIM_SERVER findfile $objdir/../../appl/simple/server/sim_server
-}
-if !info exists SIM_CLIENT {
-    set SIM_CLIENT findfile $objdir/../../appl/simple/client/sim_client
-}
-
-# Set up the Kerberos files and environment.
-if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-    return
-}
-
-# Initialize the Kerberos database.  The argument tells
-# setup_kerberos_db that it is being called from here.
-if !setup_kerberos_db 0 {
-    return
-}
-
-proc start_sim_server_daemon { } {
-    global spawn_id
-    global sim_server_pid
-    global sim_server_spawn_id
-    global SIM_SERVER
-    global T_INETD
-    global tmppwd
-    global portbase
-
-    # Start the sim_server
-    spawn $SIM_SERVER -p expr 8 + $portbase -S $tmppwd/keytab
-    set sim_server_pid exp_pid
-    set sim_server_spawn_id $spawn_id
-
-    verbose "sim_server_spawn is $sim_server_spawn_id" 1
-
-    expect {
-	"starting"	{ }
-	eof		{ perror "sim_server failed to start" }
-    }
-
-    return 1
-}
-
-
-proc stop_sim_server_daemon { } {
-    global sim_server_pid
-    global sim_server_spawn_id
-
-    if info exists sim_server_pid {
-	catch "close -i $sim_server_spawn_id"
-	catch "exec kill $sim_server_pid"
-	wait -i $sim_server_spawn_id
-	unset sim_server_pid
-    }
-
-    return 1
-}
-
-proc stop_check_sim_server_daemon { } {
-    global sim_server_spawn_id
-    global sim_server_pid
-
-    # Check the exit status of sim_server - should exit here
-    set status_list wait -i $sim_server_spawn_id
-    verbose "wait -i $sim_server_spawn_id returned $status_list (sim_server)"
-    catch "close -i $sim_server_spawn_id"
-    if { lindex $status_list 2 != 0 || lindex $status_list 3 != 0 } {
-	send_log "exit status: $status_list\n"
-	verbose "exit status: $status_list"
-	fail "sim_server"
-    } else {
-	pass "sim_server"
-    }
-    # In either case the server shutdown
-    unset sim_server_pid
-}
-
-proc test_sim_client { msg } {
-    global REALMNAME
-    global SIM_CLIENT
-    global hostname
-    global spawn_id
-    global portbase
-    global sim_server_spawn_id
-
-    # Test the client
-    spawn $SIM_CLIENT -p expr 8 + $portbase $hostname
-    verbose "sim_client_spawn is  $spawn_id" 1
-
-    expect {
-	"Sent checksummed message: " {
-		verbose "received safe message"
-	}
-	timeout {
-		fail $msg 
-		return 0
-	}
-	eof {
-		fail $msg 
-		return 0
-	}	
-     }
-
-    expect {
-	"Sent encrypted message: " {
-		verbose "received private message"
-	}
-	eof {
-		fail $msg 
-		return 0
-	    }
-    }
-    expect {
-        "\r" { }
-    }
-
-    expect {
-	-i $sim_server_spawn_id
-	"Safe message is: 'hi there!'" { }
-	timeout {
-	    fail $msg
-	    return 0
-	}
-	eof {
-	    fail $msg
-	    return 0
-	}
-    }
-
-    expect {
-	-i $sim_server_spawn_id
-	"Decrypted message is: 'hi there!'" { }
-	timeout {
-	    fail $msg
-	    return 0
-	}
-	eof {
-	    fail $msg
-	    return 0
-	}
-    }
-
-    if !check_exit_status "simple" {
-	return 0
-    }
-
-    return 1
-}
-# We are about to start up a couple of daemon processes.  We do all
-# the rest of the tests inside a proc, so that we can easily kill the
-# processes when the procedure ends.
-
-proc doit { } {
-    global hostname
-    global KEY
-    global sim_server_pid
-    global sim_server_spawn_id
-
-    # Start up the kerberos and kadmind daemons.
-    if !start_kerberos_daemons 0 {
-	return
-    }
-
-    # Use kadmin to add an host key.
-    if !add_random_key sample/$hostname 1 {
-	return
-    }
-
-    # Use ksrvutil to create a keytab entry for sample
-    if !setup_keytab 1 sample {
-	return
-    }
-
-    # Use kinit to get a ticket.
-    if !kinit krbtest/admin adminpass$KEY 1 {
-	return
-    }
-
-    if !start_sim_server_daemon {
-	return 
-    }
-
-    if !test_sim_client sim_client {
-	return
-    }
-    
-    pass "simple - standalone"
-
-    stop_check_sim_server_daemon
-    return
-}
-
-set status catch doit msg
-
-stop_sim_server_daemon
-
-stop_kerberos_daemons
-
-if { $status != 0 } {
-    send_error "ERROR: error in simple.exp\n"
-    send_error "$msg\n"
-    exit 1
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/standalone.exp Deleted

@@ -1,287 +0,0 @@
-# Standalone Kerberos test.
-# This is a DejaGnu test script.
-# This script tests that the Kerberos tools can talk to each other.
-
-# This mostly just calls procedures in testsuite/config/default.exp.
-
-# Set up the Kerberos files and environment.
-if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-    return
-}
-
-# Initialize the Kerberos database.  The argument tells
-# setup_kerberos_db that it is being called from here.
-if !setup_kerberos_db 1 {
-    return
-}
-
-# We are about to start up a couple of daemon processes.  We do all
-# the rest of the tests inside a proc, so that we can easily kill the
-# processes when the procedure ends.
-
-proc dump_and_reload {} {
-    global KDB5_UTIL
-    global tmppwd
-
-    set dumpfile $tmppwd/dump-file
-    set dumpokfile $dumpfile.dump_ok
-
-    set test1name "kdb5_util dump"
-    set test2name "kdb5_util load"
-
-    if file exists $dumpfile { file delete $dumpfile }
-    if file exists $dumpokfile { file delete $dumpokfile }
-
-    spawn $KDB5_UTIL dump $dumpfile
-    expect {
-	-re "..*" {
-	    fail $test1name
-	    untested $test2name
-	    return
-	}
-	timeout {
-	    fail $test1name
-	    untested $test2name
-	    return
-	}
-	eof { }
-    }
-    if !check_exit_status $test1name {
-	untested $test2name
-	return
-    }
-    if !file exists $dumpfile||!file exists $dumpokfile {
-	fail $test1name
-	untested $test2name
-	return
-    }
-    pass $test1name
-
-    spawn $KDB5_UTIL load $dumpfile
-    expect {
-	-re "..*" {
-	    fail $test2name
-	    return
-	}
-	timeout {
-	    fail $test2name
-	    return
-	}
-	eof { }
-    }
-    if check_exit_status $test2name {
-	pass $test2name
-    }
-}
-
-proc kinit_wrong_pw { name badpass } {
-    global REALMNAME
-    global KINIT
-    global spawn_id
-
-    # Use kinit to get a ticket.
-	#
-	# For now always get forwardable tickets. Later when we need to make
-	# tests that distinguish between forwardable tickets and otherwise
-	# we should but another option to this proc. --proven
-	#
-    spawn $KINIT -5 -f $name@$REALMNAME
-    expect {
-	"Password for $name@$REALMNAME:" {
-	    verbose "kinit started"
-	}
-	timeout {
-	    fail "kinit bad pw"
-	    return 0
-	}
-	eof {
-	    fail "kinit bad pw"
-	    return 0
-	}
-    }
-    send "$badpass\r"
-    expect {
-	"Password incorrect while getting initial credentials" {
-	}
-	timeout {
-	    fail "kinit bad pw"
-	    # kill it?
-	}
-	eof {
-	    fail "kinit bad pw"
-	    return
-	}
-    }
-    expect eof
-
-    set status_list wait -i $spawn_id
-    catch "close -i $spawn_id"
-    verbose -log "exit status: $status_list"
-    if { lindex $status_list 2 != 0 || lindex $status_list 3 != 0 } {
-	pass "kinit bad pw"
-    } else {
-	fail "kinit bad pw"
-    }
-}
-
-proc doit { } {
-    global REALMNAME
-    global KLIST
-    global KDESTROY
-    global KEY
-    global KADMIN_LOCAL
-    global KTUTIL
-    global hostname
-    global tmppwd
-    global spawn_id
-    global supported_enctypes
-    global KRBIV
-    global portbase
-    global mode
-    global tmppwd
-
-    setup_kerberos_env kdc
-
-    # Start up the kerberos and kadmind daemons.
-    if !start_kerberos_daemons 1 {
-	return
-    }
-
-    # Use kadmin to add an host key.
-    if !add_random_key host/$hostname 1 {
-	return
-    }
-
-    spawn $KADMIN_LOCAL -q "addpol fred"
-    catch expect_after
-    expect {
-	timeout {
-	    fail "kadmin.local addpol fred"
-	}
-	eof {
-	    pass "kadmin.local addpol fred"
-	}
-    }
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)"
-    catch "close -i $spawn_id"
-
-    # Use ksrvutil to create a keytab entry.
-    if !setup_keytab 1 {
-	return
-    }
-
-    # Test dump and load.  Continue on, whatever the result.
-    dump_and_reload
-
-    spawn $KADMIN_LOCAL -q "getpols"
-    expect {
-	fred {
-	    pass "kadmin.local getpols"
-	    expect eof
-	}
-	timeout {
-	    fail "kadmin.local getpols"
-	}
-	eof {
-	    fail "kadmin.local getpols"
-	}
-    }
-    set k_stat wait -i $spawn_id
-    verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)"
-    catch "close -i $spawn_id"
-
-    # Test use of wrong password.
-    kinit_wrong_pw krbtest/admin wrongpassword
-
-    setup_kerberos_env client
-    # Use kinit to get a ticket.
-    if !kinit krbtest/admin adminpass$KEY 1 {
-	return
-    }
-
-    if !kinit_renew krbtest/admin adminpass$KEY 1 {
-	return
-    }
-
-    # Make sure that klist can see the ticket.
-    if !do_klist "krbtest/admin@$REALMNAME" "krbtgt/$REALMNAME@$REALMNAME" "klist" {
-	return
-    }
-
-# Get a ticket to later use with FAST
-    if !kinit krbtest/fast adminpass$KEY 1 {
-	return
-    }
-
-    # Use fast to get a ticket
-    if !kinit_fast krbtest/fast adminpass$KEY 1 {
-	return
-    }
-
-    # Destroy the ticket.
-    spawn $KDESTROY -5
-    if !check_exit_status "kdestroy" {
-	return
-    }
-    pass "kdestroy"
-
-    # Double check that the ticket was destroyed.
-    if !do_klist_err "klist after destroy" { return }
-
-    if !add_random_key WELLKNOWN/ANONYMOUS 0 {
-	return
-    }
-
-    # If we have anonymous  then test it
-    if file exists "$tmppwd/../../../plugins/preauth/pkinit.so"  {
-	kinit_anonymous "WELLKNOWN/ANONYMOUS"
-    }
-
-    if !add_random_key foo/bar 1 {
-	return
-    }
-
-    set keytab $tmppwd/fookeytab
-    catch "exec rm -f $keytab"
-
-    modify_principal foo/bar -kvno 252
-    foreach vno {253 254 255 256 257 258} {
-	xst $tmppwd/fookeytab foo/bar
-	do_klist_kt $tmppwd/fookeytab "klist keytab foo/bar vno $vno"
-	kinit_kt "foo/bar" $tmppwd/fookeytab 1 "kt kvno $vno"
-	do_klist "foo/bar" "krbtgt/$REALMNAME@$REALMNAME" "klist kt foo/bar vno $vno"
-	do_kdestroy "kdestroy foo/bar vno $vno"
-    }
-    catch "exec rm -f $keytab"
-    # Check that kadmin.local can actually read the correct kvno, even
-    # if we don't expect kadmin to be able to.
-    setup_kerberos_env kdc
-    spawn $KADMIN_LOCAL -r $REALMNAME
-    set ok 1
-    expect_after {
-	timeout		{ fail "kadmin.local correct high kvno" ; set ok 0 }
-	eof		{ fail "kadmin.local correct high kvno" ; set ok 0 }
-    }
-    expect "kadmin.local: "
-    send "getprinc foo/bar\r"
-#    exec sleep 10
-    expect "Key: vno $vno,"
-    send "quit\r"
-    expect eof
-    if check_exit_status "kadmin.local examine foo/bar for high kvno" {
-	if $ok {
-	    pass "kadmin.local correct high kvno"
-	}
-    }
-}
-
-set status catch doit msg
-
-stop_kerberos_daemons
-
-if { $status != 0 } {
-    send_error "ERROR: error in standalone.exp\n"
-    send_error "$msg\n"
-    exit 1
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/krb-standalone/tcp.exp Deleted

@@ -1,112 +0,0 @@
-# Standalone Kerberos test.
-# This is a DejaGnu test script.
-# This script tests that the Kerberos tools can talk to each other.
-
-# This mostly just calls procedures in testsuite/config/default.exp.
-
-# We are about to start up a couple of daemon processes.  We do all
-# the rest of the tests inside a proc, so that we can easily kill the
-# processes when the procedure ends.
-
-proc doit { } {
-    global REALMNAME
-    global KLIST
-    global KDESTROY
-    global KEY
-    global KADMIN_LOCAL
-    global KTUTIL
-    global hostname
-    global tmppwd
-    global spawn_id
-    global supported_enctypes
-    global KRBIV
-    global portbase
-    global mode
-
-    # Start up the kerberos and kadmind daemons.
-    if !start_kerberos_daemons 1 {
-	return
-    }
-
-    # Use kadmin to add an host key.
-    if !add_random_key host/$hostname 1 {
-	return
-    }
-
-    # Use kinit to get a ticket.
-    if !kinit krbtest/admin adminpass$KEY 1 {
-	return
-    }
-
-    # Make sure that klist can see the ticket.
-    if !do_klist "krbtest/admin@$REALMNAME" "krbtgt/$REALMNAME@$REALMNAME" "klist" {
-	return
-    }
-
-    # Destroy the ticket.
-    spawn $KDESTROY -5
-    if !check_exit_status "kdestroy" {
-	return
-    }
-    pass "kdestroy"
-
-    set response {}
-    set got_response 0
-    set kdcsock ""
-    catch {
-	send_log "connecting to $hostname expr 3 + $portbase\n"
-	set kdcsock socket $hostname expr 3 + $portbase
-	fconfigure $kdcsock -encoding binary -blocking 0 -buffering none
-	puts -nonewline $kdcsock binary format H* ffffffff
-	# XXX
-	sleep 3
-	set response read $kdcsock
-	set got_response 1
-    } msg
-    if string length $kdcsock { catch "close $kdcsock" }
-    if $got_response {
-#	send_log list sent length -1, got back $response
-#	send_log "\n"
-	if string length $response>10 {
-	    pass "too-long TCP request"
-	} else {
-	    send_log "response too short\n"
-	    fail "too-long TCP request"
-	}
-    } else {
-	send_log "too-long connect/exchange failure: $msg\n"
-	fail "too-long TCP request"
-    }
-}
-
-set status 0
-run_once tcp {
-    # Set up the Kerberos files and environment.
-    set mode tcp
-    reset_kerberos_files
-    if {!get_hostname || !setup_kerberos_files || !setup_kerberos_env} {
-	set mode udp
-	reset_kerberos_files
-	return
-    }
-    # Reset now, for next time we write the config files.
-    set mode udp
-
-    # Initialize the Kerberos database.  The argument tells
-    # setup_kerberos_db that it is being called from here.
-    if !setup_kerberos_db 1 {
-	reset_kerberos_files
-	return
-    }
-
-    set status catch doit msg
-}
-
-reset_kerberos_files
-stop_kerberos_daemons
-
-if { $status != 0 } {
-    send_error "ERROR: error in standalone.exp\n"
-    send_error "$msg\n"
-    exit 1
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/ca.pem Deleted

@@ -1,29 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE5TCCA82gAwIBAgIBATANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
-FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
-A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
-dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
-b3RoZXJ3aXNlMB4XDTE5MDIxODAwMjU1NVoXDTMwMDEzMTAwMjU1NVowgacxCzAJ
-BgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRIwEAYDVQQHDAlDYW1i
-cmlkZ2UxDDAKBgNVBAoMA01JVDEpMCcGA1UECwwgSW5zZWN1cmUgUEtJTklUIEtl
-cmJlcm9zIHRlc3QgQ0ExMzAxBgNVBAMMKnBraW5pdCB0ZXN0IHN1aXRlIENBOyBk
-byBub3QgdXNlIG90aGVyd2lzZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
-ggEBAL6unmewooH+XR9tvj5VtwD+uUyd+YIBseWjQZfl447qdmNah3tqP6VCBGr4
-N3fYZrrPKL7CRLlsbF8qP52r6UnEjVGwVuYoNo4Eps0DgNS7+XcxviYBe9RCPJH3
-t/2PtY7NrnaW7A/h471N0IGTjwzudeIBixLfFKcn8prwQc+6IQ6Tz3Rg/4XCTFxI
-kjby4VWyKBDWOpea3gPM9dvR7PiVsnCfCJlFB+9m7enD9+PFrie0UM7ezawZ514j
-xo1luZfXsFJDpB6Zi3iAA8gNzVAF2CONMISZDlD4bTFtj58zPQmChaQlYeEise9Y
-gfSjuWOLCx7PZ3l0J3Joba+pcxECAwEAAaOCARgwggEUMB0GA1UdDgQWBBRsTf69
-b/J43+2sVy3nOfj8nmyOFjCB1AYDVR0jBIHMMIHJgBRsTf69b/J43+2sVy3nOfj8
-nmyOFqGBraSBqjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0
-dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoGA1UECgwDTUlUMSkwJwYDVQQLDCBJ
-bnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAwwqcGtpbml0
-IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlggEBMAsGA1UdDwQE
-AwIB/jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAGdouyTbxO
-bnyMr6hEDnMLRrSqwozfLGnfJIrUxvwtn/9UAlFuCpnfNi1xQkwimW8zXOHlCoAF
-fpeE7zpotmN6xbg2u98J9QOo7vGfoADvVgiZaDMq+Tv52ZG0OtbzTe/LyCXnjanM
-G+Rgjhbmy2HW1orghyDUa5Qy9ISv4d72yOKGVjK8xxItnf9i7tRARVqqJk5p81QD
-WOBc7FUZNj5jYw38YPHqmZtwlr1DhCNeXwVi5GpwPrYwFAaqGuTnspfkpcDA8wEm
-iVvs7Gy69C0zy4Yz2I9ZzsDjmTV8PyZdMaZIhhpBHjQmBm+Pol/q5BubjFeAsPSU
-/YaKjpqk1jNg
------END CERTIFICATE-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/generic.p12 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/generic.pem Deleted

@@ -1,21 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDZjCCAk4CAQcwDQYJKoZIhvcNAQELBQAwgacxCzAJBgNVBAYTAlVTMRYwFAYD
-VQQIDA1NYXNzYWNodXNldHRzMRIwEAYDVQQHDAlDYW1icmlkZ2UxDDAKBgNVBAoM
-A01JVDEpMCcGA1UECwwgSW5zZWN1cmUgUEtJTklUIEtlcmJlcm9zIHRlc3QgQ0Ex
-MzAxBgNVBAMMKnBraW5pdCB0ZXN0IHN1aXRlIENBOyBkbyBub3QgdXNlIG90aGVy
-d2lzZTAeFw0xOTAyMTgwMDI1NTZaFw0zMDAxMzEwMDI1NTZaMEoxCzAJBgNVBAYT
-AlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRQwEgYDVQQKDAtLUkJURVNULkNP
-TTENMAsGA1UEAwwEdXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AL6unmewooH+XR9tvj5VtwD+uUyd+YIBseWjQZfl447qdmNah3tqP6VCBGr4N3fY
-ZrrPKL7CRLlsbF8qP52r6UnEjVGwVuYoNo4Eps0DgNS7+XcxviYBe9RCPJH3t/2P
-tY7NrnaW7A/h471N0IGTjwzudeIBixLfFKcn8prwQc+6IQ6Tz3Rg/4XCTFxIkjby
-4VWyKBDWOpea3gPM9dvR7PiVsnCfCJlFB+9m7enD9+PFrie0UM7ezawZ514jxo1l
-uZfXsFJDpB6Zi3iAA8gNzVAF2CONMISZDlD4bTFtj58zPQmChaQlYeEise9YgfSj
-uWOLCx7PZ3l0J3Joba+pcxECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAevA9z6cL
-a+qiNfp4ssOo3ub87vrQZnayulbrU9rcRoVuqFZGbIvH7+dbQwZE34RP/R1N/ZCR
-ElaU6VNqnMYv/1pqzGnk59b7Z00hiOSblfifPt7IM+uHZRUGrgQ37dC7SyHvjSi7
-kZsSCJRc6Fjv6O/qBBp2jui1B9ZBWXQ+FBmX6YMdD/VYiD1ivpacd9YueLrHnzCm
-iIM5V/uBAiUZHLoFhkhtWDMvRBJLNHqP2zWGffg4K7jKsCriAfCcp+VUfXRAZelo
-Hp1C5HFLID0UIXvSStOnhtM1HuQAROJS9eqqz6E4irl2ujxT8vEfbZFHDpD+Cdy1
-MgVZAqL7rPjILA==
------END CERTIFICATE-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/kdc.pem Deleted

@@ -1,29 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE4TCCA8mgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
-FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
-A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
-dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
-b3RoZXJ3aXNlMB4XDTE5MDIxODAwMjU1NVoXDTMwMDEzMTAwMjU1NVowSTELMAkG
-A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
-U1QuQ09NMQwwCgYDVQQDDANLREMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQC+rp5nsKKB/l0fbb4+VbcA/rlMnfmCAbHlo0GX5eOO6nZjWod7aj+lQgRq
-+Dd32Ga6zyi+wkS5bGxfKj+dq+lJxI1RsFbmKDaOBKbNA4DUu/l3Mb4mAXvUQjyR
-97f9j7WOza52luwP4eO9TdCBk48M7nXiAYsS3xSnJ/Ka8EHPuiEOk890YP+Fwkxc
-SJI28uFVsigQ1jqXmt4DzPXb0ez4lbJwnwiZRQfvZu3pw/fjxa4ntFDO3s2sGede
-I8aNZbmX17BSQ6QemYt4gAPIDc1QBdgjjTCEmQ5Q+G0xbY+fMz0JgoWkJWHhIrHv
-WIH0o7ljiwsez2d5dCdyaG2vqXMRAgMBAAGjggFzMIIBbzAdBgNVHQ4EFgQUbE3+
-vW/yeN/trFct5zn4/J5sjhYwgdQGA1UdIwSBzDCByYAUbE3+vW/yeN/trFct5zn4
-/J5sjhahga2kgaowgacxCzAJBgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNl
-dHRzMRIwEAYDVQQHDAlDYW1icmlkZ2UxDDAKBgNVBAoMA01JVDEpMCcGA1UECwwg
-SW5zZWN1cmUgUEtJTklUIEtlcmJlcm9zIHRlc3QgQ0ExMzAxBgNVBAMMKnBraW5p
-dCB0ZXN0IHN1aXRlIENBOyBkbyBub3QgdXNlIG90aGVyd2lzZYIBATALBgNVHQ8E
-BAMCA+gwDAYDVR0TAQH/BAIwADBIBgNVHREEQTA/oD0GBisGAQUCAqAzMDGgDRsL
-S1JCVEVTVC5DT02hIDAeoAMCAQKhFzAVGwZrcmJ0Z3QbC0tSQlRFU1QuQ09NMBIG
-A1UdJQQLMAkGBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEBACoRg0+LnZehgdfM
-xy/zTXj3kH30W++NTErQAOEEOm8KscaWIF/GXNDX9G+C4tvT/LN3vHCd+hnGgvTr
-kkJlyYtLZZgkv7sa1PQW3yozhjOPRzdjiXitV6RsE4ujzwbcr3Zd0twZnf7nDbIt
-HmgjQJF5EMUprgPc1M3xdRVvi5FP/rvoUV03eI5/EmyvJ2046XfTD45pQgJdCWnO
-+KsFpaUIH6u4neWU4UdBxAsgo0/20pDYNM8GgPXY76wRi9yZ1Fgg2gJTS7QMpgyp
-ux0vuwbq3iuo4VFMhNyGmR2NeCF7OGUPSmjD/pCck9Vzk7Q7ainv58PHAyXIhM0E
-C+aVsEk=
------END CERTIFICATE-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/make-certs.sh Deleted

@@ -1,177 +0,0 @@
-#!/bin/sh -e
-
-NAMETYPE=1
-KRBTGT_NAMETYPE=2
-KEYSIZE=2048
-DAYS=4000
-REALM=KRBTEST.COM
-LOWREALM=krbtest.com
-KRB5_PRINCIPAL_SAN=1.3.6.1.5.2.2
-KRB5_UPN_SAN=1.3.6.1.4.1.311.20.2.3
-PKINIT_KDC_EKU=1.3.6.1.5.2.3.5
-PKINIT_CLIENT_EKU=1.3.6.1.5.2.3.4
-TLS_SERVER_EKU=1.3.6.1.5.5.7.3.1
-TLS_CLIENT_EKU=1.3.6.1.5.5.7.3.2
-EMAIL_PROTECTION_EKU=1.3.6.1.5.5.7.3.4
-# Add TLS EKUs to these if we're testing with NSS and we still have to
-# piggy-back on the TLS trust settings.
-KDC_EKU_LIST=$PKINIT_KDC_EKU
-CLIENT_EKU_LIST=$PKINIT_CLIENT_EKU
-
-cat > openssl.cnf << EOF
-req
-prompt = no
-distinguished_name = \$ENV::SUBJECT
-
-ca
-CN = test CA certificate
-C = US
-ST = Massachusetts
-L = Cambridge
-O = MIT
-OU = Insecure PKINIT Kerberos test CA
-CN = pkinit test suite CA; do not use otherwise
-
-kdc
-C = US
-ST = Massachusetts
-O = KRBTEST.COM
-CN = KDC
-
-user
-C = US
-ST = Massachusetts
-O = KRBTEST.COM
-CN = user
-
-exts_ca
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation,digitalSignature,keyEncipherment,dataEncipherment,keyAgreement,keyCertSign,cRLSign
-basicConstraints = critical,CA:TRUE
-
-components_kdc
-0.component=GeneralString:krbtgt
-1.component=GeneralString:$REALM
-
-princ_kdc
-nametype=EXPLICIT:0,INTEGER:$KRBTGT_NAMETYPE
-components=EXPLICIT:1,SEQUENCE:components_kdc
-
-krb5princ_kdc
-realm=EXPLICIT:0,GeneralString:$REALM
-princ=EXPLICIT:1,SEQUENCE:princ_kdc
-
-exts_kdc
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
-basicConstraints = critical,CA:FALSE
-subjectAltName = otherName:$KRB5_PRINCIPAL_SAN;SEQUENCE:krb5princ_kdc
-extendedKeyUsage = $KDC_EKU_LIST
-
-components_client
-component=GeneralString:user
-
-princ_client
-nametype=EXPLICIT:0,INTEGER:$NAMETYPE
-components=EXPLICIT:1,SEQUENCE:components_client
-
-krb5princ_client
-realm=EXPLICIT:0,GeneralString:$REALM
-princ=EXPLICIT:1,SEQUENCE:princ_client
-
-exts_client
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
-basicConstraints = critical,CA:FALSE
-subjectAltName = otherName:$KRB5_PRINCIPAL_SAN;SEQUENCE:krb5princ_client
-extendedKeyUsage = $CLIENT_EKU_LIST
-
-exts_upn_client
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
-basicConstraints = critical,CA:FALSE
-subjectAltName = otherName:$KRB5_UPN_SAN;UTF8:user@$LOWREALM
-extendedKeyUsage = $CLIENT_EKU_LIST
-
-exts_upn2_client
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
-basicConstraints = critical,CA:FALSE
-subjectAltName = otherName:$KRB5_UPN_SAN;UTF8:user
-extendedKeyUsage = $CLIENT_EKU_LIST
-
-exts_upn3_client
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
-basicConstraints = critical,CA:FALSE
-subjectAltName = otherName:$KRB5_UPN_SAN;UTF8:user@$REALM
-extendedKeyUsage = $CLIENT_EKU_LIST
-EOF
-
-# Generate a private key.
-openssl genrsa $KEYSIZE > privkey.pem
-openssl rsa -in privkey.pem -out privkey-enc.pem -des3 -passout pass:encrypted
-
-# Generate a "CA" certificate.
-SUBJECT=ca openssl req -config openssl.cnf -new -x509 -extensions exts_ca \
-    -set_serial 1 -days $DAYS -key privkey.pem -out ca.pem
-
-# Generate a KDC certificate.
-SUBJECT=kdc openssl req -config openssl.cnf -new -key privkey.pem -out kdc.csr
-SUBJECT=kdc openssl x509 -extfile openssl.cnf -extensions exts_kdc \
-    -set_serial 2 -days $DAYS -req -CA ca.pem -CAkey privkey.pem \
-    -out kdc.pem -in kdc.csr
-
-# Generate a client certificate and PKCS#12 bundles.
-SUBJECT=user openssl req -config openssl.cnf -new -key privkey.pem \
-    -out user.csr
-SUBJECT=user openssl x509 -extfile openssl.cnf -extensions exts_client \
-    -set_serial 3 -days $DAYS -req -CA ca.pem -CAkey privkey.pem \
-    -out user.pem -in user.csr
-openssl pkcs12 -export -in user.pem -inkey privkey.pem -out user.p12 \
-    -passout pass:
-openssl pkcs12 -export -in user.pem -inkey privkey.pem -out user-enc.p12 \
-    -passout pass:encrypted
-
-# Generate a client certificate and PKCS#12 bundles with a UPN SAN.
-SUBJECT=user openssl req -config openssl.cnf -new -key privkey.pem \
-    -out user-upn.csr
-SUBJECT=user openssl x509 -extfile openssl.cnf -extensions exts_upn_client \
-    -set_serial 4 -days $DAYS -req -CA ca.pem -CAkey privkey.pem \
-    -out user-upn.pem -in user-upn.csr
-openssl pkcs12 -export -in user-upn.pem -inkey privkey.pem -out user-upn.p12 \
-    -passout pass:
-
-SUBJECT=user openssl req -config openssl.cnf -new -key privkey.pem \
-    -out user-upn2.csr
-SUBJECT=user openssl x509 -extfile openssl.cnf -extensions exts_upn2_client \
-    -set_serial 5 -days $DAYS -req -CA ca.pem -CAkey privkey.pem \
-    -out user-upn2.pem -in user-upn2.csr
-openssl pkcs12 -export -in user-upn2.pem -inkey privkey.pem \
-     -out user-upn2.p12 -passout pass:
-
-SUBJECT=user openssl req -config openssl.cnf -new -key privkey.pem \
-    -out user-upn3.csr
-SUBJECT=user openssl x509 -extfile openssl.cnf -extensions exts_upn3_client \
-    -set_serial 6 -days $DAYS -req -CA ca.pem -CAkey privkey.pem \
-    -out user-upn3.pem -in user-upn3.csr
-openssl pkcs12 -export -in user-upn3.pem -inkey privkey.pem \
-     -out user-upn3.p12 -passout pass:
-
-# Generate a client certificate and PKCS#12 bundle with no PKINIT extensions.
-SUBJECT=user openssl req -config openssl.cnf -new -key privkey.pem \
-    -out generic.csr
-SUBJECT=user openssl x509 -set_serial 7 -days $DAYS -req -CA ca.pem \
-    -CAkey privkey.pem -out generic.pem -in generic.csr
-openssl pkcs12 -export -in generic.pem -inkey privkey.pem -out generic.p12 \
-    -passout pass:
-
-# Clean up.
-rm -f openssl.cnf kdc.csr user.csr user-upn.csr user-upn2.csr user-upn3.csr
-rm -f generic.csr

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/privkey-enc.pem Deleted

@@ -1,30 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,9F0F79BAC91A7D02
-
-LiK+0vY3CKK7z7q/0576K/zcR/OzmiDMLdjQEN/en8Wk9fq9LkjbZ7xbnS5eNlZA
-6McUX32M5MvfJE5tVPcijdlenKg3LEVQh91Omb63DT9TJaM2I+zIwKmFS8l1qqbB
-tO5T3qChaHJ+vnmH24Ukn9wMZ/AgV7X0aSeIJ89B+kgYyBkfoh//h64dlWgqcd+L
-4+wo6azx6k9feFV2/WwdmEG+etMS4iw3kw7jdRVG6G1himsXc9AL35TD1CKX/OAj
-InMgrMaWmf7w8rO5LBNUj4i/lBjNjqElBRGZnfCmSpyoERDWv5JEBuSYjZaP6iPq
-XAisHkJmfubN9omah/y5aNsJ8jbMjZDhBxdzA1mGuteKfnkckOgZ1YXvAZGXGxd4
-cGFzVmRwgnktsycVGpAy2P1wnOdTgo+FUkMpRIwPc1EfiPiOscUTNyZKnkNbTBk0
-l51QXXvLaZaL/Q/9mF+QfdiBDXLtxu2ZU+miA7/srJSdSxqp1UQH9kO8t0UFv4tT
-Mc4JilR4W0+IxjTFvBqirpf64MJ6rL2f0ZdJ6k9l7nBnaIeT4G7KXhR3t0YbGqyK
-kOTeUibfdgMlj66R+KHg0mlDI6E5rM/1L5GchsKIsbJs4TgD1+fcEvJMTB1XCtWM
-usY3Y/JChquKbWngFrzqidcab0xO+RsFaxboMd/RoW3bsDOIiOmf+PQfPjXFpP23
-I3Plrm9DczQTbClt5YacW6g/aboMCHhjbCh8nBSEc5u0CssqmtHe2PST9XZZ/1ny
-t480up13b3rMX3QWr74gRQ4vGsBxmCbN1DdkglJYZzYtIoTH5qAeUk7oRrRCW8wj
-YkODoLLsb/1lJKHHlq8lj0h/ygn3aaYlmdXrXoPdnld0RwaS/35KjNZy6A6UEDGt
-z91615joi/m+V4GQr/OrJ+gWKp19Rs7qUViNPY/RkvdmWAlH7uz+kmo8hK5IeshD
-iWhZ179XIkX0YeeB8r2sRkO2qecVzRxhRtBFVt0MpuDUW3pZ+A6pB7utrKn2//TD
-ZqWbwpdVdolWjru5iDt88nLxXHEGSs7GprH2iL3/aNsOJ6BrUwNVx52YBEGeNhFW
-mH+E8nLQDaGgB68UnQUMzktrkmv2baAsPK1oQLDJSzN9nbhyE4ETiN2Ok1Kso30b
-fDRDUB3SbXldWUXtVmu+NzO8pJVFpQ1StXpWimrwjWB3Kbi8bs2VYai7+B4mTXYy
-8AVthJNuOnlvSB+FYMOaW9PrmuahgXT0wjsV2hkP+qe6mzj0AQHFpFJRuCtGuRog
-spA2SgQvMO4cceJ3cxh1p5Z2/s+oC3V3ikDSDvmcpU/4FF5H/4Th44RSmXABcr7L
-HFbYYKbJjfwlYh48feS7sJMAFlU41al8vCIJneNF8hSSFM05icZVBzqjDjzXHwb4
-kBvrIOtDf/CVZK9AzykvJRROIFI+2ifa+gPmTZ1Xgv0aqO8ibLSU8v2vx5RX2BCO
-Jq+lmYEr6PZn2X5C3iqE+xvdTz7Sh0+Ilq/lE4DEJqr4NtZaGxXBwFNixLHJlXfI
-u/LmbffnBsu2hf9zPxsmcm5yCqa9+XKtWNhx5PEcQsee6PXyGX/GHtek4pBOv/dd
------END RSA PRIVATE KEY-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/privkey.pem Deleted

@@ -1,27 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEAvq6eZ7Cigf5dH22+PlW3AP65TJ35ggGx5aNBl+Xjjup2Y1qH
-e2o/pUIEavg3d9hmus8ovsJEuWxsXyo/navpScSNUbBW5ig2jgSmzQOA1Lv5dzG+
-JgF71EI8kfe3/Y+1js2udpbsD+HjvU3QgZOPDO514gGLEt8UpyfymvBBz7ohDpPP
-dGD/hcJMXEiSNvLhVbIoENY6l5reA8z129Hs+JWycJ8ImUUH72bt6cP348WuJ7RQ
-zt7NrBnnXiPGjWW5l9ewUkOkHpmLeIADyA3NUAXYI40whJkOUPhtMW2PnzM9CYKF
-pCVh4SKx71iB9KO5Y4sLHs9neXQncmhtr6lzEQIDAQABAoIBAQC0kY2F6ZnqeeLb
-eUQXqXnUYmM877gwacR6DqB15IgadWNI8JitwU6mAx9F4Oo9/lpB+xy9kCAea1Mw
-x0RY3kvbxFqDCfcwmtIWqMcAC5o7WgqB2kQTn4IQ3eyX2bqNTkKDCbl1qbO/0oyk
-XoTdv8tOVp6hOA7n/wKCzGyMVoor15PhlClBqbrAEIqBQUxfxthWibJXexlyX0ie
-MOCmEleQ4zPrQM0cY6yoz3RhM4PVybVSapPMv11czfLPc2o7s5tPgRU+rRSGeoJC
-Vp1EsaVVyZtYpNboKNsNojeJOoO3Gq5VRCjHImCa//05hnqBR1LWB+b1dvTRziwV
-z4985FBBAoGBAPqbs6bVLL2jDNEEmc+U+gEf5nh4GSlRUeioFDMM1Dd2fDTQAgiM
-0XI+a0NgZdjQI6fX3u+j5I9Ss1nfC09MzJsNxyKtjvAkQQsc6VDdZFEfHmC+qeTH
-E4oOsD3dEv8dHuopHUbguw9sztsONbF7Bc9fhBr3wU+bO5zrdM/ry3wZAoGBAMLI
-2zz+8NISHbSGE7mEJdAUdRyJVYXOp1NTzclgL6B3PD+hm8pCGQEVQa/SdWC6gJqJ
-w9sUhC+0chu9i/dl9nnES5hXJqE+fXmAsG+slv0WIATrwMzxWDYPTODe5AvEniIY
-RkQ1BDar0G7rcxxomREaPsteYBvh9DlIICgQu425AoGBAIQokjAb4VFMaBjeJULs
-HH91VDQZmaNJaDmaUbSuQkfRayTqwPfDUzy9IBHTB0K0WOlNlRqpQoI2qbBuSGeU
-Z54pQOfPwT5w0ABNSdlEN3/0Oi/ovG2ScoJuxpCJQlhZAhGYhwD2yI8U4W1x6+zh
-pKm8hE04dLBHe8OABAUWIyQZAoGAOUXh4O99U+drwJbj2dqXW7WIMdnXwb5fyMqN
-abbUijRFDNix/CivPXhIljAlv0lXYxk684H21CgUnT+Alj/u1yL2r1aAz0yWjFFg
-j5WJ1+TXiVrgl+Im885P5pbjKuqnLJNCpe+Iy6J9aP/mGuZOi47SA+4+CDTKIMWq
-Xt18qFECgYEAhVIGySQMn7u2MB7mywMQ0EQznxHBrFHDPUv0D6QuMvhUv70XUE8e
-jVad6Wev3+hTYaoELntMQaW0VmbMrhtP6WmviENkT0eV5CZJgLEVrzGAGtYQOut3
-HUO1wgqEEQK9iu4vTPddsUTj/zsXR3SzCBrqGu6p6Xl7YIiecYzACZ8=
------END RSA PRIVATE KEY-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user-enc.p12 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user-upn.p12 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user-upn.pem Deleted

@@ -1,28 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIExTCCA62gAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
-FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
-A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
-dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
-b3RoZXJ3aXNlMB4XDTE5MDIxODAwMjU1NVoXDTMwMDEzMTAwMjU1NVowSjELMAkG
-A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
-U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAvq6eZ7Cigf5dH22+PlW3AP65TJ35ggGx5aNBl+Xjjup2Y1qHe2o/pUIE
-avg3d9hmus8ovsJEuWxsXyo/navpScSNUbBW5ig2jgSmzQOA1Lv5dzG+JgF71EI8
-kfe3/Y+1js2udpbsD+HjvU3QgZOPDO514gGLEt8UpyfymvBBz7ohDpPPdGD/hcJM
-XEiSNvLhVbIoENY6l5reA8z129Hs+JWycJ8ImUUH72bt6cP348WuJ7RQzt7NrBnn
-XiPGjWW5l9ewUkOkHpmLeIADyA3NUAXYI40whJkOUPhtMW2PnzM9CYKFpCVh4SKx
-71iB9KO5Y4sLHs9neXQncmhtr6lzEQIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFGxN
-/r1v8njf7axXLec5+PyebI4WMIHUBgNVHSMEgcwwgcmAFGxN/r1v8njf7axXLec5
-+PyebI4WoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
-ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
-IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
-aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
-BAQDAgPoMAwGA1UdEwEB/wQCMAAwKwYDVR0RBCQwIqAgBgorBgEEAYI3FAIDoBIM
-EHVzZXJAa3JidGVzdC5jb20wEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0B
-AQsFAAOCAQEAeZXuyTRD2XQEcUoOYRXn6V1Glh61eHJ4e5ggp0QmTZoij8Y5YdmV
-jt4N8PE1wdXr0f7+a49Zh+YrKt7NZw4HlevYSMIyHVEeLe05zTFYL0w9R1P+16pf
-iSLmmwXZXBPX0biQq2wklD71GBFh/FF02uuetA/iPLMXvgfEUnbjVCcLpTc2/ISg
-tkGvWXtE06YXwSn3ANbCQPLifUKW2PZ8jGBOLLvslebvvJruWyfFLolkNsyA+ljr
-GvWZMxKTOD3LECHvLWFfl7xJsUNqL5qptz0baxeCrmaAdQdHvs4DApxebh1BZGn8
-KFV4g+N0Qz28tO0GSEA3cd2JHVz+wWQp7Q==
------END CERTIFICATE-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user-upn2.p12 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user-upn2.pem Deleted

@@ -1,28 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEuTCCA6GgAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
-FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
-A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
-dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
-b3RoZXJ3aXNlMB4XDTE5MDIxODAwMjU1NVoXDTMwMDEzMTAwMjU1NVowSjELMAkG
-A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
-U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAvq6eZ7Cigf5dH22+PlW3AP65TJ35ggGx5aNBl+Xjjup2Y1qHe2o/pUIE
-avg3d9hmus8ovsJEuWxsXyo/navpScSNUbBW5ig2jgSmzQOA1Lv5dzG+JgF71EI8
-kfe3/Y+1js2udpbsD+HjvU3QgZOPDO514gGLEt8UpyfymvBBz7ohDpPPdGD/hcJM
-XEiSNvLhVbIoENY6l5reA8z129Hs+JWycJ8ImUUH72bt6cP348WuJ7RQzt7NrBnn
-XiPGjWW5l9ewUkOkHpmLeIADyA3NUAXYI40whJkOUPhtMW2PnzM9CYKFpCVh4SKx
-71iB9KO5Y4sLHs9neXQncmhtr6lzEQIDAQABo4IBSjCCAUYwHQYDVR0OBBYEFGxN
-/r1v8njf7axXLec5+PyebI4WMIHUBgNVHSMEgcwwgcmAFGxN/r1v8njf7axXLec5
-+PyebI4WoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
-ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
-IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
-aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
-BAQDAgPoMAwGA1UdEwEB/wQCMAAwHwYDVR0RBBgwFqAUBgorBgEEAYI3FAIDoAYM
-BHVzZXIwEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0BAQsFAAOCAQEAWf0/
-d0284FjoywSaPpXvy4sJ3N+Ts1bXmM9NtJT+pKDpyMEisNFQ/kqO2UURT+9dZP5o
-yzMttuNdi0lJ4W8gXE5CeMDJv1z9HUXl6blDOh7YYdqM9Y6rBIKwZHyFZzSlgGIQ
-KHfDbj2dmOJLVPfLZM+MA42G1nmfQPGUMcc4mLp8Xu8x7LXCxJBuXV/gxSEMbLrm
-YNj/mXQJhQwYIZdeBZIBUcdU2rD2bMbHcWAs183ddEg3+CSN8fdppsFT1ZX4ZlPk
-XGSrv9EYC4GLZpLOtB3FwUQ1TmEDMJqzifY8jcS03UdQ0gKZBm83rVMnXvU01CgA
-MI9PN0lFwPEutERN0g==
------END CERTIFICATE-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user-upn3.p12 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user-upn3.pem Deleted

@@ -1,28 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIExTCCA62gAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
-FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
-A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
-dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
-b3RoZXJ3aXNlMB4XDTE5MDIxODAwMjU1NVoXDTMwMDEzMTAwMjU1NVowSjELMAkG
-A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
-U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAvq6eZ7Cigf5dH22+PlW3AP65TJ35ggGx5aNBl+Xjjup2Y1qHe2o/pUIE
-avg3d9hmus8ovsJEuWxsXyo/navpScSNUbBW5ig2jgSmzQOA1Lv5dzG+JgF71EI8
-kfe3/Y+1js2udpbsD+HjvU3QgZOPDO514gGLEt8UpyfymvBBz7ohDpPPdGD/hcJM
-XEiSNvLhVbIoENY6l5reA8z129Hs+JWycJ8ImUUH72bt6cP348WuJ7RQzt7NrBnn
-XiPGjWW5l9ewUkOkHpmLeIADyA3NUAXYI40whJkOUPhtMW2PnzM9CYKFpCVh4SKx
-71iB9KO5Y4sLHs9neXQncmhtr6lzEQIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFGxN
-/r1v8njf7axXLec5+PyebI4WMIHUBgNVHSMEgcwwgcmAFGxN/r1v8njf7axXLec5
-+PyebI4WoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
-ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
-IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
-aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
-BAQDAgPoMAwGA1UdEwEB/wQCMAAwKwYDVR0RBCQwIqAgBgorBgEEAYI3FAIDoBIM
-EHVzZXJAS1JCVEVTVC5DT00wEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0B
-AQsFAAOCAQEAF/V+Cx49jH70LMI7S7SGDFWr6/rtYwjJax7RgZN6JZlakd1R6GHa
-JHwUMmf67V/R3qVWfThhbKjxumEY+whxiszegDwBZC+fFiYbaQMCIchHkx8vkdmK
-ZJ9VznDiA/kp0Ty8JZKG6TMRkkxUo+csEXU4E6TZFZaz9pfPrhxHU21uPbeDeE3h
-sUiUqH7oZBjmSS+2OmAu0v4+/Ex0QkqJACvZYNA5zFpgV0Ux/26EQt/bKiYkXYZq
-CIWP7cd/MRfNqeqlbUVpKcIkk5WPpuqPVffA+f2B1Al5iJ8o1pzqN+awZBLLZv3F
-p1+AeVD5nvWpyHSXmst32OYPPTBL9Yk3uA==
------END CERTIFICATE-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user.p12 Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/pkinit-certs/user.pem Deleted

@@ -1,28 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE0zCCA7ugAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
-FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
-A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
-dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
-b3RoZXJ3aXNlMB4XDTE5MDIxODAwMjU1NVoXDTMwMDEzMTAwMjU1NVowSjELMAkG
-A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
-U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAvq6eZ7Cigf5dH22+PlW3AP65TJ35ggGx5aNBl+Xjjup2Y1qHe2o/pUIE
-avg3d9hmus8ovsJEuWxsXyo/navpScSNUbBW5ig2jgSmzQOA1Lv5dzG+JgF71EI8
-kfe3/Y+1js2udpbsD+HjvU3QgZOPDO514gGLEt8UpyfymvBBz7ohDpPPdGD/hcJM
-XEiSNvLhVbIoENY6l5reA8z129Hs+JWycJ8ImUUH72bt6cP348WuJ7RQzt7NrBnn
-XiPGjWW5l9ewUkOkHpmLeIADyA3NUAXYI40whJkOUPhtMW2PnzM9CYKFpCVh4SKx
-71iB9KO5Y4sLHs9neXQncmhtr6lzEQIDAQABo4IBZDCCAWAwHQYDVR0OBBYEFGxN
-/r1v8njf7axXLec5+PyebI4WMIHUBgNVHSMEgcwwgcmAFGxN/r1v8njf7axXLec5
-+PyebI4WoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
-ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
-IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
-aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
-BAQDAgPoMAwGA1UdEwEB/wQCMAAwOQYDVR0RBDIwMKAuBgYrBgEFAgKgJDAioA0b
-C0tSQlRFU1QuQ09NoREwD6ADAgEBoQgwBhsEdXNlcjASBgNVHSUECzAJBgcrBgEF
-AgMEMA0GCSqGSIb3DQEBCwUAA4IBAQAOBmEbWERHmV5YfMrOIY36mevch2KJokw9
-LXZqnKI4oezajEMwx0Wv+M/Gb4ZuYrfobiHSvfzCPUXyyRVWPr8sFBvDXnoBSlos
-g+Y2O8+toyJ8u8gn63SrnPOHCdYkClkDeHI3EzuIcLfgn+Uyg9lkQOjBBNj5O42K
-GoTNCuhoB6IAa66JD2u7E7pfBnceSUYP1DTlCK9l+1C+zOAEuG2N8K4n0ZRZbVqd
-2euMypjorJwgebOzlk86TNzOb5IP8G6phs7D4tvhe7J6mfJ3tFmGbH8V7jY51iCT
-EFQgm39U4J+2uQ0LlEsE3v7wXGW3MLUBY6STcGPwkBrxcmsdKNmy
------END CERTIFICATE-----

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/proxy-certs Deleted

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/dejagnu/t_inetd.c Deleted

@@ -1,142 +0,0 @@
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* tests/dejagnu/t_inetd.c */
-/*
- * Copyright 1991 by the Massachusetts Institute of Technology.
- * All Rights Reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * A simple program to simulate starting a process from inetd.
- *
- * Unlike a proper inetd situation, environment variables are passed
- * to the client.
- *
- * usage: t_inetd port program argv0 ...
- */
-
-#include "autoconf.h"
-
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netdb.h>
-#include <stdio.h>
-#include <string.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <signal.h>
-
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-
-#include "com_err.h"
-
-
-char *progname;
-
-static void usage()
-{
-    fprintf(stderr, "%s: port program argv0 argv1 ...\n", progname);
-    exit(1);
-}
-
-int
-main(argc, argv)
-    int argc;
-    char **argv;
-{
-    unsigned short port;
-    char *path;
-    int sock, acc;
-    int one = 1;
-    struct sockaddr_in l_inaddr, f_inaddr;  /* local, foreign address */
-    socklen_t namelen = sizeof(f_inaddr);
-#ifdef POSIX_SIGNALS
-    struct sigaction csig;
-#endif
-
-    progname = argv0;
-
-    if(argc <= 3) usage();
-
-    if(atoi(argv1) == 0) usage();
-
-    port = htons(atoi(argv1));
-    path = argv2;
-
-    if ((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
-        com_err(progname, errno, "creating socket");
-        exit(3);
-    }
-
-    (void) setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (char *)&one,
-                      sizeof (one));
-
-    memset(&l_inaddr, 0, sizeof(l_inaddr));
-    l_inaddr.sin_family = AF_INET;
-    l_inaddr.sin_addr.s_addr = 0;
-    l_inaddr.sin_port = port;
-
-    if (bind(sock, (struct sockaddr *)&l_inaddr, sizeof(l_inaddr))) {
-        com_err(progname, errno, "binding socket");
-        exit(3);
-    }
-
-    if (listen(sock, 1) == -1) {
-        com_err(progname, errno, "listening");
-        exit(3);
-    }
-
-    printf("Ready!\n");
-    fflush(stdout);
-    if ((acc = accept(sock, (struct sockaddr *)&f_inaddr,
-                      &namelen)) == -1) {
-        com_err(progname, errno, "accepting");
-        exit(3);
-    }
-
-    dup2(acc, 0);
-    dup2(acc, 1);
-    dup2(acc, 2);
-    close(sock);
-    sock = 0;
-
-    /* Don't wait for a child signal... Otherwise dejagnu gets confused */
-#ifdef POSIX_SIGNALS
-    csig.sa_handler = (RETSIGTYPE (*)())0;
-    sigemptyset(&csig.sa_mask);
-    csig.sa_flags = 0;
-    sigaction(SIGCHLD, &csig, (struct sigaction *)0);
-#else
-    signal(SIGCHLD, SIG_IGN);
-#endif
-
-    if(execv(path, &argv3))
-        fprintf(stderr, "t_inetd: Could not exec %s\n", path);
-    exit(1);
-}

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/profile/prof_test1 Deleted

@@ -1,377 +0,0 @@
-# To do: Should run all tests and return a useful exit status, not
-# punt on the first failure.
-
-set wd pwd
-set verbose 0
-
-proc test1 {} {
-    global wd verbose
-    set p profile_init_path $wd/test2.ini
-    set sect {{test section 1} child_section child}
-    set iter profile_iterator_create $p $sect 0
-    set done 0
-    if $verbose { puts "Iterating over {$sect} entries:" }
-    while {!$done} {
-	set pair profile_iterator $iter
-	if string match $pair {{} {}} {
-	    set done 1
-	} else {
-	    set val lindex $pair 1
-	    if $verbose { puts -nonewline "\t$val" }
-	}
-    }
-    if $verbose { puts "" }
-    profile_iterator_free $iter
-
-    set iter profile_iterator_create $p $sect 0
-    set done 0
-    if $verbose { puts "Iterating again, deleting:" }
-    while {!$done} {
-	set pair profile_iterator $iter
-	if string match $pair {{} {}} {
-	    set done 1
-	} else {
-	    set val lindex $pair 1
-	    if $verbose { puts -nonewline "\t$val" }
-	    profile_update_relation $p $sect $val
-	}
-    }
-    if $verbose { puts "" }
-    profile_iterator_free $iter
-    catch {file delete $wd/test3.ini}
-    profile_flush_to_file $p $wd/test3.ini
-    profile_abandon $p
-
-    if $verbose { puts "Reloading new profile" }
-    set p profile_init_path $wd/test3.ini
-    set iter profile_iterator_create $p $sect 0
-    set done 0
-    if $verbose { puts "Iterating again:" }
-    set found_some 0
-    while {!$done} {
-	set pair profile_iterator $iter
-	if string match $pair {{} {}} {
-	    set done 1
-	} else {
-	    set found_some 1
-	    set val lindex $pair 1
-	    if $verbose { puts -nonewline "\t$val" }
-	}
-    }
-    profile_iterator_free $iter
-    profile_abandon $p
-
-    if {$found_some} {
-	if $verbose { puts "" }
-	puts stderr "Error: Deleting in iterator didn't get them all."
-	exit 1
-    } else {
-	puts "OK: test1: Deleting in iteration got rid of all entries."
-    }
-}
-
-proc test2 {} {
-    global wd verbose
-
-    # lxs said: create A, read A, flush A, read A, create B, read B, crash
-    # (where "create" refers to the object, not the file)
-
-    if $verbose { puts "Running test2" }
-    set c profile_init_path $wd/test2.ini
-    # create A
-    set a profile_init_path $wd/test2.ini
-    if $verbose { puts "Opened profile $wd/test2.ini" }
-    # read A
-    set x profile_get_values $a {{test section 1} foo}
-    if $verbose { puts "Read $x from profile" }
-    if $verbose { puts "updating" }
-    exec sleep 2
-    profile_update_relation $a {{test section 1} foo} lindex $x 0 lindex $x 0
-    set x profile_get_values $a {{test section 1} foo}
-    if $verbose { puts "Read $x from profile" }
-    # flush A
-    profile_flush $a
-    # read A again
-    set x profile_get_values $a {{test section 1} foo}
-    if $verbose { puts "Read $x from profile" }
-    profile_release $a
-    # create B
-    set b profile_init_path $wd/test2.ini
-    if $verbose { puts "Opened profile again" }
-    # read B
-    set x profile_get_values $b {{test section 1} foo}
-    if $verbose { puts "Read $x from profile" }
-    # read B
-    set x profile_get_values $b {{test section 1} foo}
-    if $verbose { puts "Read $x from profile" }
-    # If we got this far, now what?
-    profile_release $b
-    profile_release $c
-    puts "OK: test2: Modifications don't corrupt existing open handles"
-}
-
-proc test3 {} {
-    # lxs said: Start with a relation in the file.  Open, delete
-    # relation, add relation back, list relations.  In 1.4 release
-    # code, got two back.
-
-    global wd verbose
-
-    exec cp $wd/test2.ini $wd/test1c.ini
-    set p profile_init_path $wd/test1c.ini
-    set sect {{test section 1} quux}
-
-    set v profile_get_values $p $sect
-    set v1 lindex $v 0
-    if $verbose { puts "Old values: $v" }
-    profile_clear_relation $p $sect
-    if $verbose { puts "Cleared." }
-    # profile_get_values raises an exception if no data is there; so if
-    # it succeeds, the test fails.
-    catch {
-	set v profile_get_values $p $sect
-	if $verbose { puts "New values: $v" }
-	puts stderr "Error: test3: Clearing relation didn't get rid of all values."
-	exit 1
-    }
-    if $verbose { puts "Adding back $v1 ..." }
-    profile_add_relation $p $sect $v1
-    set v profile_get_values $p $sect
-    if $verbose { puts "New values: $v" }
-    if llength $v!=1 {
-	puts stderr "Error: test3: Adding one entry after clearing relation leaves llength $v entries."
-	exit 1
-    }
-    profile_abandon $p
-    file delete $wd/test1c.ini
-    puts "OK: test3: Clearing relation and adding one entry yields correct count."
-}
-
-# Exercise the include and includedir directives.
-proc test4 {} {
-    global wd verbose
-
-    # Test expected error message when including nonexistent file.
-    catch file delete $wd/testinc.ini
-    exec echo "include does-not-exist" >$wd/testinc.ini
-    catch { profile_init_path $wd/testinc.ini } err
-    if $verbose { puts "Got error message $err" }
-    if !string equal $err "Included profile file could not be read" {
-	puts stderr "Error: test4: Did not get expected error when including nonexistent file."
-	exit 1
-    }
-
-    # Test expected error message when including nonexistent directory.
-    catch file delete $wd/testinc.ini
-    exec echo "includedir does-not-exist" >$wd/testinc.ini
-    catch { profile_init_path $wd/testinc.ini } err
-    if $verbose { puts "Got error message $err" }
-    if !string equal $err "Included profile directory could not be read" {
-	puts stderr "Error: test4: Did not get expected error when including nonexistent directory."
-	exit 1
-    }
-
-    # Test including a file.
-    catch file delete $wd/testinc.ini
-    exec echo "include $wd/test2.ini" >$wd/testinc.ini
-    set p profile_init_path $wd/testinc.ini
-    set x profile_get_values $p {{test section 1} bar}
-    if $verbose { puts "Read $x from included profile" }
-    if !string equal lindex $x 0 "foo" {
-	puts stderr "Error: test4: Did not get expected result from included profile."
-	exit 1
-    }
-    profile_release $p
-
-    # Test including a directory.  Put four copies of test2.ini inside
-    # the directory, two with invalid names.  Check that we get two
-    # values for one of the variables.
-    catch file delete -force $wd/test_include_dir
-    exec mkdir $wd/test_include_dir
-    exec cp $wd/test2.ini $wd/test_include_dir/a
-    exec cp $wd/test2.ini $wd/test_include_dir/a~
-    exec cp $wd/test2.ini $wd/test_include_dir/b.conf
-    exec cp $wd/test2.ini $wd/test_include_dir/b.conf.rpmsave
-    catch file delete $wd/testinc.ini
-    exec echo "includedir $wd/test_include_dir" >$wd/testinc.ini
-    set p profile_init_path $wd/testinc.ini
-    set x profile_get_values $p {{test section 1} bar}
-    if $verbose { puts "Read $x from included directory" }
-    if !string equal $x "foo foo" {
-	puts stderr, "Error: test4: Did not get expected result from included directory."
-	exit 1
-    }
-    profile_release $p
-
-    # Directly list the directory in the profile path and try again.
-    set p profile_init_path $wd/test_include_dir
-    set x profile_get_values $p {{test section 1} bar}
-    if $verbose { puts "Read $x from directory" }
-    if !string equal $x "foo foo" {
-	puts stderr, "Error: test4: Did not get expected result from directory."
-	exit 1
-    }
-    profile_release $p
-
-    puts "OK: test4: include and includedir directives"
-}
-
-proc test5 {} {
-    global wd verbose
-
-    # Test syntactic independence of included profile files.
-    catch file delete $wd/testinc.ini
-    set f open "$wd/testinc.ini" w
-    puts $f {sec1}
-    puts $f "var = {"
-    puts $f "a = 1"
-    puts $f "include testinc2.ini"
-    puts $f "c = 3"
-    puts $f "}"
-    close $f
-    catch file delete $wd/testinc2.ini
-    set f open "$wd/testinc2.ini" w
-    puts $f {sec2}
-    puts $f "b = 2"
-    close $f
-    set p profile_init_path $wd/testinc.ini
-    set a profile_get_values $p {sec1 var a}
-    set b profile_get_values $p {sec2 b}
-    set c profile_get_values $p {sec1 var c}
-    if $verbose { puts "Read values concat $a $b $c from profile" }
-    if { $a != 1 || $b != 2 || $c != 3 } {
-	puts stderr, "Error: test5: Wrong results from profile"
-	exit 1
-    }
-    profile_release $p
-
-    puts "OK: test5: syntax independence of included files"
-}
-
-proc test6 {} {
-    global wd verbose
-
-    # If a section is deleted and replaced, the new section should be
-    # used when retrieving values.
-    set p profile_init_path $wd/test2.ini
-    set sect {{test section 1}}
-    set newrel concat $sect testkey
-    set oldrel concat $sect child
-    if $verbose { puts "Removing and replacing {$sect}" }
-    profile_rename_section $p $sect
-    profile_add_relation $p $sect
-    if $verbose { puts "Adding {$newrel}" }
-    profile_add_relation $p $newrel 6
-    set x profile_get_values $p $newrel
-    if $verbose { puts "Read from new relation {$newrel}: $x" }
-    if { $x != 6 } {
-	puts stderr, "Error: test6: Could not get value from new section"
-	exit 1
-    }
-    if $verbose { puts "Reading old relation {$oldrel} which should be gone" }
-    catch {
-	profile_get_values $p $oldrel
-	puts stderr, "Error: test6: Got value from deleted section"
-	exit 1
-    }
-    profile_abandon $p
-
-    puts "OK: test6: section replacement"
-}
-
-proc test7 {} {
-    global wd verbose
-
-    # A deleted node at the end of a relation's value set should not cause
-    # profile_clear_relation to error, as long as some value is present.
-    set p profile_init_path $wd/test2.ini
-    set rel {{test section 1} testkey}
-    if $verbose { puts "Adding values 1 2 at {$rel}" }
-    profile_add_relation $p $rel 1
-    profile_add_relation $p $rel 2
-    if $verbose { puts "Removing value 2 at {$rel}" }
-    profile_update_relation $p $rel 2
-    if $verbose { puts "Clearing values at {$rel}" }
-    profile_clear_relation $p $rel
-    profile_abandon $p
-    puts "OK: test7: profile_clear_relation with deleted node at end"
-}
-
-proc test8 {} {
-    global wd verbose
-
-    # Order of relation operations should be reflected even if some of
-    # the relations were deleted.
-    set p profile_init_path $wd/test2.ini
-    set rel {{test section 1} testkey}
-    if $verbose { puts "Adding values 1 2 3 at {$rel}" }
-    profile_add_relation $p $rel 1
-    profile_add_relation $p $rel 2
-    profile_add_relation $p $rel 3
-    if $verbose { puts "Removing values 2 and adding 4 at {$rel}" }
-    profile_update_relation $p $rel 2
-    profile_add_relation $p $rel 4
-    set x profile_get_values $p $rel
-    if $verbose { puts "Read values from {$rel}: $x" }
-    if { $x != {1 3 4} } {
-	puts stderr, "Error: test8: Wrong order of values: $x"
-	exit 1
-    }
-    profile_abandon $p
-
-    puts "OK: test8: relation order in the presence of deletions"
-}
-
-proc test9 {} {
-    global wd verbose
-
-    # Regression test for #8431: profile_flush_to_file erroneously
-    # cleared the DIRTY and SHARED flags from the data object, which
-    # could lead to a dangling reference in g_shared_trees on release.
-    set p profile_init_path $wd/test2.ini
-    catch {file delete $wd/test3.ini}
-    profile_flush_to_file $p $wd/test3.ini
-    profile_release $p
-
-    # If a dangling reference was created in g_shared_trees, the next
-    # profile open will trigger an assertion failure.
-    set p profile_init_path $wd/test2.ini
-    profile_release $p
-
-    puts "OK: test9: profile_flush_to_file with no changes"
-}
-
-proc test10 {} {
-    global wd verbose
-
-    # Regression test for #7863: multiply-specified subsections should
-    # be merged.
-    set p profile_init_path $wd/test2.ini
-    set x profile_get_values $p {{test section 2} child_section2 child}
-    if $verbose { puts "Read $x from profile" }
-    if !string equal $x "slick harry {john\tb } ron" {
-	puts stderr "Error: test10: Did not get expected merged children."
-	exit 1
-    }
-
-    set x profile_get_string $p {test section 2} child_section2 chores
-    if $verbose { puts "Read $x from profile" }
-    if !string equal $x "cleaning" {
-	puts stderr "Error: test10: Did not find expected chores."
-	exit 1
-    }
-    profile_release $p
-}
-
-test1
-test2
-test3
-test4
-test5
-test6
-test7
-test8
-test9
-test10
-
-exit 0

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/profile/profile.swg Deleted

@@ -1,258 +0,0 @@
-%{
-/*
- * Copyright 2004, 2008 by the Massachusetts Institute of Technology.
- * All Rights Reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- * 
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- *
- *
- * Input for wrapper generator program SWIG for profile routines.
- */
-#include <errno.h>
-#include "com_err.h"
-#include "profile.h"
-
-#ifdef SWIGTCL
-/* Reduce warnings about cast discarding const to just this one, from
-   every SWIG-generated call to Tcl_SetResult.  */
-static void my_tcl_setresult(Tcl_Interp *i, const char *str, Tcl_FreeProc *f)
-{
-    Tcl_SetResult(i, (char *) str, f);
-}
-#undef Tcl_SetResult
-#define Tcl_SetResult my_tcl_setresult
-#endif
-%}
-
-%include "typemaps.i"
-
-/* These should perhaps be part of the general SWIG package, maybe?  */
-%typemap(in,numinputs=0) SWIGTYPE *OUTPUT ($1_basetype tmp) {
-    /*generic swigtype hack*/ $1 = &tmp;
-}
-%typemap(tcl8,argout) SWIGTYPE *OUTPUT
-  "/*generic swigtype hack*/ Tcl_SetObjResult(interp,SWIG_NewInstanceObj((void *) *$1, $*1_descriptor,0));";
-%typemap(python,argout) SWIGTYPE *OUTPUT
-  "/*generic swigtype hack*/ resultobj = SWIG_NewPointerObj((void *) *$1, $*1_descriptor,0);";
-
-%module profile
-
-typedef long errcode_t;
-%inline %{
-typedef void **iter_t; /* ick */
-%}
-
-/* As a hack, if we have too much trouble trying to manage output
-   arguments for functions returning error codes, this output argument
-   type will let us twist it around into a function returning the
-   interesting type, and incidentally possibly raising an error.  */
-%typemap(in,numinputs=0) errcode_t * (errcode_t tmp) {
-    /* in errcode_t * */
-    tmp = 0;
-    $1 = &tmp;
-}
-%typemap(tcl8,argout) errcode_t* {
-    /* argout errcode_t * */
-    if (*$1) {
-	/* There could be a memory leak here in the SWIG-Tcl layer,
-	   I'm not sure.  Not going to worry about it though.  */
-	Tcl_SetResult(interp, (char *) error_message(*$1), TCL_STATIC);
-	SWIG_fail;
-    }
-}
-/* returning errcode_t */
-%typemap(tcl8,out) errcode_t {
-    /* out errcode_t $1 */
-    if ($1) {
-	/* There could be a memory leak here in the SWIG-Tcl layer,
-	   I'm not sure.  Not going to worry about it though.  */
-	Tcl_SetResult(interp, (char *) error_message($1), TCL_STATIC);
-	SWIG_fail;
-    }
-}
-%typemap(python,argout) errcode_t* {
-    /* do something with *($1) */ abort();
-}
-%typemap(python,out) errcode_t {
-    /* do something with $1 */ abort();
-}
-
-/* "char **OUTPUT" : Supply a place for the function to stuff one
-   string pointer.  */
-%typemap(in,numinputs=0) char **OUTPUT (char * tmp) {
-    /* in char **OUTPUT */
-    tmp = NULL;
-    $1 = &tmp;
-}
-%typemap(tcl8,argout) char **OUTPUT {
-    /* argout char **OUTPUT */
-/*    Tcl_SetResult(interp, *$1, TCL_DYNAMIC); */
-    char *s = ($1 && *$1) ? *$1 : "";
-    Tcl_ListObjAppendElement(interp, Tcl_GetObjResult(interp),
-			     Tcl_NewStringObj(s, strlen(s)));
-}
-%typemap(freearg) char **OUTPUT {
-    /* There may be a memory leak here.  Investigate later, if anyone
-       cares.  */
-/*    profile_release_string(*$1); */
-}
-
-/* "char **nullterm" : Null-terminated list of strings, from a single
-   input value which is a list.  */
-%typemap(tcl8,in) char **nullterm {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj($input,NULL), &n, (const char ***) &$1) == TCL_ERROR) SWIG_fail;
-}
-%typemap(tcl8,freearg) char **nullterm {
-    /* freearg char **nullterm */
-    if ($1) { Tcl_Free((char *)$1); $1 = (char **) NULL; }
-}
-
-/* "char ***OUTPUT" : Supply a place for the function to stuff a
-   pointer to a list of strings, which will be combined into a list to
-   return, and the data from the function itself freed before
-   returning.  */
-%typemap(in,numinputs=0) char ***OUTPUT (char ** tmp) {
-    /* in char ***OUTPUT */
-    tmp = NULL;
-    $1 = &tmp;
-}
-%typemap(tcl8,argout) char ***OUTPUT {
-    /* argout char ***OUTPUT */
-    int i;
-    for (i = 0; (*$1)i; i++)
-	Tcl_AppendElement(interp, (*$1)i);
-}
-%typemap(tcl8,freearg) char ***OUTPUT {
-    /* freearg char ***OUTPUT */
-    profile_free_list(*$1);
-}
-
-typedef struct _profile_t *profile_t;
-
-errcode_t profile_init_path(const char *path = NULL, profile_t *OUTPUT);
-errcode_t profile_init(const char **nullterm = NULL, profile_t *OUTPUT);
-errcode_t profile_flush(profile_t);
-errcode_t profile_flush_to_file(profile_t, const char *path);
-/* Nota bene: There is nothing at all in this code to prevent a script
-   from accessing a profile object after calling one of these routines
-   to destroy it!  */
-void profile_abandon(profile_t);
-void profile_release(profile_t);
-
-errcode_t profile_get_values(profile_t p, const char **nullterm,
-			     char ***OUTPUT);
-
-/* XXX Because of the way this is specified, the default can only be
-   given if you're actually using all three names (e.g., for realm
-   data).  SWIG currently doesn't support a non-optional argument (at
-   the scripting-language level -- the output-only argument doesn't
-   count) after an optional one.  */
-extern errcode_t profile_get_string(profile_t p,
-				    const char *name,
-				    const char *subname,
-				    const char *subsubname = NULL,
-				    const char *defval = NULL,
-				    char **OUTPUT);
-
-errcode_t profile_get_integer(profile_t p,
-			      const char *name,
-			      const char *subname,
-			      const char *subsubname = NULL,
-			      int defval = 0,
-			      int *OUTPUT);
-errcode_t profile_get_boolean(profile_t p,
-			      const char *name,
-			      const char *subname,
-			      const char *subsubname = NULL,
-			      int defval = 0,
-			      int *OUTPUT);
-errcode_t profile_get_relation_names(profile_t p,
-				     const char **nullterm,
-				     char ***OUTPUT);
-errcode_t profile_get_subsection_names(profile_t p,
-				       const char **nullterm,
-				       char ***OUTPUT);
-
-%rename("profile_iterator_create") iter_create;
-%rename("profile_iterator_free") iter_free;
-%inline %{
-static errcode_t iter_create(profile_t p, const char **nullterm,
-			     int flags, iter_t *OUTPUT)
-{
-    iter_t it;
-    errcode_t err;
-    const char **args;
-
-    it = malloc(sizeof(*it));
-    if (it == NULL)
-	return ENOMEM;
-    {
-	/* Memory leak!
-
-	   The profile code seems to assume that I'll keep the string
-	   array around for as long as the iterator is valid; I can't
-	   create the iterator and then throw them away.
-
-	   But right now, I can't be bothered to track the necessary
-	   information to do the cleanup later.  */
-	int count, j;
-	for (count = 0; nulltermcount; count++) ;
-	args = calloc(count+1, sizeof(char *));
-	if (args == NULL)
-	    return ENOMEM;
-	for (j = 0; j < count; j++) {
-	    argsj = strdup(nulltermj);
-	    if (argsj == NULL)
-		return ENOMEM;
-	}
-	argsj = NULL;
-    }
-    err = profile_iterator_create(p, args, flags, it);
-    if (err)
-	free(it);
-    else
-	*OUTPUT = it;
-    return err;
-}
-static void iter_free(iter_t i)
-{
-    profile_iterator_free(i);
-    free(i);
-}
-%}
-errcode_t profile_iterator(iter_t, char **OUTPUT, char **OUTPUT);
-
-
-errcode_t profile_update_relation(profile_t p, const char **nullterm,
-				  const char *oldval,
-				  const char *newval = NULL);
-errcode_t profile_clear_relation(profile_t p, const char **nullterm);
-errcode_t profile_rename_section(profile_t p, const char **nullterm,
-				 const char *new_name = NULL);
-errcode_t profile_add_relation(profile_t p, const char **nullterm,
-			       const char *new_val = NULL);
-/* XXX Should be using profile_free_buffer blah.  */
-errcode_t profile_flush_to_buffer(profile_t p, char **OUTPUT);
-
-#ifdef SWIGTCL
-%include "tclsh.i"
-#endif

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/profile/profile_tcl.c Deleted

@@ -1,3369 +0,0 @@
-/* ----------------------------------------------------------------------------
- * This file was automatically generated by SWIG (http://www.swig.org).
- * Version 1.3.40
- *
- * This file is not intended to be easily readable and contains a number of
- * coding conventions designed to improve portability and efficiency. Do not make
- * changes to this file unless you know what you are doing--modify the SWIG
- * interface file instead.
- * ----------------------------------------------------------------------------- */
-
-#define SWIGTCL
-
-/* -----------------------------------------------------------------------------
- *  This section contains generic SWIG labels for method/variable
- *  declarations/attributes, and other compiler dependent labels.
- * ----------------------------------------------------------------------------- */
-
-/* template workaround for compilers that cannot correctly implement the C++ standard */
-#ifndef SWIGTEMPLATEDISAMBIGUATOR
-# if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x560)
-#  define SWIGTEMPLATEDISAMBIGUATOR template
-# elif defined(__HP_aCC)
-/* Needed even with `aCC -AA' when `aCC -V' reports HP ANSI C++ B3910B A.03.55 */
-/* If we find a maximum version that requires this, the test would be __HP_aCC <= 35500 for A.03.55 */
-#  define SWIGTEMPLATEDISAMBIGUATOR template
-# else
-#  define SWIGTEMPLATEDISAMBIGUATOR
-# endif
-#endif
-
-/* inline attribute */
-#ifndef SWIGINLINE
-# if defined(__cplusplus) || (defined(__GNUC__) && !defined(__STRICT_ANSI__))
-#   define SWIGINLINE inline
-# else
-#   define SWIGINLINE
-# endif
-#endif
-
-/* attribute recognised by some compilers to avoid 'unused' warnings */
-#ifndef SWIGUNUSED
-# if defined(__GNUC__)
-#   if !(defined(__cplusplus)) || (__GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4))
-#     define SWIGUNUSED __attribute__ ((__unused__))
-#   else
-#     define SWIGUNUSED
-#   endif
-# elif defined(__ICC)
-#   define SWIGUNUSED __attribute__ ((__unused__))
-# else
-#   define SWIGUNUSED
-# endif
-#endif
-
-#ifndef SWIG_MSC_UNSUPPRESS_4505
-# if defined(_MSC_VER)
-#   pragma warning(disable : 4505) /* unreferenced local function has been removed */
-# endif
-#endif
-
-#ifndef SWIGUNUSEDPARM
-# ifdef __cplusplus
-#   define SWIGUNUSEDPARM(p)
-# else
-#   define SWIGUNUSEDPARM(p) p SWIGUNUSED
-# endif
-#endif
-
-/* internal SWIG method */
-#ifndef SWIGINTERN
-# define SWIGINTERN static SWIGUNUSED
-#endif
-
-/* internal inline SWIG method */
-#ifndef SWIGINTERNINLINE
-# define SWIGINTERNINLINE SWIGINTERN SWIGINLINE
-#endif
-
-/* exporting methods */
-#if (__GNUC__ >= 4) || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4)
-#  ifndef GCC_HASCLASSVISIBILITY
-#    define GCC_HASCLASSVISIBILITY
-#  endif
-#endif
-
-#ifndef SWIGEXPORT
-# if defined(_WIN32) || defined(__WIN32__) || defined(__CYGWIN__)
-#   if defined(STATIC_LINKED)
-#     define SWIGEXPORT
-#   else
-#     define SWIGEXPORT __declspec(dllexport)
-#   endif
-# else
-#   if defined(__GNUC__) && defined(GCC_HASCLASSVISIBILITY)
-#     define SWIGEXPORT __attribute__ ((visibility("default")))
-#   else
-#     define SWIGEXPORT
-#   endif
-# endif
-#endif
-
-/* calling conventions for Windows */
-#ifndef SWIGSTDCALL
-# if defined(_WIN32) || defined(__WIN32__) || defined(__CYGWIN__)
-#   define SWIGSTDCALL __stdcall
-# else
-#   define SWIGSTDCALL
-# endif
-#endif
-
-/* Deal with Microsoft's attempt at deprecating C standard runtime functions */
-#if !defined(SWIG_NO_CRT_SECURE_NO_DEPRECATE) && defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
-# define _CRT_SECURE_NO_DEPRECATE
-#endif
-
-/* Deal with Microsoft's attempt at deprecating methods in the standard C++ library */
-#if !defined(SWIG_NO_SCL_SECURE_NO_DEPRECATE) && defined(_MSC_VER) && !defined(_SCL_SECURE_NO_DEPRECATE)
-# define _SCL_SECURE_NO_DEPRECATE
-#endif
-
-
-
-#include <stdio.h>
-#include <tcl.h>
-#include <errno.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <ctype.h>
-
-/* -----------------------------------------------------------------------------
- * swigrun.swg
- *
- * This file contains generic C API SWIG runtime support for pointer
- * type checking.
- * ----------------------------------------------------------------------------- */
-
-/* This should only be incremented when either the layout of swig_type_info changes,
-   or for whatever reason, the runtime changes incompatibly */
-#define SWIG_RUNTIME_VERSION "4"
-
-/* define SWIG_TYPE_TABLE_NAME as "SWIG_TYPE_TABLE" */
-#ifdef SWIG_TYPE_TABLE
-# define SWIG_QUOTE_STRING(x) #x
-# define SWIG_EXPAND_AND_QUOTE_STRING(x) SWIG_QUOTE_STRING(x)
-# define SWIG_TYPE_TABLE_NAME SWIG_EXPAND_AND_QUOTE_STRING(SWIG_TYPE_TABLE)
-#else
-# define SWIG_TYPE_TABLE_NAME
-#endif
-
-/*
-  You can use the SWIGRUNTIME and SWIGRUNTIMEINLINE macros for
-  creating a static or dynamic library from the SWIG runtime code.
-  In 99.9% of the cases, SWIG just needs to declare them as 'static'.
-
-  But only do this if strictly necessary, ie, if you have problems
-  with your compiler or suchlike.
-*/
-
-#ifndef SWIGRUNTIME
-# define SWIGRUNTIME SWIGINTERN
-#endif
-
-#ifndef SWIGRUNTIMEINLINE
-# define SWIGRUNTIMEINLINE SWIGRUNTIME SWIGINLINE
-#endif
-
-/*  Generic buffer size */
-#ifndef SWIG_BUFFER_SIZE
-# define SWIG_BUFFER_SIZE 1024
-#endif
-
-/* Flags for pointer conversions */
-#define SWIG_POINTER_DISOWN        0x1
-#define SWIG_CAST_NEW_MEMORY       0x2
-
-/* Flags for new pointer objects */
-#define SWIG_POINTER_OWN           0x1
-
-
-/*
-   Flags/methods for returning states.
-
-   The SWIG conversion methods, as ConvertPtr, return and integer
-   that tells if the conversion was successful or not. And if not,
-   an error code can be returned (see swigerrors.swg for the codes).
-
-   Use the following macros/flags to set or process the returning
-   states.
-
-   In old versions of SWIG, code such as the following was usually written:
-
-     if (SWIG_ConvertPtr(obj,vptr,ty.flags) != -1) {
-       // success code
-     } else {
-       //fail code
-     }
-
-   Now you can be more explicit:
-
-    int res = SWIG_ConvertPtr(obj,vptr,ty.flags);
-    if (SWIG_IsOK(res)) {
-      // success code
-    } else {
-      // fail code
-    }
-
-   which is the same really, but now you can also do
-
-    Type *ptr;
-    int res = SWIG_ConvertPtr(obj,(void **)(&ptr),ty.flags);
-    if (SWIG_IsOK(res)) {
-      // success code
-      if (SWIG_IsNewObj(res) {
-        ...
-	delete *ptr;
-      } else {
-        ...
-      }
-    } else {
-      // fail code
-    }
-
-   I.e., now SWIG_ConvertPtr can return new objects and you can
-   identify the case and take care of the deallocation. Of course that
-   also requires SWIG_ConvertPtr to return new result values, such as
-
-      int SWIG_ConvertPtr(obj, ptr,...) {
-        if (<obj is ok>) {
-          if (<need new object>) {
-            *ptr = <ptr to new allocated object>;
-            return SWIG_NEWOBJ;
-          } else {
-            *ptr = <ptr to old object>;
-            return SWIG_OLDOBJ;
-          }
-        } else {
-          return SWIG_BADOBJ;
-        }
-      }
-
-   Of course, returning the plain '0(success)/-1(fail)' still works, but you can be
-   more explicit by returning SWIG_BADOBJ, SWIG_ERROR or any of the
-   SWIG errors code.
-
-   Finally, if the SWIG_CASTRANK_MODE is enabled, the result code
-   allows to return the 'cast rank', for example, if you have this
-
-       int food(double)
-       int fooi(int);
-
-   and you call
-
-      food(1)   // cast rank '1'  (1 -> 1.0)
-      fooi(1)   // cast rank '0'
-
-   just use the SWIG_AddCast()/SWIG_CheckState()
-*/
-
-#define SWIG_OK                    (0)
-#define SWIG_ERROR                 (-1)
-#define SWIG_IsOK(r)               (r >= 0)
-#define SWIG_ArgError(r)           ((r != SWIG_ERROR) ? r : SWIG_TypeError)
-
-/* The CastRankLimit says how many bits are used for the cast rank */
-#define SWIG_CASTRANKLIMIT         (1 << 8)
-/* The NewMask denotes the object was created (using new/malloc) */
-#define SWIG_NEWOBJMASK            (SWIG_CASTRANKLIMIT  << 1)
-/* The TmpMask is for in/out typemaps that use temporal objects */
-#define SWIG_TMPOBJMASK            (SWIG_NEWOBJMASK << 1)
-/* Simple returning values */
-#define SWIG_BADOBJ                (SWIG_ERROR)
-#define SWIG_OLDOBJ                (SWIG_OK)
-#define SWIG_NEWOBJ                (SWIG_OK | SWIG_NEWOBJMASK)
-#define SWIG_TMPOBJ                (SWIG_OK | SWIG_TMPOBJMASK)
-/* Check, add and del mask methods */
-#define SWIG_AddNewMask(r)         (SWIG_IsOK(r) ? (r | SWIG_NEWOBJMASK) : r)
-#define SWIG_DelNewMask(r)         (SWIG_IsOK(r) ? (r & ~SWIG_NEWOBJMASK) : r)
-#define SWIG_IsNewObj(r)           (SWIG_IsOK(r) && (r & SWIG_NEWOBJMASK))
-#define SWIG_AddTmpMask(r)         (SWIG_IsOK(r) ? (r | SWIG_TMPOBJMASK) : r)
-#define SWIG_DelTmpMask(r)         (SWIG_IsOK(r) ? (r & ~SWIG_TMPOBJMASK) : r)
-#define SWIG_IsTmpObj(r)           (SWIG_IsOK(r) && (r & SWIG_TMPOBJMASK))
-
-/* Cast-Rank Mode */
-#if defined(SWIG_CASTRANK_MODE)
-#  ifndef SWIG_TypeRank
-#    define SWIG_TypeRank             unsigned long
-#  endif
-#  ifndef SWIG_MAXCASTRANK            /* Default cast allowed */
-#    define SWIG_MAXCASTRANK          (2)
-#  endif
-#  define SWIG_CASTRANKMASK          ((SWIG_CASTRANKLIMIT) -1)
-#  define SWIG_CastRank(r)           (r & SWIG_CASTRANKMASK)
-SWIGINTERNINLINE int SWIG_AddCast(int r) {
-  return SWIG_IsOK(r) ? ((SWIG_CastRank(r) < SWIG_MAXCASTRANK) ? (r + 1) : SWIG_ERROR) : r;
-}
-SWIGINTERNINLINE int SWIG_CheckState(int r) {
-  return SWIG_IsOK(r) ? SWIG_CastRank(r) + 1 : 0;
-}
-#else /* no cast-rank mode */
-#  define SWIG_AddCast
-#  define SWIG_CheckState(r) (SWIG_IsOK(r) ? 1 : 0)
-#endif
-
-
-#include <string.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-typedef void *(*swig_converter_func)(void *, int *);
-typedef struct swig_type_info *(*swig_dycast_func)(void **);
-
-/* Structure to store information on one type */
-typedef struct swig_type_info {
-  const char             *name;			/* mangled name of this type */
-  const char             *str;			/* human readable name of this type */
-  swig_dycast_func        dcast;		/* dynamic cast function down a hierarchy */
-  struct swig_cast_info  *cast;			/* linked list of types that can cast into this type */
-  void                   *clientdata;		/* language specific type data */
-  int                    owndata;		/* flag if the structure owns the clientdata */
-} swig_type_info;
-
-/* Structure to store a type and conversion function used for casting */
-typedef struct swig_cast_info {
-  swig_type_info         *type;			/* pointer to type that is equivalent to this type */
-  swig_converter_func     converter;		/* function to cast the void pointers */
-  struct swig_cast_info  *next;			/* pointer to next cast in linked list */
-  struct swig_cast_info  *prev;			/* pointer to the previous cast */
-} swig_cast_info;
-
-/* Structure used to store module information
- * Each module generates one structure like this, and the runtime collects
- * all of these structures and stores them in a circularly linked list.*/
-typedef struct swig_module_info {
-  swig_type_info         **types;		/* Array of pointers to swig_type_info structures that are in this module */
-  size_t                 size;		        /* Number of types in this module */
-  struct swig_module_info *next;		/* Pointer to next element in circularly linked list */
-  swig_type_info         **type_initial;	/* Array of initially generated type structures */
-  swig_cast_info         **cast_initial;	/* Array of initially generated casting structures */
-  void                    *clientdata;		/* Language specific module data */
-} swig_module_info;
-
-/*
-  Compare two type names skipping the space characters, therefore
-  "char*" == "char *" and "Class<int>" == "Class<int >", etc.
-
-  Return 0 when the two name types are equivalent, as in
-  strncmp, but skipping ' '.
-*/
-SWIGRUNTIME int
-SWIG_TypeNameComp(const char *f1, const char *l1,
-		  const char *f2, const char *l2) {
-  for (;(f1 != l1) && (f2 != l2); ++f1, ++f2) {
-    while ((*f1 == ' ') && (f1 != l1)) ++f1;
-    while ((*f2 == ' ') && (f2 != l2)) ++f2;
-    if (*f1 != *f2) return (*f1 > *f2) ? 1 : -1;
-  }
-  return (int)((l1 - f1) - (l2 - f2));
-}
-
-/*
-  Check type equivalence in a name list like <name1>|<name2>|...
-  Return 0 if not equal, 1 if equal
-*/
-SWIGRUNTIME int
-SWIG_TypeEquiv(const char *nb, const char *tb) {
-  int equiv = 0;
-  const char* te = tb + strlen(tb);
-  const char* ne = nb;
-  while (!equiv && *ne) {
-    for (nb = ne; *ne; ++ne) {
-      if (*ne == '|') break;
-    }
-    equiv = (SWIG_TypeNameComp(nb, ne, tb, te) == 0) ? 1 : 0;
-    if (*ne) ++ne;
-  }
-  return equiv;
-}
-
-/*
-  Check type equivalence in a name list like <name1>|<name2>|...
-  Return 0 if equal, -1 if nb < tb, 1 if nb > tb
-*/
-SWIGRUNTIME int
-SWIG_TypeCompare(const char *nb, const char *tb) {
-  int equiv = 0;
-  const char* te = tb + strlen(tb);
-  const char* ne = nb;
-  while (!equiv && *ne) {
-    for (nb = ne; *ne; ++ne) {
-      if (*ne == '|') break;
-    }
-    equiv = (SWIG_TypeNameComp(nb, ne, tb, te) == 0) ? 1 : 0;
-    if (*ne) ++ne;
-  }
-  return equiv;
-}
-
-
-/*
-  Check the typename
-*/
-SWIGRUNTIME swig_cast_info *
-SWIG_TypeCheck(const char *c, swig_type_info *ty) {
-  if (ty) {
-    swig_cast_info *iter = ty->cast;
-    while (iter) {
-      if (strcmp(iter->type->name, c) == 0) {
-        if (iter == ty->cast)
-          return iter;
-        /* Move iter to the top of the linked list */
-        iter->prev->next = iter->next;
-        if (iter->next)
-          iter->next->prev = iter->prev;
-        iter->next = ty->cast;
-        iter->prev = 0;
-        if (ty->cast) ty->cast->prev = iter;
-        ty->cast = iter;
-        return iter;
-      }
-      iter = iter->next;
-    }
-  }
-  return 0;
-}
-
-/*
-  Identical to SWIG_TypeCheck, except strcmp is replaced with a pointer comparison
-*/
-SWIGRUNTIME swig_cast_info *
-SWIG_TypeCheckStruct(swig_type_info *from, swig_type_info *ty) {
-  if (ty) {
-    swig_cast_info *iter = ty->cast;
-    while (iter) {
-      if (iter->type == from) {
-        if (iter == ty->cast)
-          return iter;
-        /* Move iter to the top of the linked list */
-        iter->prev->next = iter->next;
-        if (iter->next)
-          iter->next->prev = iter->prev;
-        iter->next = ty->cast;
-        iter->prev = 0;
-        if (ty->cast) ty->cast->prev = iter;
-        ty->cast = iter;
-        return iter;
-      }
-      iter = iter->next;
-    }
-  }
-  return 0;
-}
-
-/*
-  Cast a pointer up an inheritance hierarchy
-*/
-SWIGRUNTIMEINLINE void *
-SWIG_TypeCast(swig_cast_info *ty, void *ptr, int *newmemory) {
-  return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr, newmemory);
-}
-
-/*
-   Dynamic pointer casting. Down an inheritance hierarchy
-*/
-SWIGRUNTIME swig_type_info *
-SWIG_TypeDynamicCast(swig_type_info *ty, void **ptr) {
-  swig_type_info *lastty = ty;
-  if (!ty || !ty->dcast) return ty;
-  while (ty && (ty->dcast)) {
-    ty = (*ty->dcast)(ptr);
-    if (ty) lastty = ty;
-  }
-  return lastty;
-}
-
-/*
-  Return the name associated with this type
-*/
-SWIGRUNTIMEINLINE const char *
-SWIG_TypeName(const swig_type_info *ty) {
-  return ty->name;
-}
-
-/*
-  Return the pretty name associated with this type,
-  that is an unmangled type name in a form presentable to the user.
-*/
-SWIGRUNTIME const char *
-SWIG_TypePrettyName(const swig_type_info *type) {
-  /* The "str" field contains the equivalent pretty names of the
-     type, separated by vertical-bar characters.  We choose
-     to print the last name, as it is often (?) the most
-     specific. */
-  if (!type) return NULL;
-  if (type->str != NULL) {
-    const char *last_name = type->str;
-    const char *s;
-    for (s = type->str; *s; s++)
-      if (*s == '|') last_name = s+1;
-    return last_name;
-  }
-  else
-    return type->name;
-}
-
-/*
-   Set the clientdata field for a type
-*/
-SWIGRUNTIME void
-SWIG_TypeClientData(swig_type_info *ti, void *clientdata) {
-  swig_cast_info *cast = ti->cast;
-  /* if (ti->clientdata == clientdata) return; */
-  ti->clientdata = clientdata;
-
-  while (cast) {
-    if (!cast->converter) {
-      swig_type_info *tc = cast->type;
-      if (!tc->clientdata) {
-	SWIG_TypeClientData(tc, clientdata);
-      }
-    }
-    cast = cast->next;
-  }
-}
-SWIGRUNTIME void
-SWIG_TypeNewClientData(swig_type_info *ti, void *clientdata) {
-  SWIG_TypeClientData(ti, clientdata);
-  ti->owndata = 1;
-}
-
-/*
-  Search for a swig_type_info structure only by mangled name
-  Search is a O(log #types)
-
-  We start searching at module start, and finish searching when start == end.
-  Note: if start == end at the beginning of the function, we go all the way around
-  the circular list.
-*/
-SWIGRUNTIME swig_type_info *
-SWIG_MangledTypeQueryModule(swig_module_info *start,
-                            swig_module_info *end,
-		            const char *name) {
-  swig_module_info *iter = start;
-  do {
-    if (iter->size) {
-      size_t l = 0;
-      size_t r = iter->size - 1;
-      do {
-	/* since l+r >= 0, we can (>> 1) instead (/ 2) */
-	size_t i = (l + r) >> 1;
-	const char *iname = iter->typesi->name;
-	if (iname) {
-	  int compare = strcmp(name, iname);
-	  if (compare == 0) {
-	    return iter->typesi;
-	  } else if (compare < 0) {
-	    if (i) {
-	      r = i - 1;
-	    } else {
-	      break;
-	    }
-	  } else if (compare > 0) {
-	    l = i + 1;
-	  }
-	} else {
-	  break; /* should never happen */
-	}
-      } while (l <= r);
-    }
-    iter = iter->next;
-  } while (iter != end);
-  return 0;
-}
-
-/*
-  Search for a swig_type_info structure for either a mangled name or a human readable name.
-  It first searches the mangled names of the types, which is a O(log #types)
-  If a type is not found it then searches the human readable names, which is O(#types).
-
-  We start searching at module start, and finish searching when start == end.
-  Note: if start == end at the beginning of the function, we go all the way around
-  the circular list.
-*/
-SWIGRUNTIME swig_type_info *
-SWIG_TypeQueryModule(swig_module_info *start,
-                     swig_module_info *end,
-		     const char *name) {
-  /* STEP 1: Search the name field using binary search */
-  swig_type_info *ret = SWIG_MangledTypeQueryModule(start, end, name);
-  if (ret) {
-    return ret;
-  } else {
-    /* STEP 2: If the type hasn't been found, do a complete search
-       of the str field (the human readable name) */
-    swig_module_info *iter = start;
-    do {
-      size_t i = 0;
-      for (; i < iter->size; ++i) {
-	if (iter->typesi->str && (SWIG_TypeEquiv(iter->typesi->str, name)))
-	  return iter->typesi;
-      }
-      iter = iter->next;
-    } while (iter != end);
-  }
-
-  /* neither found a match */
-  return 0;
-}
-
-/*
-   Pack binary data into a string
-*/
-SWIGRUNTIME char *
-SWIG_PackData(char *c, void *ptr, size_t sz) {
-  static const char hex17 = "0123456789abcdef";
-  const unsigned char *u = (unsigned char *) ptr;
-  const unsigned char *eu =  u + sz;
-  for (; u != eu; ++u) {
-    unsigned char uu = *u;
-    *(c++) = hex(uu & 0xf0) >> 4;
-    *(c++) = hexuu & 0xf;
-  }
-  return c;
-}
-
-/*
-   Unpack binary data from a string
-*/
-SWIGRUNTIME const char *
-SWIG_UnpackData(const char *c, void *ptr, size_t sz) {
-  unsigned char *u = (unsigned char *) ptr;
-  const unsigned char *eu = u + sz;
-  for (; u != eu; ++u) {
-    char d = *(c++);
-    unsigned char uu;
-    if ((d >= '0') && (d <= '9'))
-      uu = ((d - '0') << 4);
-    else if ((d >= 'a') && (d <= 'f'))
-      uu = ((d - ('a'-10)) << 4);
-    else
-      return (char *) 0;
-    d = *(c++);
-    if ((d >= '0') && (d <= '9'))
-      uu |= (d - '0');
-    else if ((d >= 'a') && (d <= 'f'))
-      uu |= (d - ('a'-10));
-    else
-      return (char *) 0;
-    *u = uu;
-  }
-  return c;
-}
-
-/*
-   Pack 'void *' into a string buffer.
-*/
-SWIGRUNTIME char *
-SWIG_PackVoidPtr(char *buff, void *ptr, const char *name, size_t bsz) {
-  char *r = buff;
-  if ((2*sizeof(void *) + 2) > bsz) return 0;
-  *(r++) = '_';
-  r = SWIG_PackData(r,&ptr,sizeof(void *));
-  if (strlen(name) + 1 > (bsz - (r - buff))) return 0;
-  strcpy(r,name);
-  return buff;
-}
-
-SWIGRUNTIME const char *
-SWIG_UnpackVoidPtr(const char *c, void **ptr, const char *name) {
-  if (*c != '_') {
-    if (strcmp(c,"NULL") == 0) {
-      *ptr = (void *) 0;
-      return name;
-    } else {
-      return 0;
-    }
-  }
-  return SWIG_UnpackData(++c,ptr,sizeof(void *));
-}
-
-SWIGRUNTIME char *
-SWIG_PackDataName(char *buff, void *ptr, size_t sz, const char *name, size_t bsz) {
-  char *r = buff;
-  size_t lname = (name ? strlen(name) : 0);
-  if ((2*sz + 2 + lname) > bsz) return 0;
-  *(r++) = '_';
-  r = SWIG_PackData(r,ptr,sz);
-  if (lname) {
-    strncpy(r,name,lname+1);
-  } else {
-    *r = 0;
-  }
-  return buff;
-}
-
-SWIGRUNTIME const char *
-SWIG_UnpackDataName(const char *c, void *ptr, size_t sz, const char *name) {
-  if (*c != '_') {
-    if (strcmp(c,"NULL") == 0) {
-      memset(ptr,0,sz);
-      return name;
-    } else {
-      return 0;
-    }
-  }
-  return SWIG_UnpackData(++c,ptr,sz);
-}
-
-#ifdef __cplusplus
-}
-#endif
-
-/*  Errors in SWIG */
-#define  SWIG_UnknownError    	   -1
-#define  SWIG_IOError        	   -2
-#define  SWIG_RuntimeError   	   -3
-#define  SWIG_IndexError     	   -4
-#define  SWIG_TypeError      	   -5
-#define  SWIG_DivisionByZero 	   -6
-#define  SWIG_OverflowError  	   -7
-#define  SWIG_SyntaxError    	   -8
-#define  SWIG_ValueError     	   -9
-#define  SWIG_SystemError    	   -10
-#define  SWIG_AttributeError 	   -11
-#define  SWIG_MemoryError    	   -12
-#define  SWIG_NullReferenceError   -13
-
-
-
-/* -----------------------------------------------------------------------------
- * error manipulation
- * ----------------------------------------------------------------------------- */
-
-SWIGINTERN const char*
-SWIG_Tcl_ErrorType(int code) {
-  const char* type = 0;
-  switch(code) {
-  case SWIG_MemoryError:
-    type = "MemoryError";
-    break;
-  case SWIG_IOError:
-    type = "IOError";
-    break;
-  case SWIG_RuntimeError:
-    type = "RuntimeError";
-    break;
-  case SWIG_IndexError:
-    type = "IndexError";
-    break;
-  case SWIG_TypeError:
-    type = "TypeError";
-    break;
-  case SWIG_DivisionByZero:
-    type = "ZeroDivisionError";
-    break;
-  case SWIG_OverflowError:
-    type = "OverflowError";
-    break;
-  case SWIG_SyntaxError:
-    type = "SyntaxError";
-    break;
-  case SWIG_ValueError:
-    type = "ValueError";
-    break;
-  case SWIG_SystemError:
-    type = "SystemError";
-    break;
-  case SWIG_AttributeError:
-    type = "AttributeError";
-    break;
-  default:
-    type = "RuntimeError";
-  }
-  return type;
-}
-
-
-SWIGINTERN void
-SWIG_Tcl_SetErrorObj(Tcl_Interp *interp, const char *ctype, Tcl_Obj *obj)
-{
-  Tcl_ResetResult(interp);
-  Tcl_SetObjResult(interp, obj);
-  Tcl_SetErrorCode(interp, "SWIG", ctype, NULL);
-}
-
-SWIGINTERN void
-SWIG_Tcl_SetErrorMsg(Tcl_Interp *interp, const char *ctype, const char *mesg)
-{
-  Tcl_ResetResult(interp);
-  Tcl_SetErrorCode(interp, "SWIG", ctype, NULL);
-  Tcl_AppendResult(interp, ctype, " ", mesg, NULL);
-  /*
-  Tcl_AddErrorInfo(interp, ctype);
-  Tcl_AddErrorInfo(interp, " ");
-  Tcl_AddErrorInfo(interp, mesg);
-  */
-}
-
-SWIGINTERNINLINE void
-SWIG_Tcl_AddErrorMsg(Tcl_Interp *interp, const char* mesg)
-{
-  Tcl_AddErrorInfo(interp, mesg);
-}
-
-
-
-/* -----------------------------------------------------------------------------
- * SWIG API. Portion that goes into the runtime
- * ----------------------------------------------------------------------------- */
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* -----------------------------------------------------------------------------
- * Constant declarations
- * ----------------------------------------------------------------------------- */
-
-/* Constant Types */
-#define SWIG_TCL_POINTER 4
-#define SWIG_TCL_BINARY  5
-
-/* Constant information structure */
-typedef struct swig_const_info {
-    int type;
-    char *name;
-    long lvalue;
-    double dvalue;
-    void   *pvalue;
-    swig_type_info **ptype;
-} swig_const_info;
-
-typedef int   (*swig_wrapper)(ClientData, Tcl_Interp *, int, Tcl_Obj *CONST );
-typedef int   (*swig_wrapper_func)(ClientData, Tcl_Interp *, int, Tcl_Obj *CONST );
-typedef char *(*swig_variable_func)(ClientData, Tcl_Interp *, char *, char *, int);
-typedef void  (*swig_delete_func)(ClientData);
-
-typedef struct swig_method {
-  const char     *name;
-  swig_wrapper   method;
-} swig_method;
-
-typedef struct swig_attribute {
-  const char     *name;
-  swig_wrapper   getmethod;
-  swig_wrapper   setmethod;
-} swig_attribute;
-
-typedef struct swig_class {
-  const char         *name;
-  swig_type_info   **type;
-  swig_wrapper       constructor;
-  void              (*destructor)(void *);
-  swig_method        *methods;
-  swig_attribute     *attributes;
-  struct swig_class **bases;
-  const char              **base_names;
-  swig_module_info   *module;
-} swig_class;
-
-typedef struct swig_instance {
-  Tcl_Obj       *thisptr;
-  void          *thisvalue;
-  swig_class   *classptr;
-  int            destroy;
-  Tcl_Command    cmdtok;
-} swig_instance;
-
-/* Structure for command table */
-typedef struct {
-  const char *name;
-  int       (*wrapper)(ClientData, Tcl_Interp *, int, Tcl_Obj *CONST );
-  ClientData  clientdata;
-} swig_command_info;
-
-/* Structure for variable linking table */
-typedef struct {
-  const char *name;
-  void *addr;
-  char * (*get)(ClientData, Tcl_Interp *, char *, char *, int);
-  char * (*set)(ClientData, Tcl_Interp *, char *, char *, int);
-} swig_var_info;
-
-
-/* -----------------------------------------------------------------------------*
- *  Install a constant object
- * -----------------------------------------------------------------------------*/
-
-static Tcl_HashTable   swigconstTable;
-static int             swigconstTableinit = 0;
-
-SWIGINTERN void
-SWIG_Tcl_SetConstantObj(Tcl_Interp *interp, const char* name, Tcl_Obj *obj) {
-  int newobj;
-  Tcl_ObjSetVar2(interp,Tcl_NewStringObj(name,-1), NULL, obj, TCL_GLOBAL_ONLY);
-  Tcl_SetHashValue(Tcl_CreateHashEntry(&swigconstTable, name, &newobj), (ClientData) obj);
-}
-
-SWIGINTERN Tcl_Obj *
-SWIG_Tcl_GetConstantObj(const char *key) {
-  Tcl_HashEntry *entryPtr;
-  if (!swigconstTableinit) return 0;
-  entryPtr = Tcl_FindHashEntry(&swigconstTable, key);
-  if (entryPtr) {
-    return (Tcl_Obj *) Tcl_GetHashValue(entryPtr);
-  }
-  return 0;
-}
-
-#ifdef __cplusplus
-}
-#endif
-
-
-
-/* -----------------------------------------------------------------------------
- * See the LICENSE file for information on copyright, usage and redistribution
- * of SWIG, and the README file for authors - http://www.swig.org/release.html.
- *
- * tclrun.swg
- *
- * This file contains the runtime support for Tcl modules and includes
- * code for managing global variables and pointer type checking.
- * ----------------------------------------------------------------------------- */
-
-/* Common SWIG API */
-
-/* for raw pointers */
-#define SWIG_ConvertPtr(oc, ptr, ty, flags)             SWIG_Tcl_ConvertPtr(interp, oc, ptr, ty, flags)
-#define SWIG_NewPointerObj(ptr, type, flags)            SWIG_Tcl_NewPointerObj(ptr, type, flags)
-
-/* for raw packed data */
-#define SWIG_ConvertPacked(obj, ptr, sz, ty)            SWIG_Tcl_ConvertPacked(interp, obj, ptr, sz, ty)
-#define SWIG_NewPackedObj(ptr, sz, type)                SWIG_Tcl_NewPackedObj(ptr, sz, type)
-
-/* for class or struct pointers */
-#define SWIG_ConvertInstance(obj, pptr, type, flags)    SWIG_Tcl_ConvertPtr(interp, obj, pptr, type, flags)
-#define SWIG_NewInstanceObj(thisvalue, type, flags)     SWIG_Tcl_NewInstanceObj(interp, thisvalue, type, flags)
-
-/* for C or C++ function pointers */
-#define SWIG_ConvertFunctionPtr(obj, pptr, type)        SWIG_Tcl_ConvertPtr(interp, obj, pptr, type, 0)
-#define SWIG_NewFunctionPtrObj(ptr, type)               SWIG_Tcl_NewPointerObj(ptr, type, 0)
-
-/* for C++ member pointers, ie, member methods */
-#define SWIG_ConvertMember(obj, ptr, sz, ty)            SWIG_Tcl_ConvertPacked(interp,obj, ptr, sz, ty)
-#define SWIG_NewMemberObj(ptr, sz, type)                SWIG_Tcl_NewPackedObj(ptr, sz, type)
-
-
-/* Runtime API */
-
-#define SWIG_GetModule(clientdata)                      SWIG_Tcl_GetModule((Tcl_Interp *) (clientdata))
-#define SWIG_SetModule(clientdata, pointer)          	SWIG_Tcl_SetModule((Tcl_Interp *) (clientdata), pointer)
-
-
-/* Error manipulation */
-
-#define SWIG_ErrorType(code)                            SWIG_Tcl_ErrorType(code)
-#define SWIG_Error(code, msg)            		SWIG_Tcl_SetErrorMsg(interp, SWIG_Tcl_ErrorType(code), msg)
-#define SWIG_fail                        		goto fail
-
-
-/* Tcl-specific SWIG API */
-
-#define SWIG_Acquire(ptr)                               SWIG_Tcl_Acquire(ptr)
-#define SWIG_MethodCommand                           	SWIG_Tcl_MethodCommand
-#define SWIG_Disown(ptr)                             	SWIG_Tcl_Disown(ptr)
-#define SWIG_ConvertPtrFromString(c, ptr, ty, flags) 	SWIG_Tcl_ConvertPtrFromString(interp, c, ptr, ty, flags)
-#define SWIG_MakePtr(c, ptr, ty, flags)              	SWIG_Tcl_MakePtr(c, ptr, ty, flags)
-#define SWIG_PointerTypeFromString(c)                	SWIG_Tcl_PointerTypeFromString(c)
-#define SWIG_GetArgs                                 	SWIG_Tcl_GetArgs
-#define SWIG_GetConstantObj(key)                     	SWIG_Tcl_GetConstantObj(key)
-#define SWIG_ObjectConstructor                       	SWIG_Tcl_ObjectConstructor
-#define SWIG_Thisown(ptr)                            	SWIG_Tcl_Thisown(ptr)
-#define SWIG_ObjectDelete                            	SWIG_Tcl_ObjectDelete
-
-
-#define SWIG_TCL_DECL_ARGS_2(arg1, arg2)                (Tcl_Interp *interp SWIGUNUSED, arg1, arg2)
-#define SWIG_TCL_CALL_ARGS_2(arg1, arg2)                (interp, arg1, arg2)
-/* -----------------------------------------------------------------------------
- * pointers/data manipulation
- * ----------------------------------------------------------------------------- */
-
-/* For backward compatibility only */
-#define SWIG_POINTER_EXCEPTION  0
-#define SWIG_GetConstant        SWIG_GetConstantObj
-#define SWIG_Tcl_GetConstant    SWIG_Tcl_GetConstantObj
-
-#include "assert.h"
-
-#ifdef __cplusplus
-extern "C" {
-#if 0
-} /* cc-mode */
-#endif
-#endif
-
-/* Object support */
-
-SWIGRUNTIME Tcl_HashTable*
-SWIG_Tcl_ObjectTable(void) {
-  static Tcl_HashTable  swigobjectTable;
-  static int            swigobjectTableinit = 0;
-  if (!swigobjectTableinit) {
-    Tcl_InitHashTable(&swigobjectTable, TCL_ONE_WORD_KEYS);
-    swigobjectTableinit = 1;
-  }
-  return &swigobjectTable;
-}
-
-/* Acquire ownership of a pointer */
-SWIGRUNTIME void
-SWIG_Tcl_Acquire(void *ptr) {
-  int newobj;
-  Tcl_CreateHashEntry(SWIG_Tcl_ObjectTable(), (char *) ptr, &newobj);
-}
-
-SWIGRUNTIME int
-SWIG_Tcl_Thisown(void *ptr) {
-  if (Tcl_FindHashEntry(SWIG_Tcl_ObjectTable(), (char *) ptr)) {
-    return 1;
-  }
-  return 0;
-}
-
-/* Disown a pointer.  Returns 1 if we owned it to begin with */
-SWIGRUNTIME int
-SWIG_Tcl_Disown(void *ptr) {
-  Tcl_HashEntry *entryPtr = Tcl_FindHashEntry(SWIG_Tcl_ObjectTable(), (char *) ptr);
-  if (entryPtr) {
-    Tcl_DeleteHashEntry(entryPtr);
-    return 1;
-  }
-  return 0;
-}
-
-/* Convert a pointer value */
-SWIGRUNTIME int
-SWIG_Tcl_ConvertPtrFromString(Tcl_Interp *interp, const char *c, void **ptr, swig_type_info *ty, int flags) {
-  swig_cast_info *tc;
-  /* Pointer values must start with leading underscore */
-  while (*c != '_') {
-    *ptr = (void *) 0;
-    if (strcmp(c,"NULL") == 0) return SWIG_OK;
-
-    /* Empty string: not a pointer */
-    if (*c == 0) return SWIG_ERROR;
-
-    /* Hmmm. It could be an object name. */
-
-    /* Check if this is a command at all. Prevents <c> cget -this         */
-    /* from being called when c is not a command, firing the unknown proc */
-    if (Tcl_VarEval(interp,"info commands ", c, (char *) NULL) == TCL_OK) {
-      Tcl_Obj *result = Tcl_GetObjResult(interp);
-      if (*(Tcl_GetStringFromObj(result, NULL)) == 0) {
-        /* It's not a command, so it can't be a pointer */
-        Tcl_ResetResult(interp);
-        return SWIG_ERROR;
-      }
-    } else {
-      /* This will only fail if the argument is multiple words. */
-      /* Multiple words are also not commands.                  */
-      Tcl_ResetResult(interp);
-      return SWIG_ERROR;
-    }
-
-    /* Check if this is really a SWIG pointer */
-    if (Tcl_VarEval(interp,c," cget -this", (char *) NULL) != TCL_OK) {
-      Tcl_ResetResult(interp);
-      return SWIG_ERROR;
-    }
-
-    c = Tcl_GetStringFromObj(Tcl_GetObjResult(interp), NULL);
-  }
-
-  c++;
-  c = SWIG_UnpackData(c,ptr,sizeof(void *));
-  if (ty) {
-    tc = c ? SWIG_TypeCheck(c,ty) : 0;
-    if (!tc) {
-      return SWIG_ERROR;
-    }
-    if (flags & SWIG_POINTER_DISOWN) {
-      SWIG_Disown((void *) *ptr);
-    }
-    {
-      int newmemory = 0;
-      *ptr = SWIG_TypeCast(tc,(void *) *ptr,&newmemory);
-      assert(!newmemory); /* newmemory handling not yet implemented */
-    }
-  }
-  return SWIG_OK;
-}
-
-/* Convert a pointer value */
-SWIGRUNTIMEINLINE int
-SWIG_Tcl_ConvertPtr(Tcl_Interp *interp, Tcl_Obj *oc, void **ptr, swig_type_info *ty, int flags) {
-  return SWIG_Tcl_ConvertPtrFromString(interp, Tcl_GetStringFromObj(oc,NULL), ptr, ty, flags);
-}
-
-/* Convert a pointer value */
-SWIGRUNTIME char *
-SWIG_Tcl_PointerTypeFromString(char *c) {
-  char d;
-  /* Pointer values must start with leading underscore. NULL has no type */
-  if (*c != '_') {
-    return 0;
-  }
-  c++;
-  /* Extract hex value from pointer */
-  while ((d = *c)) {
-    if (!(((d >= '0') && (d <= '9')) || ((d >= 'a') && (d <= 'f')))) break;
-    c++;
-  }
-  return c;
-}
-
-/* Convert a packed value value */
-SWIGRUNTIME int
-SWIG_Tcl_ConvertPacked(Tcl_Interp *SWIGUNUSEDPARM(interp) , Tcl_Obj *obj, void *ptr, int sz, swig_type_info *ty) {
-  swig_cast_info *tc;
-  const char  *c;
-
-  if (!obj) goto type_error;
-  c = Tcl_GetStringFromObj(obj,NULL);
-  /* Pointer values must start with leading underscore */
-  if (*c != '_') goto type_error;
-  c++;
-  c = SWIG_UnpackData(c,ptr,sz);
-  if (ty) {
-    tc = SWIG_TypeCheck(c,ty);
-    if (!tc) goto type_error;
-  }
-  return SWIG_OK;
-
- type_error:
-
-  return SWIG_ERROR;
-}
-
-
-/* Take a pointer and convert it to a string */
-SWIGRUNTIME void
-SWIG_Tcl_MakePtr(char *c, void *ptr, swig_type_info *ty, int flags) {
-  if (ptr) {
-    *(c++) = '_';
-    c = SWIG_PackData(c,&ptr,sizeof(void *));
-    strcpy(c,ty->name);
-  } else {
-    strcpy(c,(char *)"NULL");
-  }
-  flags = 0;
-}
-
-/* Create a new pointer object */
-SWIGRUNTIMEINLINE Tcl_Obj *
-SWIG_Tcl_NewPointerObj(void *ptr, swig_type_info *type, int flags) {
-  Tcl_Obj *robj;
-  char resultSWIG_BUFFER_SIZE;
-  SWIG_MakePtr(result,ptr,type,flags);
-  robj = Tcl_NewStringObj(result,-1);
-  return robj;
-}
-
-SWIGRUNTIME Tcl_Obj *
-SWIG_Tcl_NewPackedObj(void *ptr, int sz, swig_type_info *type) {
-  char result1024;
-  char *r = result;
-  if ((2*sz + 1 + strlen(type->name)) > 1000) return 0;
-  *(r++) = '_';
-  r = SWIG_PackData(r,ptr,sz);
-  strcpy(r,type->name);
-  return Tcl_NewStringObj(result,-1);
-}
-
-/* -----------------------------------------------------------------------------*
- *  Get type list
- * -----------------------------------------------------------------------------*/
-
-SWIGRUNTIME swig_module_info *
-SWIG_Tcl_GetModule(Tcl_Interp *interp) {
-  const char *data;
-  swig_module_info *ret = 0;
-
-  /* first check if pointer already created */
-  data = Tcl_GetVar(interp, (char *)"swig_runtime_data_type_pointer" SWIG_RUNTIME_VERSION SWIG_TYPE_TABLE_NAME, TCL_GLOBAL_ONLY);
-  if (data) {
-    SWIG_UnpackData(data, &ret, sizeof(swig_type_info **));
-  }
-
-  return ret;
-}
-
-SWIGRUNTIME void
-SWIG_Tcl_SetModule(Tcl_Interp *interp, swig_module_info *module) {
-  char bufSWIG_BUFFER_SIZE;
-  char *data;
-
-  /* create a new pointer */
-  data = SWIG_PackData(buf, &module, sizeof(swig_type_info **));
-  *data = 0;
-  Tcl_SetVar(interp, (char *)"swig_runtime_data_type_pointer" SWIG_RUNTIME_VERSION SWIG_TYPE_TABLE_NAME, buf, 0);
-}
-
-/* -----------------------------------------------------------------------------*
- *  Object auxiliars
- * -----------------------------------------------------------------------------*/
-
-
-SWIGRUNTIME void
-SWIG_Tcl_ObjectDelete(ClientData clientData) {
-  swig_instance *si = (swig_instance *) clientData;
-  if ((si) && (si->destroy) && (SWIG_Disown(si->thisvalue))) {
-    if (si->classptr->destructor) {
-      (si->classptr->destructor)(si->thisvalue);
-    }
-  }
-  Tcl_DecrRefCount(si->thisptr);
-  free(si);
-}
-
-/* Function to invoke object methods given an instance */
-SWIGRUNTIME int
-SWIG_Tcl_MethodCommand(ClientData clientData, Tcl_Interp *interp, int objc, Tcl_Obj *CONST _objv) {
-  char *method,   *attrname;
-  swig_instance   *inst = (swig_instance *) clientData;
-  swig_method     *meth;
-  swig_attribute  *attr;
-  Tcl_Obj         *oldarg;
-  Tcl_Obj         **objv;
-  int              rcode;
-  swig_class      *cls;
-  swig_class      *cls_stack64;
-  int              cls_stack_bi64;
-  int              cls_stack_top = 0;
-  int              numconf = 2;
-  int              bi;
-
-  objv = (Tcl_Obj **) _objv;
-  if (objc < 2) {
-    Tcl_SetResult(interp, (char *) "wrong # args.", TCL_STATIC);
-    return TCL_ERROR;
-  }
-  method = Tcl_GetStringFromObj(objv1,NULL);
-  if (strcmp(method,"-acquire") == 0) {
-    inst->destroy = 1;
-    SWIG_Acquire(inst->thisvalue);
-    return TCL_OK;
-  }
-  if (strcmp(method,"-disown") == 0) {
-    if (inst->destroy) {
-      SWIG_Disown(inst->thisvalue);
-    }
-    inst->destroy = 0;
-    return TCL_OK;
-  }
-  if (strcmp(method,"-delete") == 0) {
-    Tcl_DeleteCommandFromToken(interp,inst->cmdtok);
-    return TCL_OK;
-  }
-  cls_stackcls_stack_top = inst->classptr;
-  cls_stack_bicls_stack_top = -1;
-  cls = inst->classptr;
-  while (1) {
-    bi = cls_stack_bicls_stack_top;
-    cls = cls_stackcls_stack_top;
-    if (bi != -1) {
-      if (!cls->basesbi && cls->base_namesbi) {
-        /* lookup and cache the base class */
-	swig_type_info *info = SWIG_TypeQueryModule(cls->module, cls->module, cls->base_namesbi);
-	if (info) cls->basesbi = (swig_class *) info->clientdata;
-      }
-      cls = cls->basesbi;
-      if (cls) {
-        cls_stack_bicls_stack_top++;
-        cls_stack_top++;
-        cls_stackcls_stack_top = cls;
-        cls_stack_bicls_stack_top = -1;
-        continue;
-      }
-    }
-    if (!cls) {
-      cls_stack_top--;
-      if (cls_stack_top < 0) break;
-      else continue;
-    }
-    cls_stack_bicls_stack_top++;
-
-    meth = cls->methods;
-    /* Check for methods */
-    while (meth && meth->name) {
-      if (strcmp(meth->name,method) == 0) {
-        oldarg = objv1;
-        objv1 = inst->thisptr;
-        Tcl_IncrRefCount(inst->thisptr);
-        rcode = (*meth->method)(clientData,interp,objc,objv);
-        objv1 = oldarg;
-        Tcl_DecrRefCount(inst->thisptr);
-        return rcode;
-      }
-      meth++;
-    }
-    /* Check class methods for a match */
-    if (strcmp(method,"cget") == 0) {
-      if (objc < 3) {
-        Tcl_SetResult(interp, (char *) "wrong # args.", TCL_STATIC);
-        return TCL_ERROR;
-      }
-      attrname = Tcl_GetStringFromObj(objv2,NULL);
-      attr = cls->attributes;
-      while (attr && attr->name) {
-        if ((strcmp(attr->name, attrname) == 0) && (attr->getmethod)) {
-          oldarg = objv1;
-          objv1 = inst->thisptr;
-          Tcl_IncrRefCount(inst->thisptr);
-          rcode = (*attr->getmethod)(clientData,interp,2, objv);
-          objv1 = oldarg;
-          Tcl_DecrRefCount(inst->thisptr);
-          return rcode;
-        }
-        attr++;
-      }
-      if (strcmp(attrname, "-this") == 0) {
-        Tcl_SetObjResult(interp, Tcl_DuplicateObj(inst->thisptr));
-        return TCL_OK;
-      }
-      if (strcmp(attrname, "-thisown") == 0) {
-        if (SWIG_Thisown(inst->thisvalue)) {
-          Tcl_SetResult(interp,(char*)"1",TCL_STATIC);
-        } else {
-          Tcl_SetResult(interp,(char*)"0",TCL_STATIC);
-        }
-        return TCL_OK;
-      }
-    } else if (strcmp(method, "configure") == 0) {
-      int i;
-      if (objc < 4) {
-        Tcl_SetResult(interp, (char *) "wrong # args.", TCL_STATIC);
-        return TCL_ERROR;
-      }
-      i = 2;
-      while (i < objc) {
-        attrname = Tcl_GetStringFromObj(objvi,NULL);
-        attr = cls->attributes;
-        while (attr && attr->name) {
-          if ((strcmp(attr->name, attrname) == 0) && (attr->setmethod)) {
-            oldarg = objvi;
-            objvi = inst->thisptr;
-            Tcl_IncrRefCount(inst->thisptr);
-            rcode = (*attr->setmethod)(clientData,interp,3, &objvi-1);
-            objvi = oldarg;
-            Tcl_DecrRefCount(inst->thisptr);
-            if (rcode != TCL_OK) return rcode;
-            numconf += 2;
-          }
-          attr++;
-        }
-        i+=2;
-      }
-    }
-  }
-  if (strcmp(method,"configure") == 0) {
-    if (numconf >= objc) {
-      return TCL_OK;
-    } else {
-      Tcl_SetResult(interp,(char *) "Invalid attribute name.", TCL_STATIC);
-      return TCL_ERROR;
-    }
-  }
-  if (strcmp(method,"cget") == 0) {
-    Tcl_SetResult(interp,(char *) "Invalid attribute name.", TCL_STATIC);
-    return TCL_ERROR;
-  }
-  Tcl_SetResult(interp, (char *) "Invalid method. Must be one of: configure cget -acquire -disown -delete", TCL_STATIC);
-  cls = inst->classptr;
-  bi = 0;
-  while (cls) {
-    meth = cls->methods;
-    while (meth && meth->name) {
-      char *cr = (char *) Tcl_GetStringResult(interp);
-      size_t meth_len = strlen(meth->name);
-      char* where = strchr(cr,':');
-      while(where) {
-        where = strstr(where, meth->name);
-        if(where) {
-          if(where-1 == ' ' && (wheremeth_len == ' ' || wheremeth_len==0)) {
-            break;
-          } else {
-            where++;
-          }
-        }
-      }
-
-      if (!where)
-        Tcl_AppendElement(interp, (char *) meth->name);
-      meth++;
-    }
-    cls = inst->classptr->basesbi++;
-  }
-  return TCL_ERROR;
-}
-
-/* This function takes the current result and turns it into an object command */
-SWIGRUNTIME Tcl_Obj *
-SWIG_Tcl_NewInstanceObj(Tcl_Interp *interp, void *thisvalue, swig_type_info *type, int flags) {
-  Tcl_Obj *robj = SWIG_NewPointerObj(thisvalue, type,0);
-  /* Check to see if this pointer belongs to a class or not */
-  if ((type->clientdata) && (interp)) {
-    Tcl_CmdInfo    ci;
-    char          *name;
-    name = Tcl_GetStringFromObj(robj,NULL);
-    if (!Tcl_GetCommandInfo(interp,name, &ci) || (flags)) {
-      swig_instance *newinst = (swig_instance *) malloc(sizeof(swig_instance));
-      newinst->thisptr = Tcl_DuplicateObj(robj);
-      Tcl_IncrRefCount(newinst->thisptr);
-      newinst->thisvalue = thisvalue;
-      newinst->classptr = (swig_class *) type->clientdata;
-      newinst->destroy = flags;
-      newinst->cmdtok = Tcl_CreateObjCommand(interp, Tcl_GetStringFromObj(robj,NULL), (swig_wrapper_func) SWIG_MethodCommand, (ClientData) newinst, (swig_delete_func) SWIG_ObjectDelete);
-      if (flags) {
-        SWIG_Acquire(thisvalue);
-      }
-    }
-  }
-  return robj;
-}
-
-/* Function to create objects */
-SWIGRUNTIME int
-SWIG_Tcl_ObjectConstructor(ClientData clientData, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  Tcl_Obj          *newObj = 0;
-  void             *thisvalue = 0;
-  swig_instance   *newinst = 0;
-  swig_class      *classptr = (swig_class *) clientData;
-  swig_wrapper     cons = 0;
-  char             *name = 0;
-  int               firstarg = 0;
-  int               thisarg = 0;
-  int               destroy = 1;
-
-  if (!classptr) {
-    Tcl_SetResult(interp, (char *) "swig: internal runtime error. No class object defined.", TCL_STATIC);
-    return TCL_ERROR;
-  }
-  cons = classptr->constructor;
-  if (objc > 1) {
-    char *s = Tcl_GetStringFromObj(objv1,NULL);
-    if (strcmp(s,"-this") == 0) {
-      thisarg = 2;
-      cons = 0;
-    } else if (strcmp(s,"-args") == 0) {
-      firstarg = 1;
-    } else if (objc == 2) {
-      firstarg = 1;
-      name = s;
-    } else if (objc >= 3) {
-      char *s1;
-      name = s;
-      s1 = Tcl_GetStringFromObj(objv2,NULL);
-      if (strcmp(s1,"-this") == 0) {
-	thisarg = 3;
-	cons = 0;
-      } else {
-	firstarg = 1;
-      }
-    }
-  }
-  if (cons) {
-    int result;
-    result = (*cons)(0, interp, objc-firstarg, &objvfirstarg);
-    if (result != TCL_OK) {
-      return result;
-    }
-    newObj = Tcl_DuplicateObj(Tcl_GetObjResult(interp));
-    if (!name) name = Tcl_GetStringFromObj(newObj,NULL);
-  } else if (thisarg > 0) {
-    if (thisarg < objc) {
-      destroy = 0;
-      newObj = Tcl_DuplicateObj(objvthisarg);
-      if (!name) name = Tcl_GetStringFromObj(newObj,NULL);
-    } else {
-      Tcl_SetResult(interp, (char *) "wrong # args.", TCL_STATIC);
-      return TCL_ERROR;
-    }
-  } else {
-    Tcl_SetResult(interp, (char *) "No constructor available.", TCL_STATIC);
-    return TCL_ERROR;
-  }
-  if (SWIG_Tcl_ConvertPtr(interp,newObj, (void **) &thisvalue, *(classptr->type), 0) != SWIG_OK) {
-    Tcl_DecrRefCount(newObj);
-    return TCL_ERROR;
-  }
-  newinst = (swig_instance *) malloc(sizeof(swig_instance));
-  newinst->thisptr = newObj;
-  Tcl_IncrRefCount(newObj);
-  newinst->thisvalue = thisvalue;
-  newinst->classptr = classptr;
-  newinst->destroy = destroy;
-  if (destroy) {
-    SWIG_Acquire(thisvalue);
-  }
-  newinst->cmdtok = Tcl_CreateObjCommand(interp,name, (swig_wrapper) SWIG_MethodCommand, (ClientData) newinst, (swig_delete_func) SWIG_ObjectDelete);
-  return TCL_OK;
-}
-
-/* -----------------------------------------------------------------------------*
- *   Get arguments
- * -----------------------------------------------------------------------------*/
-SWIGRUNTIME int
-SWIG_Tcl_GetArgs(Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv, const char *fmt, ...) {
-  int        argno = 0, opt = 0;
-  long       tempi;
-  double     tempd;
-  const char *c;
-  va_list    ap;
-  void      *vptr;
-  Tcl_Obj   *obj = 0;
-  swig_type_info *ty;
-
-  va_start(ap,fmt);
-  for (c = fmt; (*c && (*c != ':') && (*c != ';')); c++,argno++) {
-    if (*c == '|') {
-      opt = 1;
-      c++;
-    }
-    if (argno >= (objc-1)) {
-      if (!opt) {
-        Tcl_SetResult(interp, (char *) "Wrong number of arguments ", TCL_STATIC);
-        goto argerror;
-      } else {
-        va_end(ap);
-        return TCL_OK;
-      }
-    }
-
-    vptr = va_arg(ap,void *);
-    if (vptr) {
-      if (isupper(*c)) {
-        obj = SWIG_Tcl_GetConstantObj(Tcl_GetStringFromObj(objvargno+1,0));
-        if (!obj) obj = objvargno+1;
-      } else {
-        obj = objvargno+1;
-      }
-      switch(*c) {
-      case 'i': case 'I':
-      case 'l': case 'L':
-      case 'h': case 'H':
-      case 'b': case 'B':
-        if (Tcl_GetLongFromObj(interp,obj,&tempi) != TCL_OK) goto argerror;
-        if ((*c == 'i') || (*c == 'I')) *((int *)vptr) = (int)tempi;
-        else if ((*c == 'l') || (*c == 'L')) *((long *)vptr) = (long)tempi;
-        else if ((*c == 'h') || (*c == 'H')) *((short*)vptr) = (short)tempi;
-        else if ((*c == 'b') || (*c == 'B')) *((unsigned char *)vptr) = (unsigned char)tempi;
-        break;
-      case 'f': case 'F':
-      case 'd': case 'D':
-        if (Tcl_GetDoubleFromObj(interp,obj,&tempd) != TCL_OK) goto argerror;
-        if ((*c == 'f') || (*c == 'F')) *((float *) vptr) = (float)tempd;
-        else if ((*c == 'd') || (*c == 'D')) *((double*) vptr) = tempd;
-        break;
-      case 's': case 'S':
-        if (*(c+1) == '#') {
-          int *vlptr = (int *) va_arg(ap, void *);
-          *((char **) vptr) = Tcl_GetStringFromObj(obj, vlptr);
-          c++;
-        } else {
-          *((char **)vptr) = Tcl_GetStringFromObj(obj,NULL);
-        }
-        break;
-      case 'c': case 'C':
-        *((char *)vptr) = *(Tcl_GetStringFromObj(obj,NULL));
-        break;
-      case 'p': case 'P':
-        ty = (swig_type_info *) va_arg(ap, void *);
-        if (SWIG_Tcl_ConvertPtr(interp, obj, (void **) vptr, ty, 0) != SWIG_OK) goto argerror;
-        break;
-      case 'o': case 'O':
-        *((Tcl_Obj **)vptr) = objvargno+1;
-        break;
-      default:
-        break;
-      }
-    }
-  }
-
-  if ((*c != ';') && ((objc-1) > argno)) {
-    Tcl_SetResult(interp, (char *) "Wrong # args.", TCL_STATIC);
-    goto argerror;
-  }
-  va_end(ap);
-  return TCL_OK;
-
- argerror:
-  {
-    char temp32;
-    sprintf(temp,"%d", argno+1);
-    c = strchr(fmt,':');
-    if (!c) c = strchr(fmt,';');
-    if (!c) c = (char *)"";
-    Tcl_AppendResult(interp,c," argument ", temp, NULL);
-    va_end(ap);
-    return TCL_ERROR;
-  }
-}
-
-#ifdef __cplusplus
-#if 0
-{ /* cc-mode */
-#endif
-}
-#endif
-
-
-
-#define SWIG_exception_fail(code, msg) do { SWIG_Error(code, msg); SWIG_fail; } while(0)
-
-#define SWIG_contract_assert(expr, msg) if (!(expr)) { SWIG_Error(SWIG_RuntimeError, msg); SWIG_fail; } else
-
-
-
-/* -------- TYPES TABLE (BEGIN) -------- */
-
-#define SWIGTYPE_p__profile_t swig_types0
-#define SWIGTYPE_p_char swig_types1
-#define SWIGTYPE_p_int swig_types2
-#define SWIGTYPE_p_long swig_types3
-#define SWIGTYPE_p_p__profile_t swig_types4
-#define SWIGTYPE_p_p_char swig_types5
-#define SWIGTYPE_p_p_p_char swig_types6
-#define SWIGTYPE_p_p_p_void swig_types7
-#define SWIGTYPE_p_p_void swig_types8
-static swig_type_info *swig_types10;
-static swig_module_info swig_module = {swig_types, 9, 0, 0, 0, 0};
-#define SWIG_TypeQuery(name) SWIG_TypeQueryModule(&swig_module, &swig_module, name)
-#define SWIG_MangledTypeQuery(name) SWIG_MangledTypeQueryModule(&swig_module, &swig_module, name)
-
-/* -------- TYPES TABLE (END) -------- */
-
-#define SWIG_init    Profile_Init
-#define SWIG_name    "profile"
-#define SWIG_prefix  ""
-#define SWIG_version "0.0"
-
-#define SWIGVERSION 0x010340
-#define SWIG_VERSION SWIGVERSION
-
-
-#define SWIG_as_voidptr(a) (void *)((const void *)(a))
-#define SWIG_as_voidptrptr(a) ((void)SWIG_as_voidptr(*a),(void**)(a))
-
-
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-#ifdef MAC_TCL
-#pragma export on
-#endif
-SWIGEXPORT int SWIG_init(Tcl_Interp *);
-#ifdef MAC_TCL
-#pragma export off
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-/* Compatibility version for TCL stubs */
-#ifndef SWIG_TCL_STUBS_VERSION
-#define SWIG_TCL_STUBS_VERSION "8.1"
-#endif
-
-
-
-/*
- * Copyright 2004, 2008 by the Massachusetts Institute of Technology.
- * All Rights Reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- *
- *
- * Input for wrapper generator program SWIG for profile routines.
- */
-#include <errno.h>
-#include "com_err.h"
-#include "profile.h"
-
-#ifdef SWIGTCL
-/* Reduce warnings about cast discarding const to just this one, from
-   every SWIG-generated call to Tcl_SetResult.  */
-static void my_tcl_setresult(Tcl_Interp *i, const char *str, Tcl_FreeProc *f)
-{
-    Tcl_SetResult(i, (char *) str, f);
-}
-#undef Tcl_SetResult
-#define Tcl_SetResult my_tcl_setresult
-#endif
-
-
-typedef struct {
-    void *handle;
-    char **args;
-} *iter_t;
-
-
-SWIGINTERN int
-SWIG_AsCharPtrAndSize(Tcl_Obj *obj, char** cptr, size_t* psize, int *alloc)
-{
-  int len = 0;
-  char *cstr = Tcl_GetStringFromObj(obj, &len);
-  if (cstr) {
-    if (cptr)  *cptr = cstr;
-    if (psize) *psize = len + 1;
-    if (alloc) *alloc = SWIG_OLDOBJ;
-    return SWIG_OK;
-  }
-  return SWIG_TypeError;
-}
-
-
-
-
-
-#include <limits.h>
-#if !defined(SWIG_NO_LLONG_MAX)
-# if !defined(LLONG_MAX) && defined(__GNUC__) && defined (__LONG_LONG_MAX__)
-#   define LLONG_MAX __LONG_LONG_MAX__
-#   define LLONG_MIN (-LLONG_MAX - 1LL)
-#   define ULLONG_MAX (LLONG_MAX * 2ULL + 1ULL)
-# endif
-#endif
-
-
-SWIGINTERN int
-SWIG_AsVal_long SWIG_TCL_DECL_ARGS_2(Tcl_Obj *obj, long* val)
-{
-  long v;
-  if (Tcl_GetLongFromObj(0,obj, &v) == TCL_OK) {
-    if (val) *val = (long) v;
-    return SWIG_OK;
-  }
-  return SWIG_TypeError;
-}
-
-
-SWIGINTERN int
-SWIG_AsVal_int SWIG_TCL_DECL_ARGS_2(Tcl_Obj * obj, int *val)
-{
-  long v;
-  int res = SWIG_AsVal_long SWIG_TCL_CALL_ARGS_2(obj, &v);
-  if (SWIG_IsOK(res)) {
-    if ((v < INT_MIN || v > INT_MAX)) {
-      return SWIG_OverflowError;
-    } else {
-      if (val) *val = (int)(v);
-    }
-  }
-  return res;
-}
-
-
-SWIGINTERNINLINE Tcl_Obj*
-SWIG_From_long  (long value)
-{
-  if (((long) INT_MIN <= value) && (value <= (long) INT_MAX)) {
-    return Tcl_NewIntObj((int)(value));
-  } else {
-    return Tcl_NewLongObj(value);
-  }
-}
-
-
-SWIGINTERNINLINE Tcl_Obj *
-SWIG_From_int  (int value)
-{
-  return SWIG_From_long  (value);
-}
-
-
-static void iter_free(iter_t it)
-{
-    int i;
-
-    for (i = 0; it->args != NULL && it->argsi != NULL; i++)
-	free(it->argsi);
-    free(it->args);
-    profile_iterator_free(&it->handle);
-    free(it);
-}
-
-static errcode_t iter_create(profile_t p, const char **nullterm,
-			     int flags, iter_t *OUTPUT)
-{
-    iter_t it;
-    errcode_t err;
-
-    it = malloc(sizeof(*it));
-    if (it == NULL)
-	return ENOMEM;
-    {
-	/* The current implementation requires that the names be kept around
-	 * for the lifetime of the iterator. */
-	int count, j;
-	for (count = 0; nulltermcount; count++) ;
-	it->args = calloc(count + 1, sizeof(*it->args));
-	if (it->args == NULL)
-	    return ENOMEM;
-	for (j = 0; j < count; j++) {
-	    it->argsj = strdup(nulltermj);
-	    if (it->argsj == NULL)
-		return ENOMEM;
-	}
-	it->argsj = NULL;
-    }
-    err = profile_iterator_create(p, (const char **)it->args, flags,
-				  &it->handle);
-    if (err)
-	iter_free(it);
-    else
-	*OUTPUT = it;
-    return err;
-}
-
-
-/* A TCL_AppInit() function that lets you build a new copy
- * of tclsh.
- *
- * The macro SWIG_init contains the name of the initialization
- * function in the wrapper file.
- */
-
-#ifndef SWIG_RcFileName
-char *SWIG_RcFileName = "~/.myapprc";
-#endif
-
-
-#ifdef MAC_TCL
-extern int		MacintoshInit _ANSI_ARGS_((void));
-#endif
-
-int Tcl_AppInit(Tcl_Interp *interp){
-
-  if (Tcl_Init(interp) == TCL_ERROR)
-    return TCL_ERROR;
-
-  /* Now initialize our functions */
-
-  if (SWIG_init(interp) == TCL_ERROR)
-    return TCL_ERROR;
-#if TCL_MAJOR_VERSION > 7 || TCL_MAJOR_VERSION == 7 && TCL_MINOR_VERSION >= 5
-   Tcl_SetVar(interp, (char *) "tcl_rcFileName",SWIG_RcFileName,TCL_GLOBAL_ONLY);
-#else
-   tcl_RcFileName = SWIG_RcFileName;
-#endif
-#ifdef SWIG_RcRsrcName
-  Tcl_SetVar(interp, (char *) "tcl_rcRsrcName",SWIG_RcRsrcName,TCL_GLOBAL);
-#endif
-
-  return TCL_OK;
-}
-
-#if TCL_MAJOR_VERSION > 7 || TCL_MAJOR_VERSION == 7 && TCL_MINOR_VERSION >= 4
-int main(int argc, char **argv) {
-#ifdef MAC_TCL
-    char *newArgv2;
-
-    if (MacintoshInit()  != TCL_OK) {
-	Tcl_Exit(1);
-    }
-
-    argc = 1;
-    newArgv0 = "tclsh";
-    newArgv1 = NULL;
-    argv = newArgv;
-#endif
-
-  Tcl_Main(argc, argv, Tcl_AppInit);
-  return(0);
-
-}
-#else
-extern int main();
-#endif
-
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-SWIGINTERN int
-_wrap_profile_init_path(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  char *arg1 = (char *) NULL ;
-  profile_t *arg2 = (profile_t *) 0 ;
-  int res1 ;
-  char *buf1 = 0 ;
-  int alloc1 = 0 ;
-  profile_t tmp2 ;
-  errcode_t result;
-
-  {
-    /*generic swigtype hack*/ arg2 = &tmp2;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"|o:profile_init_path ?path? ",(void *)0) == TCL_ERROR) SWIG_fail;
-  if (objc > 1) {
-    res1 = SWIG_AsCharPtrAndSize(objv1, &buf1, NULL, &alloc1);
-    if (!SWIG_IsOK(res1)) {
-      SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_init_path" "', argument " "1"" of type '" "char const *""'");
-    }
-    arg1 = (char *)(buf1);
-  }
-  result = (errcode_t)profile_init_path((char const *)arg1,arg2);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  /*generic swigtype hack*/ Tcl_SetObjResult(interp,SWIG_NewInstanceObj((void *) *arg2, SWIGTYPE_p__profile_t,0));
-  if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
-  return TCL_OK;
-fail:
-  if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_init(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  char **arg1 = (char **) NULL ;
-  profile_t *arg2 = (profile_t *) 0 ;
-  profile_t tmp2 ;
-  errcode_t result;
-
-  {
-    /*generic swigtype hack*/ arg2 = &tmp2;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"|o:profile_init ?nullterm? ",(void *)0) == TCL_ERROR) SWIG_fail;
-  if (objc > 1) {
-    {
-      /* in char **nullterm */
-      int n;
-      if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv1,NULL), &n, (const char ***) &arg1) == TCL_ERROR) SWIG_fail;
-    }
-  }
-  result = (errcode_t)profile_init((char const **)arg1,arg2);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  /*generic swigtype hack*/ Tcl_SetObjResult(interp,SWIG_NewInstanceObj((void *) *arg2, SWIGTYPE_p__profile_t,0));
-  {
-    /* freearg char **nullterm */
-    if (arg1) {
-      Tcl_Free((char *)arg1); arg1 = (char **) NULL;
-    }
-  }
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg1) {
-      Tcl_Free((char *)arg1); arg1 = (char **) NULL;
-    }
-  }
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_flush(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  errcode_t result;
-
-  if (SWIG_GetArgs(interp, objc, objv,"o:profile_flush profile_t ",(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_flush" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  result = (errcode_t)profile_flush(arg1);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  return TCL_OK;
-fail:
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_flush_to_file(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char *arg2 = (char *) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int res2 ;
-  char *buf2 = 0 ;
-  int alloc2 = 0 ;
-  errcode_t result;
-
-  if (SWIG_GetArgs(interp, objc, objv,"oo:profile_flush_to_file profile_t path ",(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_flush_to_file" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  res2 = SWIG_AsCharPtrAndSize(objv2, &buf2, NULL, &alloc2);
-  if (!SWIG_IsOK(res2)) {
-    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "profile_flush_to_file" "', argument " "2"" of type '" "char const *""'");
-  }
-  arg2 = (char *)(buf2);
-  result = (errcode_t)profile_flush_to_file(arg1,(char const *)arg2);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  return TCL_OK;
-fail:
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_abandon(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-
-  if (SWIG_GetArgs(interp, objc, objv,"o:profile_abandon profile_t ",(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_abandon" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  profile_abandon(arg1);
-
-  return TCL_OK;
-fail:
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_release(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-
-  if (SWIG_GetArgs(interp, objc, objv,"o:profile_release profile_t ",(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_release" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  profile_release(arg1);
-
-  return TCL_OK;
-fail:
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_get_values(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  char ***arg3 = (char ***) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  char **tmp3 ;
-  errcode_t result;
-
-  {
-    /* in char ***OUTPUT */
-    tmp3 = NULL;
-    arg3 = &tmp3;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"oo:profile_get_values p nullterm ",(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_get_values" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  result = (errcode_t)profile_get_values(arg1,(char const **)arg2,arg3);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* argout char ***OUTPUT */
-    int i;
-    for (i = 0; (*arg3)i; i++)
-    Tcl_AppendElement(interp, (*arg3)i);
-  }
-  profile_free_list(*arg3);
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_get_string(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char *arg2 = (char *) 0 ;
-  char *arg3 = (char *) 0 ;
-  char *arg4 = (char *) NULL ;
-  char *arg5 = (char *) NULL ;
-  char **arg6 = (char **) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int res2 ;
-  char *buf2 = 0 ;
-  int alloc2 = 0 ;
-  int res3 ;
-  char *buf3 = 0 ;
-  int alloc3 = 0 ;
-  int res4 ;
-  char *buf4 = 0 ;
-  int alloc4 = 0 ;
-  int res5 ;
-  char *buf5 = 0 ;
-  int alloc5 = 0 ;
-  char *tmp6 ;
-  errcode_t result;
-
-  {
-    /* in char **OUTPUT */
-    tmp6 = NULL;
-    arg6 = &tmp6;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"ooo|oo:profile_get_string p name subname ?subsubname? ?defval? ",(void *)0,(void *)0,(void *)0,(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_get_string" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  res2 = SWIG_AsCharPtrAndSize(objv2, &buf2, NULL, &alloc2);
-  if (!SWIG_IsOK(res2)) {
-    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "profile_get_string" "', argument " "2"" of type '" "char const *""'");
-  }
-  arg2 = (char *)(buf2);
-  res3 = SWIG_AsCharPtrAndSize(objv3, &buf3, NULL, &alloc3);
-  if (!SWIG_IsOK(res3)) {
-    SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "profile_get_string" "', argument " "3"" of type '" "char const *""'");
-  }
-  arg3 = (char *)(buf3);
-  if (objc > 4) {
-    res4 = SWIG_AsCharPtrAndSize(objv4, &buf4, NULL, &alloc4);
-    if (!SWIG_IsOK(res4)) {
-      SWIG_exception_fail(SWIG_ArgError(res4), "in method '" "profile_get_string" "', argument " "4"" of type '" "char const *""'");
-    }
-    arg4 = (char *)(buf4);
-  }
-  if (objc > 5) {
-    res5 = SWIG_AsCharPtrAndSize(objv5, &buf5, NULL, &alloc5);
-    if (!SWIG_IsOK(res5)) {
-      SWIG_exception_fail(SWIG_ArgError(res5), "in method '" "profile_get_string" "', argument " "5"" of type '" "char const *""'");
-    }
-    arg5 = (char *)(buf5);
-  }
-  result = (errcode_t)profile_get_string(arg1,(char const *)arg2,(char const *)arg3,(char const *)arg4,(char const *)arg5,arg6);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* argout char **OUTPUT */
-    /*    Tcl_SetResult(interp, *arg6, TCL_DYNAMIC); */
-    char *s = (arg6 && *arg6) ? *arg6 : "";
-    Tcl_ListObjAppendElement(interp, Tcl_GetObjResult(interp),
-      Tcl_NewStringObj(s, strlen(s)));
-    profile_release_string(s);
-  }
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  if (alloc5 == SWIG_NEWOBJ) free((char*)buf5);
-  return TCL_OK;
-fail:
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  if (alloc5 == SWIG_NEWOBJ) free((char*)buf5);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_get_integer(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char *arg2 = (char *) 0 ;
-  char *arg3 = (char *) 0 ;
-  char *arg4 = (char *) NULL ;
-  int arg5 = (int) 0 ;
-  int *arg6 = (int *) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int res2 ;
-  char *buf2 = 0 ;
-  int alloc2 = 0 ;
-  int res3 ;
-  char *buf3 = 0 ;
-  int alloc3 = 0 ;
-  int res4 ;
-  char *buf4 = 0 ;
-  int alloc4 = 0 ;
-  int val5 ;
-  int ecode5 = 0 ;
-  int temp6 ;
-  int res6 = SWIG_TMPOBJ ;
-  errcode_t result;
-
-  arg6 = &temp6;
-  if (SWIG_GetArgs(interp, objc, objv,"ooo|oo:profile_get_integer p name subname ?subsubname? ?defval? ",(void *)0,(void *)0,(void *)0,(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_get_integer" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  res2 = SWIG_AsCharPtrAndSize(objv2, &buf2, NULL, &alloc2);
-  if (!SWIG_IsOK(res2)) {
-    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "profile_get_integer" "', argument " "2"" of type '" "char const *""'");
-  }
-  arg2 = (char *)(buf2);
-  res3 = SWIG_AsCharPtrAndSize(objv3, &buf3, NULL, &alloc3);
-  if (!SWIG_IsOK(res3)) {
-    SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "profile_get_integer" "', argument " "3"" of type '" "char const *""'");
-  }
-  arg3 = (char *)(buf3);
-  if (objc > 4) {
-    res4 = SWIG_AsCharPtrAndSize(objv4, &buf4, NULL, &alloc4);
-    if (!SWIG_IsOK(res4)) {
-      SWIG_exception_fail(SWIG_ArgError(res4), "in method '" "profile_get_integer" "', argument " "4"" of type '" "char const *""'");
-    }
-    arg4 = (char *)(buf4);
-  }
-  if (objc > 5) {
-    ecode5 = SWIG_AsVal_int SWIG_TCL_CALL_ARGS_2(objv5, &val5);
-    if (!SWIG_IsOK(ecode5)) {
-      SWIG_exception_fail(SWIG_ArgError(ecode5), "in method '" "profile_get_integer" "', argument " "5"" of type '" "int""'");
-    }
-    arg5 = (int)(val5);
-  }
-  result = (errcode_t)profile_get_integer(arg1,(char const *)arg2,(char const *)arg3,(char const *)arg4,arg5,arg6);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  if (SWIG_IsTmpObj(res6)) {
-    Tcl_ListObjAppendElement(interp,Tcl_GetObjResult(interp),SWIG_From_int((*arg6)));
-  } else {
-    int new_flags = SWIG_IsNewObj(res6) ? (SWIG_POINTER_OWN |  0 ) :  0 ;
-    Tcl_ListObjAppendElement(interp,Tcl_GetObjResult(interp),SWIG_NewPointerObj((void*)(arg6), SWIGTYPE_p_int, new_flags));
-  }
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  return TCL_OK;
-fail:
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_get_boolean(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char *arg2 = (char *) 0 ;
-  char *arg3 = (char *) 0 ;
-  char *arg4 = (char *) NULL ;
-  int arg5 = (int) 0 ;
-  int *arg6 = (int *) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int res2 ;
-  char *buf2 = 0 ;
-  int alloc2 = 0 ;
-  int res3 ;
-  char *buf3 = 0 ;
-  int alloc3 = 0 ;
-  int res4 ;
-  char *buf4 = 0 ;
-  int alloc4 = 0 ;
-  int val5 ;
-  int ecode5 = 0 ;
-  int temp6 ;
-  int res6 = SWIG_TMPOBJ ;
-  errcode_t result;
-
-  arg6 = &temp6;
-  if (SWIG_GetArgs(interp, objc, objv,"ooo|oo:profile_get_boolean p name subname ?subsubname? ?defval? ",(void *)0,(void *)0,(void *)0,(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_get_boolean" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  res2 = SWIG_AsCharPtrAndSize(objv2, &buf2, NULL, &alloc2);
-  if (!SWIG_IsOK(res2)) {
-    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "profile_get_boolean" "', argument " "2"" of type '" "char const *""'");
-  }
-  arg2 = (char *)(buf2);
-  res3 = SWIG_AsCharPtrAndSize(objv3, &buf3, NULL, &alloc3);
-  if (!SWIG_IsOK(res3)) {
-    SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "profile_get_boolean" "', argument " "3"" of type '" "char const *""'");
-  }
-  arg3 = (char *)(buf3);
-  if (objc > 4) {
-    res4 = SWIG_AsCharPtrAndSize(objv4, &buf4, NULL, &alloc4);
-    if (!SWIG_IsOK(res4)) {
-      SWIG_exception_fail(SWIG_ArgError(res4), "in method '" "profile_get_boolean" "', argument " "4"" of type '" "char const *""'");
-    }
-    arg4 = (char *)(buf4);
-  }
-  if (objc > 5) {
-    ecode5 = SWIG_AsVal_int SWIG_TCL_CALL_ARGS_2(objv5, &val5);
-    if (!SWIG_IsOK(ecode5)) {
-      SWIG_exception_fail(SWIG_ArgError(ecode5), "in method '" "profile_get_boolean" "', argument " "5"" of type '" "int""'");
-    }
-    arg5 = (int)(val5);
-  }
-  result = (errcode_t)profile_get_boolean(arg1,(char const *)arg2,(char const *)arg3,(char const *)arg4,arg5,arg6);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  if (SWIG_IsTmpObj(res6)) {
-    Tcl_ListObjAppendElement(interp,Tcl_GetObjResult(interp),SWIG_From_int((*arg6)));
-  } else {
-    int new_flags = SWIG_IsNewObj(res6) ? (SWIG_POINTER_OWN |  0 ) :  0 ;
-    Tcl_ListObjAppendElement(interp,Tcl_GetObjResult(interp),SWIG_NewPointerObj((void*)(arg6), SWIGTYPE_p_int, new_flags));
-  }
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  return TCL_OK;
-fail:
-  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_get_relation_names(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  char ***arg3 = (char ***) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  char **tmp3 ;
-  errcode_t result;
-
-  {
-    /* in char ***OUTPUT */
-    tmp3 = NULL;
-    arg3 = &tmp3;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"oo:profile_get_relation_names p nullterm ",(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_get_relation_names" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  result = (errcode_t)profile_get_relation_names(arg1,(char const **)arg2,arg3);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* argout char ***OUTPUT */
-    int i;
-    for (i = 0; (*arg3)i; i++)
-    Tcl_AppendElement(interp, (*arg3)i);
-  }
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_get_subsection_names(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  char ***arg3 = (char ***) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  char **tmp3 ;
-  errcode_t result;
-
-  {
-    /* in char ***OUTPUT */
-    tmp3 = NULL;
-    arg3 = &tmp3;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"oo:profile_get_subsection_names p nullterm ",(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_get_subsection_names" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  result = (errcode_t)profile_get_subsection_names(arg1,(char const **)arg2,arg3);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* argout char ***OUTPUT */
-    int i;
-    for (i = 0; (*arg3)i; i++)
-    Tcl_AppendElement(interp, (*arg3)i);
-  }
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_iterator_create(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  int arg3 ;
-  iter_t *arg4 = (iter_t *) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int val3 ;
-  int ecode3 = 0 ;
-  iter_t tmp4 ;
-  errcode_t result;
-
-  {
-    /*generic swigtype hack*/ arg4 = &tmp4;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"ooo:profile_iterator_create p nullterm flags ",(void *)0,(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_iterator_create" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  ecode3 = SWIG_AsVal_int SWIG_TCL_CALL_ARGS_2(objv3, &val3);
-  if (!SWIG_IsOK(ecode3)) {
-    SWIG_exception_fail(SWIG_ArgError(ecode3), "in method '" "profile_iterator_create" "', argument " "3"" of type '" "int""'");
-  }
-  arg3 = (int)(val3);
-  result = (errcode_t)iter_create(arg1,(char const **)arg2,arg3,arg4);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  /*generic swigtype hack*/ Tcl_SetObjResult(interp,SWIG_NewInstanceObj((void *) *arg4, SWIGTYPE_p_p_void,0));
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_iterator_free(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  iter_t arg1 = (iter_t) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-
-  if (SWIG_GetArgs(interp, objc, objv,"o:profile_iterator_free i ",(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p_p_void, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_iterator_free" "', argument " "1"" of type '" "iter_t""'");
-  }
-  arg1 = (iter_t)(argp1);
-  iter_free(arg1);
-
-  return TCL_OK;
-fail:
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_iterator(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  iter_t arg1 = (iter_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  char **arg3 = (char **) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  char *tmp2 ;
-  char *tmp3 ;
-  errcode_t result;
-
-  {
-    /* in char **OUTPUT */
-    tmp2 = NULL;
-    arg2 = &tmp2;
-  }
-  {
-    /* in char **OUTPUT */
-    tmp3 = NULL;
-    arg3 = &tmp3;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"o:profile_iterator iter_t ",(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p_p_void, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_iterator" "', argument " "1"" of type '" "iter_t""'");
-  }
-  arg1 = (iter_t)(argp1);
-  result = (errcode_t)profile_iterator(&arg1->handle,arg2,arg3);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* argout char **OUTPUT */
-    /*    Tcl_SetResult(interp, *arg2, TCL_DYNAMIC); */
-    char *s = (arg2 && *arg2) ? *arg2 : "";
-    Tcl_ListObjAppendElement(interp, Tcl_GetObjResult(interp),
-      Tcl_NewStringObj(s, strlen(s)));
-  }
-  profile_release_string(*arg2);
-  {
-    /* argout char **OUTPUT */
-    /*    Tcl_SetResult(interp, *arg3, TCL_DYNAMIC); */
-    char *s = (arg3 && *arg3) ? *arg3 : "";
-    Tcl_ListObjAppendElement(interp, Tcl_GetObjResult(interp),
-      Tcl_NewStringObj(s, strlen(s)));
-  }
-  profile_release_string(*arg3);
-  return TCL_OK;
-fail:
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_update_relation(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  char *arg3 = (char *) 0 ;
-  char *arg4 = (char *) NULL ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int res3 ;
-  char *buf3 = 0 ;
-  int alloc3 = 0 ;
-  int res4 ;
-  char *buf4 = 0 ;
-  int alloc4 = 0 ;
-  errcode_t result;
-
-  if (SWIG_GetArgs(interp, objc, objv,"ooo|o:profile_update_relation p nullterm oldval ?newval? ",(void *)0,(void *)0,(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_update_relation" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  res3 = SWIG_AsCharPtrAndSize(objv3, &buf3, NULL, &alloc3);
-  if (!SWIG_IsOK(res3)) {
-    SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "profile_update_relation" "', argument " "3"" of type '" "char const *""'");
-  }
-  arg3 = (char *)(buf3);
-  if (objc > 4) {
-    res4 = SWIG_AsCharPtrAndSize(objv4, &buf4, NULL, &alloc4);
-    if (!SWIG_IsOK(res4)) {
-      SWIG_exception_fail(SWIG_ArgError(res4), "in method '" "profile_update_relation" "', argument " "4"" of type '" "char const *""'");
-    }
-    arg4 = (char *)(buf4);
-  }
-  result = (errcode_t)profile_update_relation(arg1,(char const **)arg2,(char const *)arg3,(char const *)arg4);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_clear_relation(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  errcode_t result;
-
-  if (SWIG_GetArgs(interp, objc, objv,"oo:profile_clear_relation p nullterm ",(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_clear_relation" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  result = (errcode_t)profile_clear_relation(arg1,(char const **)arg2);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_rename_section(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  char *arg3 = (char *) NULL ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int res3 ;
-  char *buf3 = 0 ;
-  int alloc3 = 0 ;
-  errcode_t result;
-
-  if (SWIG_GetArgs(interp, objc, objv,"oo|o:profile_rename_section p nullterm ?new_name? ",(void *)0,(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_rename_section" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  if (objc > 3) {
-    res3 = SWIG_AsCharPtrAndSize(objv3, &buf3, NULL, &alloc3);
-    if (!SWIG_IsOK(res3)) {
-      SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "profile_rename_section" "', argument " "3"" of type '" "char const *""'");
-    }
-    arg3 = (char *)(buf3);
-  }
-  result = (errcode_t)profile_rename_section(arg1,(char const **)arg2,(char const *)arg3);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_add_relation(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  char *arg3 = (char *) NULL ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  int res3 ;
-  char *buf3 = 0 ;
-  int alloc3 = 0 ;
-  errcode_t result;
-
-  if (SWIG_GetArgs(interp, objc, objv,"oo|o:profile_add_relation p nullterm ?new_val? ",(void *)0,(void *)0,(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_add_relation" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  {
-    /* in char **nullterm */
-    int n;
-    if (Tcl_SplitList(interp, Tcl_GetStringFromObj(objv2,NULL), &n, (const char ***) &arg2) == TCL_ERROR) SWIG_fail;
-  }
-  if (objc > 3) {
-    res3 = SWIG_AsCharPtrAndSize(objv3, &buf3, NULL, &alloc3);
-    if (!SWIG_IsOK(res3)) {
-      SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "profile_add_relation" "', argument " "3"" of type '" "char const *""'");
-    }
-    arg3 = (char *)(buf3);
-  }
-  result = (errcode_t)profile_add_relation(arg1,(char const **)arg2,(char const *)arg3);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  return TCL_OK;
-fail:
-  {
-    /* freearg char **nullterm */
-    if (arg2) {
-      Tcl_Free((char *)arg2); arg2 = (char **) NULL;
-    }
-  }
-  if (alloc3 == SWIG_NEWOBJ) free((char*)buf3);
-  return TCL_ERROR;
-}
-
-
-SWIGINTERN int
-_wrap_profile_flush_to_buffer(ClientData clientData SWIGUNUSED, Tcl_Interp *interp, int objc, Tcl_Obj *CONST objv) {
-  profile_t arg1 = (profile_t) 0 ;
-  char **arg2 = (char **) 0 ;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  char *tmp2 ;
-  errcode_t result;
-
-  {
-    /* in char **OUTPUT */
-    tmp2 = NULL;
-    arg2 = &tmp2;
-  }
-  if (SWIG_GetArgs(interp, objc, objv,"o:profile_flush_to_buffer p ",(void *)0) == TCL_ERROR) SWIG_fail;
-  res1 = SWIG_ConvertPtr(objv1, &argp1,SWIGTYPE_p__profile_t, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "profile_flush_to_buffer" "', argument " "1"" of type '" "profile_t""'");
-  }
-  arg1 = (profile_t)(argp1);
-  result = (errcode_t)profile_flush_to_buffer(arg1,arg2);
-  {
-    /* out errcode_t result */
-    if (result) {
-      /* There could be a memory leak here in the SWIG-Tcl layer,
-      	   I'm not sure.  Not going to worry about it though.  */
-      Tcl_SetResult(interp, (char *) error_message(result), TCL_STATIC);
-      SWIG_fail;
-    }
-  }
-  {
-    /* argout char **OUTPUT */
-    /*    Tcl_SetResult(interp, *arg2, TCL_DYNAMIC); */
-    char *s = (arg2 && *arg2) ? *arg2 : "";
-    Tcl_ListObjAppendElement(interp, Tcl_GetObjResult(interp),
-      Tcl_NewStringObj(s, strlen(s)));
-  }
-  return TCL_OK;
-fail:
-  return TCL_ERROR;
-}
-
-
-
-static swig_command_info swig_commands = {
-    { SWIG_prefix "profile_init_path", (swig_wrapper_func) _wrap_profile_init_path, NULL},
-    { SWIG_prefix "profile_init", (swig_wrapper_func) _wrap_profile_init, NULL},
-    { SWIG_prefix "profile_flush", (swig_wrapper_func) _wrap_profile_flush, NULL},
-    { SWIG_prefix "profile_flush_to_file", (swig_wrapper_func) _wrap_profile_flush_to_file, NULL},
-    { SWIG_prefix "profile_abandon", (swig_wrapper_func) _wrap_profile_abandon, NULL},
-    { SWIG_prefix "profile_release", (swig_wrapper_func) _wrap_profile_release, NULL},
-    { SWIG_prefix "profile_get_values", (swig_wrapper_func) _wrap_profile_get_values, NULL},
-    { SWIG_prefix "profile_get_string", (swig_wrapper_func) _wrap_profile_get_string, NULL},
-    { SWIG_prefix "profile_get_integer", (swig_wrapper_func) _wrap_profile_get_integer, NULL},
-    { SWIG_prefix "profile_get_boolean", (swig_wrapper_func) _wrap_profile_get_boolean, NULL},
-    { SWIG_prefix "profile_get_relation_names", (swig_wrapper_func) _wrap_profile_get_relation_names, NULL},
-    { SWIG_prefix "profile_get_subsection_names", (swig_wrapper_func) _wrap_profile_get_subsection_names, NULL},
-    { SWIG_prefix "profile_iterator_create", (swig_wrapper_func) _wrap_profile_iterator_create, NULL},
-    { SWIG_prefix "profile_iterator_free", (swig_wrapper_func) _wrap_profile_iterator_free, NULL},
-    { SWIG_prefix "profile_iterator", (swig_wrapper_func) _wrap_profile_iterator, NULL},
-    { SWIG_prefix "profile_update_relation", (swig_wrapper_func) _wrap_profile_update_relation, NULL},
-    { SWIG_prefix "profile_clear_relation", (swig_wrapper_func) _wrap_profile_clear_relation, NULL},
-    { SWIG_prefix "profile_rename_section", (swig_wrapper_func) _wrap_profile_rename_section, NULL},
-    { SWIG_prefix "profile_add_relation", (swig_wrapper_func) _wrap_profile_add_relation, NULL},
-    { SWIG_prefix "profile_flush_to_buffer", (swig_wrapper_func) _wrap_profile_flush_to_buffer, NULL},
-    {0, 0, 0}
-};
-
-static swig_var_info swig_variables = {
-    {0,0,0,0}
-};
-
-static swig_const_info swig_constants = {
-    {0,0,0,0,0,0}
-};
-
-/* -------- TYPE CONVERSION AND EQUIVALENCE RULES (BEGIN) -------- */
-
-static swig_type_info _swigt__p__profile_t = {"_p__profile_t", "struct _profile_t *|profile_t", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_char = {"_p_char", "char *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_int = {"_p_int", "int *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_long = {"_p_long", "long *|errcode_t *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_p__profile_t = {"_p_p__profile_t", "profile_t *|struct _profile_t **", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_p_char = {"_p_p_char", "char **", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_p_p_char = {"_p_p_p_char", "char ***", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_p_p_void = {"_p_p_p_void", "void ***|iter_t *", 0, 0, (void*)0, 0};
-static swig_type_info _swigt__p_p_void = {"_p_p_void", "void **|iter_t", 0, 0, (void*)0, 0};
-
-static swig_type_info *swig_type_initial = {
-  &_swigt__p__profile_t,
-  &_swigt__p_char,
-  &_swigt__p_int,
-  &_swigt__p_long,
-  &_swigt__p_p__profile_t,
-  &_swigt__p_p_char,
-  &_swigt__p_p_p_char,
-  &_swigt__p_p_p_void,
-  &_swigt__p_p_void,
-};
-
-static swig_cast_info _swigc__p__profile_t = {  {&_swigt__p__profile_t, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_char = {  {&_swigt__p_char, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_int = {  {&_swigt__p_int, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_long = {  {&_swigt__p_long, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_p__profile_t = {  {&_swigt__p_p__profile_t, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_p_char = {  {&_swigt__p_p_char, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_p_p_char = {  {&_swigt__p_p_p_char, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_p_p_void = {  {&_swigt__p_p_p_void, 0, 0, 0},{0, 0, 0, 0}};
-static swig_cast_info _swigc__p_p_void = {  {&_swigt__p_p_void, 0, 0, 0},{0, 0, 0, 0}};
-
-static swig_cast_info *swig_cast_initial = {
-  _swigc__p__profile_t,
-  _swigc__p_char,
-  _swigc__p_int,
-  _swigc__p_long,
-  _swigc__p_p__profile_t,
-  _swigc__p_p_char,
-  _swigc__p_p_p_char,
-  _swigc__p_p_p_void,
-  _swigc__p_p_void,
-};
-
-
-/* -------- TYPE CONVERSION AND EQUIVALENCE RULES (END) -------- */
-
-#ifdef __cplusplus
-}
-#endif
-/* -----------------------------------------------------------------------------
- * Type initialization:
- * This problem is tough by the requirement that no dynamic
- * memory is used. Also, since swig_type_info structures store pointers to
- * swig_cast_info structures and swig_cast_info structures store pointers back
- * to swig_type_info structures, we need some lookup code at initialization.
- * The idea is that swig generates all the structures that are needed.
- * The runtime then collects these partially filled structures.
- * The SWIG_InitializeModule function takes these initial arrays out of
- * swig_module, and does all the lookup, filling in the swig_module.types
- * array with the correct data and linking the correct swig_cast_info
- * structures together.
- *
- * The generated swig_type_info structures are assigned staticly to an initial
- * array. We just loop through that array, and handle each type individually.
- * First we lookup if this type has been already loaded, and if so, use the
- * loaded structure instead of the generated one. Then we have to fill in the
- * cast linked list. The cast data is initially stored in something like a
- * two-dimensional array. Each row corresponds to a type (there are the same
- * number of rows as there are in the swig_type_initial array). Each entry in
- * a column is one of the swig_cast_info structures for that type.
- * The cast_initial array is actually an array of arrays, because each row has
- * a variable number of columns. So to actually build the cast linked list,
- * we find the array of casts associated with the type, and loop through it
- * adding the casts to the list. The one last trick we need to do is making
- * sure the type pointer in the swig_cast_info struct is correct.
- *
- * First off, we lookup the cast->type name to see if it is already loaded.
- * There are three cases to handle:
- *  1) If the cast->type has already been loaded AND the type we are adding
- *     casting info to has not been loaded (it is in this module), THEN we
- *     replace the cast->type pointer with the type pointer that has already
- *     been loaded.
- *  2) If BOTH types (the one we are adding casting info to, and the
- *     cast->type) are loaded, THEN the cast info has already been loaded by
- *     the previous module so we just ignore it.
- *  3) Finally, if cast->type has not already been loaded, then we add that
- *     swig_cast_info to the linked list (because the cast->type) pointer will
- *     be correct.
- * ----------------------------------------------------------------------------- */
-
-#ifdef __cplusplus
-extern "C" {
-#if 0
-} /* c-mode */
-#endif
-#endif
-
-#if 0
-#define SWIGRUNTIME_DEBUG
-#endif
-
-
-SWIGRUNTIME void
-SWIG_InitializeModule(void *clientdata) {
-  size_t i;
-  swig_module_info *module_head, *iter;
-  int found, init;
-
-  /* check to see if the circular list has been setup, if not, set it up */
-  if (swig_module.next==0) {
-    /* Initialize the swig_module */
-    swig_module.type_initial = swig_type_initial;
-    swig_module.cast_initial = swig_cast_initial;
-    swig_module.next = &swig_module;
-    init = 1;
-  } else {
-    init = 0;
-  }
-
-  /* Try and load any already created modules */
-  module_head = SWIG_GetModule(clientdata);
-  if (!module_head) {
-    /* This is the first module loaded for this interpreter */
-    /* so set the swig module into the interpreter */
-    SWIG_SetModule(clientdata, &swig_module);
-    module_head = &swig_module;
-  } else {
-    /* the interpreter has loaded a SWIG module, but has it loaded this one? */
-    found=0;
-    iter=module_head;
-    do {
-      if (iter==&swig_module) {
-        found=1;
-        break;
-      }
-      iter=iter->next;
-    } while (iter!= module_head);
-
-    /* if the is found in the list, then all is done and we may leave */
-    if (found) return;
-    /* otherwise we must add out module into the list */
-    swig_module.next = module_head->next;
-    module_head->next = &swig_module;
-  }
-
-  /* When multiple interpeters are used, a module could have already been initialized in
-       a different interpreter, but not yet have a pointer in this interpreter.
-       In this case, we do not want to continue adding types... everything should be
-       set up already */
-  if (init == 0) return;
-
-  /* Now work on filling in swig_module.types */
-#ifdef SWIGRUNTIME_DEBUG
-  printf("SWIG_InitializeModule: size %d\n", swig_module.size);
-#endif
-  for (i = 0; i < swig_module.size; ++i) {
-    swig_type_info *type = 0;
-    swig_type_info *ret;
-    swig_cast_info *cast;
-
-#ifdef SWIGRUNTIME_DEBUG
-    printf("SWIG_InitializeModule: type %d %s\n", i, swig_module.type_initiali->name);
-#endif
-
-    /* if there is another module already loaded */
-    if (swig_module.next != &swig_module) {
-      type = SWIG_MangledTypeQueryModule(swig_module.next, &swig_module, swig_module.type_initiali->name);
-    }
-    if (type) {
-      /* Overwrite clientdata field */
-#ifdef SWIGRUNTIME_DEBUG
-      printf("SWIG_InitializeModule: found type %s\n", type->name);
-#endif
-      if (swig_module.type_initiali->clientdata) {
-        type->clientdata = swig_module.type_initiali->clientdata;
-#ifdef SWIGRUNTIME_DEBUG
-        printf("SWIG_InitializeModule: found and overwrite type %s \n", type->name);
-#endif
-      }
-    } else {
-      type = swig_module.type_initiali;
-    }
-
-    /* Insert casting types */
-    cast = swig_module.cast_initiali;
-    while (cast->type) {
-      /* Don't need to add information already in the list */
-      ret = 0;
-#ifdef SWIGRUNTIME_DEBUG
-      printf("SWIG_InitializeModule: look cast %s\n", cast->type->name);
-#endif
-      if (swig_module.next != &swig_module) {
-        ret = SWIG_MangledTypeQueryModule(swig_module.next, &swig_module, cast->type->name);
-#ifdef SWIGRUNTIME_DEBUG
-        if (ret) printf("SWIG_InitializeModule: found cast %s\n", ret->name);
-#endif
-      }
-      if (ret) {
-        if (type == swig_module.type_initiali) {
-#ifdef SWIGRUNTIME_DEBUG
-          printf("SWIG_InitializeModule: skip old type %s\n", ret->name);
-#endif
-          cast->type = ret;
-          ret = 0;
-        } else {
-          /* Check for casting already in the list */
-          swig_cast_info *ocast = SWIG_TypeCheck(ret->name, type);
-#ifdef SWIGRUNTIME_DEBUG
-          if (ocast) printf("SWIG_InitializeModule: skip old cast %s\n", ret->name);
-#endif
-          if (!ocast) ret = 0;
-        }
-      }
-
-      if (!ret) {
-#ifdef SWIGRUNTIME_DEBUG
-        printf("SWIG_InitializeModule: adding cast %s\n", cast->type->name);
-#endif
-        if (type->cast) {
-          type->cast->prev = cast;
-          cast->next = type->cast;
-        }
-        type->cast = cast;
-      }
-      cast++;
-    }
-    /* Set entry in modules->types array equal to the type */
-    swig_module.typesi = type;
-  }
-  swig_module.typesi = 0;
-
-#ifdef SWIGRUNTIME_DEBUG
-  printf("**** SWIG_InitializeModule: Cast List ******\n");
-  for (i = 0; i < swig_module.size; ++i) {
-    int j = 0;
-    swig_cast_info *cast = swig_module.cast_initiali;
-    printf("SWIG_InitializeModule: type %d %s\n", i, swig_module.type_initiali->name);
-    while (cast->type) {
-      printf("SWIG_InitializeModule: cast type %s\n", cast->type->name);
-      cast++;
-      ++j;
-    }
-    printf("---- Total casts: %d\n",j);
-  }
-  printf("**** SWIG_InitializeModule: Cast List ******\n");
-#endif
-}
-
-/* This function will propagate the clientdata field of type to
-* any new swig_type_info structures that have been added into the list
-* of equivalent types.  It is like calling
-* SWIG_TypeClientData(type, clientdata) a second time.
-*/
-SWIGRUNTIME void
-SWIG_PropagateClientData(void) {
-  size_t i;
-  swig_cast_info *equiv;
-  static int init_run = 0;
-
-  if (init_run) return;
-  init_run = 1;
-
-  for (i = 0; i < swig_module.size; i++) {
-    if (swig_module.typesi->clientdata) {
-      equiv = swig_module.typesi->cast;
-      while (equiv) {
-        if (!equiv->converter) {
-          if (equiv->type && !equiv->type->clientdata)
-          SWIG_TypeClientData(equiv->type, swig_module.typesi->clientdata);
-        }
-        equiv = equiv->next;
-      }
-    }
-  }
-}
-
-#ifdef __cplusplus
-#if 0
-{
-  /* c-mode */
-#endif
-}
-#endif
-
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-  /* -----------------------------------------------------------------------------
-   * constants/methods manipulation
-   * ----------------------------------------------------------------------------- */
-
-  /* Install Constants */
-
-  SWIGINTERN void
-  SWIG_Tcl_InstallConstants(Tcl_Interp *interp, swig_const_info constants) {
-    int i;
-    Tcl_Obj *obj;
-
-    if (!swigconstTableinit) {
-      Tcl_InitHashTable(&swigconstTable, TCL_STRING_KEYS);
-      swigconstTableinit = 1;
-    }
-    for (i = 0; constantsi.type; i++) {
-      switch(constantsi.type) {
-      case SWIG_TCL_POINTER:
-        obj = SWIG_NewPointerObj(constantsi.pvalue, *(constantsi).ptype,0);
-        break;
-      case SWIG_TCL_BINARY:
-        obj = SWIG_NewPackedObj(constantsi.pvalue, constantsi.lvalue, *(constantsi.ptype));
-        break;
-      default:
-        obj = 0;
-        break;
-      }
-      if (obj) {
-        SWIG_Tcl_SetConstantObj(interp, constantsi.name, obj);
-      }
-    }
-  }
-
-#ifdef __cplusplus
-}
-#endif
-
-/* -----------------------------------------------------------------------------*
- *  Partial Init method
- * -----------------------------------------------------------------------------*/
-
-SWIGEXPORT int SWIG_init(Tcl_Interp *interp) {
-  int i;
-  if (interp == 0) return TCL_ERROR;
-#ifdef USE_TCL_STUBS
-  /* (char*) cast is required to avoid compiler warning/error for Tcl < 8.4. */
-  if (Tcl_InitStubs(interp, (char*)SWIG_TCL_STUBS_VERSION, 0) == NULL) {
-    return TCL_ERROR;
-  }
-#endif
-#ifdef USE_TK_STUBS
-  /* (char*) cast is required to avoid compiler warning/error. */
-  if (Tk_InitStubs(interp, (char*)SWIG_TCL_STUBS_VERSION, 0) == NULL) {
-    return TCL_ERROR;
-  }
-#endif
-
-  Tcl_PkgProvide(interp, (char*)SWIG_name, (char*)SWIG_version);
-
-#ifdef SWIG_namespace
-  Tcl_Eval(interp, "namespace eval " SWIG_namespace " { }");
-#endif
-
-  SWIG_InitializeModule((void *) interp);
-  SWIG_PropagateClientData();
-
-  for (i = 0; swig_commandsi.name; i++) {
-    Tcl_CreateObjCommand(interp, (char *) swig_commandsi.name, (swig_wrapper_func) swig_commandsi.wrapper,
-      swig_commandsi.clientdata, NULL);
-  }
-  for (i = 0; swig_variablesi.name; i++) {
-    Tcl_SetVar(interp, (char *) swig_variablesi.name, (char *) "", TCL_GLOBAL_ONLY);
-    Tcl_TraceVar(interp, (char *) swig_variablesi.name, TCL_TRACE_READS | TCL_GLOBAL_ONLY,
-      (Tcl_VarTraceProc *) swig_variablesi.get, (ClientData) swig_variablesi.addr);
-    Tcl_TraceVar(interp, (char *) swig_variablesi.name, TCL_TRACE_WRITES | TCL_GLOBAL_ONLY,
-      (Tcl_VarTraceProc *) swig_variablesi.set, (ClientData) swig_variablesi.addr);
-  }
-
-  SWIG_Tcl_InstallConstants(interp, swig_constants);
-
-
-  return TCL_OK;
-}

_service:tar_scm:krb5-1.20.1.tar.gz.asc Added

_service:tar_scm:krb5-1.19.2.tar.gz/.github/workflows/build.yml -> _service:tar_scm:krb5-1.20.1.tar.gz/.github/workflows/build.yml Changed

@@ -17,6 +17,7 @@
                       os: ubuntu-18.04
                       compiler: clang
                       makevars: CPPFLAGS=-Werror
+                      configureopts: --enable-asan
                     - name: linux-clang-openssl
                       os: ubuntu-18.04
                       compiler: clang
@@ -32,7 +33,7 @@
               if: startsWith(matrix.os, 'ubuntu')
               run: |
                 sudo apt-get update -qq
-                sudo apt-get install -y bison dejagnu gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libresolv-wrapper libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcl-dev tcsh
+                sudo apt-get install -y bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libresolv-wrapper libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcsh
                 pip3 install pyrad
             - name: Build
               env:
@@ -60,7 +61,7 @@
                 fi
 
     windows:
-        runs-on: windows-latest
+        runs-on: windows-2019
         env:
             KRB_INSTALL_DIR: C:\kfw
         steps:

_service:tar_scm:krb5-1.19.2.tar.gz/NOTICE -> _service:tar_scm:krb5-1.20.1.tar.gz/NOTICE Changed

_service:tar_scm:krb5-1.19.2.tar.gz/README -> _service:tar_scm:krb5-1.20.1.tar.gz/README Changed

@@ -1,4 +1,4 @@
-                   Kerberos Version 5, Release 1.19
+                   Kerberos Version 5, Release 1.20
 
                             Release Notes
                         The MIT Kerberos Team
@@ -6,7 +6,7 @@
 Copyright and Other Notices
 ---------------------------
 
-Copyright (C) 1985-2021 by the Massachusetts Institute of Technology
+Copyright (C) 1985-2022 by the Massachusetts Institute of Technology
 and its contributors.  All rights reserved.
 
 Please see the file named NOTICE for additional notices.
@@ -64,6 +64,16 @@
 interface to our bug database is read-only for guests, and the primary
 way to interact with our bug database is via email.
 
+PAC transition
+--------------
+
+Beginning with release 1.20, the KDC will include minimal PACs in
+tickets instead of AD-SIGNEDPATH authdata.  S4U requests (protocol
+transition and constrained delegation) must now contain valid PACs in
+the incoming tickets.  If only some KDCs in a realm have been upgraded
+across version 1.20, the upgraded KDCs will reject S4U requests
+containing tickets from non-upgraded KDCs and vice versa.
+
 Triple-DES transition
 ---------------------
 
@@ -75,163 +85,133 @@
 Beginning with the krb5-1.18 release, single-DES encryption types have
 been removed.
 
-Major changes in 1.19.2 (2021-07-22)
+Major changes in 1.20.1 (2022-11-15)
 ------------------------------------
 
 This is a bug fix release.
 
-* Fix a denial of service attack against the KDC encrypted challenge
-  code CVE-2021-36222.
-
-* Fix a memory leak when gss_inquire_cred() is called without a
-  credential handle.
+* Fix integer overflows in PAC parsing CVE-2022-42898.
 
-krb5-1.19.2 changes by ticket ID
---------------------------------
-
-8989    Fix typo in enctypes.rst
-8992    Avoid rand() in aes-gen test program
-9005    Fix argument type errors on Windows
-9006    doc build fails with Sphinx 4.0.2
-9007    Fix KDC null deref on bad encrypted challenge
-9014    Using locking in MEMORY krb5_cc_get_principal()
-9015    Fix use-after-free during krad remote_shutdown()
-9016    Memory leak in krb5_gss_inquire_cred
+* Fix null deref in KDC when decoding invalid NDR.
 
-Major changes in 1.19.1 (2021-02-18)
-------------------------------------
+* Fix memory leak in OTP kdcpreauth module.
 
-This is a bug fix release.
+* Fix PKCS11 module path search.
 
-* Fix a linking issue with Samba.
-
-* Better support multiple pkinit_identities values by checking whether
-  certificates can be loaded for each value.
-
-krb5-1.19.1 changes by ticket ID
+krb5-1.20.1 changes by ticket ID
 --------------------------------
 
-8984    Load certs when checking pkinit_identities values
-8985    Restore krb5_set_default_tgs_ktypes()
-8987    Synchronize command-line option documentation
+9061    Fix memory leak in SPAKE kdcpreauth module
+9062    Fix net-server.c when AI_NUMERICSERV is undefined
+9063    Fix memory leak in OTP kdcpreauth module
+9064    Free verto context later in KDC cleanup
+9065    Fix uncommon PKINIT memory leak
+9067    Fix PKCS11 module path search
+9073    Fix null deref in KDC when decoding invalid NDR
+9074    Fix integer overflows in PAC parsing
 
-Major changes in 1.19 (2021-02-01)
+Major changes in 1.20 (2022-05-26)
 ----------------------------------
 
 Administrator experience:
 
-* When a client keytab is present, the GSSAPI krb5 mech will refresh
-  credentials even if the current credentials were acquired manually.
+* Added a "disable_pac" realm relation to suppress adding PAC authdata
+  to tickets, for realms which do not need to support S4U requests.
 
-* It is now harder to accidentally delete the K/M entry from a KDB.
-
-Developer experience:
+* Most credential cache types will use atomic replacement when a cache
+  is reinitialized using kinit or refreshed from the client keytab.
 
-* gss_acquire_cred_from() now supports the "password" and "verify"
-  options, allowing credentials to be acquired via password and
-  verified using a keytab key.
+* kprop can now propagate databases with a dump size larger than 4GB,
+  if both the client and server are upgraded.
 
-* When an application accepts a GSS security context, the new
-  GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
-  both provided matching channel bindings.
+* kprop can now work over NATs that change the destination IP address,
+  if the client is upgraded.
 
-* Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self
-  requests to identify the desired client principal by certificate.
+Developer experience:
 
-* PKINIT certauth modules can now cause the hw-authent flag to be set
-  in issued tickets.
+* Updated the KDB interface.  The sign_authdata() method is replaced
+  with the issue_pac() method, allowing KDB modules to add logon info
+  and other buffers to the PAC issued by the KDC.
 
-* The krb5_init_creds_step() API will now issue the same password
-  expiration warnings as krb5_get_init_creds_password().
+* Host-based initiator names are better supported in the GSS krb5
+  mechanism.
 
 Protocol evolution:
 
-* Added client and KDC support for Microsoft's Resource-Based
-  Constrained Delegation, which allows cross-realm S4U2Proxy requests.
-  A third-party database module is required for KDC support.
+* Replaced AD-SIGNEDPATH authdata with minimal PACs.
+
+* To avoid spurious replay errors, password change requests will not
+  be attempted over UDP until the attempt over TCP fails.
+
+* PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
 
-* kadmin/admin is now the preferred server principal name for kadmin
-  connections, and the host-based form is no longer created by
-  default.  The client will still try the host-based form as a
-  fallback.
+Code quality:
 
-* Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
-  extension, which causes channel bindings to be required for the
-  initiator if the acceptor provided them.  The client will send this
-  option if the client_aware_gss_bindings profile option is set.
+* Updated all code using OpenSSL to be compatible with OpenSSL 3.
 
-User experience:
+* Reorganized the libk5crypto build system to allow the OpenSSL
+  back-end to pull in material from the builtin back-end depending on
+  the OpenSSL version.
 
-* kinit will now issue a warning if the des3-cbc-sha1 encryption type
-  is used in the reply.  This encryption type will be deprecated and
-  removed in future releases.
+* Simplified the PRNG logic to always use the platform PRNG.
 
-* Added kvno flags --out-cache, --no-store, and --cached-only
-  (inspired by Heimdal's kgetcred).
+* Converted the remaining Tcl tests to Python.
 
-krb5-1.19 changes by ticket ID
+krb5-1.20 changes by ticket ID
 ------------------------------
 
-7976    Client keytab does not refresh manually obtained ccaches
-8332    Referral and cross-realm TGS requests fail with anonymous cache
-8871    Zero length fields when freeing object contents
-8879    Allow certauth modules to set hw-authent flag
-8885    PKINIT calls responder twice
-8890    Add finalization safety check to com_err
-8893    Do expiration warnings for all init_creds APIs
-8897    Pass gss_localname() through SPNEGO
-8899    Implement GSS_C_CHANNEL_BOUND_FLAG
-8900    Implement KERB_AP_OPTIONS_CBT (server side)
-8901    Stop reporting krb5 mech from IAKERB
-8902    Omit KDC indicator check for S4U2Self requests
-8904    Add KRB5_PRINCIPAL_PARSE_NO_DEF_REALM flag
-8907    Pass channel bindings through SPNEGO
-8909    Return GSS_S_NO_CRED from krb5 gss_acquire_cred
-8910    Building with --enable-static fails when Yasm is available
-8911    Default dns_canonicalize_hostname to "fallback"
-8912    Omit PA_FOR_USER if we can't compute its checksum
-8913    Deleting master key principal entry shouldn't be possible
-8914    Invalid negative record length in keytab file
-8915    Try to find <target>-ar when cross compiling
-8917    Add three kvno options from Heimdal kgetcred
-8919    Interop with Heimdal KDC for S4U2Self requests
-8920    Fix KDC choice to send encrypted S4U_X509_USER
-8921    Use the term "primary KDC" in source and docs
-8922    Trace plugin module loading errors
-8923    Add GSS_KRB5_NT_X509_CERT name type
-8927    getdate.y %type warnings with bison 3.5
-8928    Fix three configure tests for Xcode 12
-8929    Ignore bad enctypes in krb5_string_to_keysalts()
-8930    Expand dns_canonicalize_host=fallback support
-8931    Cache S4U2Proxy requests by second ticket
-8932    Do proper length decoding in SPNEGO gss_get_oid()
-8934    Try kadmin/admin first in libkadm5clnt
-8935    Don't create hostbased principals in new KDBs
-8937    Fix Leash console option
-8940    Remove Leash import functionality
-8942    Fix KRB5_GC_CACHED for S4U2Self requests
-8943    Allow KDC to canonicalize realm in TGS client
-8944    Harmonize macOS pack declarations with Heimdal
-8946    Improve KDC alias checking for S4U requests
-8947    Warn when des3-cbc-sha1 is used for initial auth
-8948    Update SRV record documentation
-8950    Document enctype migration
-8951    Allow aliases when matching U2U second ticket
-8952    Fix doc issues with newer Doxygen and Sphinx
-8953    Move more KDC checks to validate_tgs_request()
-8954    Update Gladman AES code to a version with a clearer license
-8957    Use PKG_CHECK_MODULES for system library com_err
-8961    Fix gss_acquire_cred_from() IAKERB handling
-8962    Add password option to cred store
-8963    Add verify option to cred store
-8964    Add GSS credential store documentation
-8965    Install shared libraries as executable
-8966    Improve duplicate checking in gss_add_cred()
-8967    Continue on KRB5_FCC_NOFILE in KCM cache iteration
-8969    Update kvno(1) synopsis with missing options
-8971    Implement fallback for GSS acceptor names
-8973    Revert dns_canonicalize_hostname default to true
-8975    Incorrect runstatedir substitution affecting "make install"
+7707    Credential cache API does not support atomic reinitialization
+8010    gss_store_cred should initialize ccache and work with collections
+8970    Wrong Encryption types shown in MIT Kerberos Ticket Manager on Windows
+8976    all-liblinks build target fails when symlinks not supported
+8977    Allow kprop over more types of NATs
+8978    Support host-based GSS initiator names
+8980    Add APIs for marshalling credentials
+8981    Documentation__krb5.conf
+8983    Infer name type when creating principals
+8988    Only require one valid pkinit anchor/pool value
+8990    Add KCM_OP_GET_CRED_LIST for faster iteration
+8991    Fix PKINIT memory leaks
+8994    Fix gss-krb5 handling of high sequence numbers
+8995    KCM interop issue with KRB5_TC_ flags
+8997    Use KCM_OP_RETRIEVE in KCM client
+8998    Simplify krb5_cccol_have_content()
+8999    Add additional KRB5_TRACE points
+9000    Fix multiple UPN handling in PKINIT client certs
+9002    Check for undefined kadm5 policy mask bits
+9003    Add duplicate check to kadm5_create_policy()
+9009    Update IRC pointer in resources.rst
+9010    Add MAXHOSTNAME guard in Windows public header
+9011    Fix some principal realm canonicalization cases
+9012    Allow kinit with keytab to defer canonicalization
+9013    Fix kadmin -k with fallback or referral realm
+9017    Clarify and correct interposer plugin docs
+9019    make check fails: OSError: AF_UNIX path too long
+9022    Potential integer overflows
+9024    Find gss_get_mic_iov extensions in GSS modules
+9025    Use version-independent OpenLDAP links in docs
+9027    Add OpenLDAP advice to princ_dns.rst
+9028    Constify name field in four plugin vtables
+9031    Fix verification of RODC-issued PAC KDC signature
+9032    Always use platform PRNG
+9034    Use builtin MD4, RC4 for OpenSSL 3.0
+9035    Avoid use after free during libkrad cleanup
+9036    Support larger RADIUS attributes in libkrad
+9037    Race condition in krb5_set_password()
+9038    Issue an error from KDC on S4U2Self failures
+9039    Fix PAC handling of authtimes after y2038
+9040    Use 14 instead of 9 for unkeyed SHA-1 checksum
+9041    Add PA-REDHAT-IDP-OAUTH2 padata type
+9042    Don't fail krb5_cc_select() for no default realm
+9043    Add PAC ticket signature APIs
+9044    Replace AD-SIGNEDPATH with minimal PACs
+9047    Avoid passing null for asprintf strings
+9048    Pass client flag to KDB for client preauth match
+9049    Add replace_reply_key kdcpreauth callback
+9050    Implement replaced_reply_key input to issue_pac()
+9051    Clarify certauth interface documentation
+9056    Fix iprop with fallback
+9060    Read GSS configuration files with mtime 0
 
 Acknowledgements
 ----------------
@@ -352,6 +332,7 @@
     Sumit Bose
     Emmanuel Bouillon
     Isaac Boukris
+    Ulf Bremer
     Pavel Březina
     Philip Brown
     Samuel Cabrero
@@ -384,6 +365,7 @@
     John Devitofranceschi
     Marc Dionne
     Roland Dowdeswell
+    Ken Dreyer
     Dorian Ducournau
     Viktor Dukhovni
     Jason Edgecombe
@@ -402,6 +384,7 @@
     Frank Filz
     William Fiveash
     Jacques Florent
+    Oliver Freyermuth
     Ákos Frohner
     Sebastian Galiano
     Marcus Granado
@@ -419,6 +402,7 @@
     Matthieu Hautreux
     Jochen Hein
     Paul B. Henson
+    Kihong Heo
     Jeff Hodges
     Christopher Hogan
     Love Hörnquist Åstrand
@@ -476,7 +460,9 @@
     Nathaniel McCallum
     Greg McClement
     Cameron Meadors
+    Vipul Mehta
     Alexey Melnikov
+    Ivan A. Melnikov
     Franklyn Mendez
     Mantas Mikulėnas
     Markus Moeller
@@ -484,6 +470,7 @@
     Paul Moore
     Keiichi Mori
     Michael Morony
+    Sam Morris
     Zbysek Mraz
     Edward Murrell
     Joshua Neuheisel
@@ -511,6 +498,7 @@
     Tony Reix
     Martin Rex
     Pat Riehecky
+    Julien Rische
     Jason Rogers
     Matt Rogers
     Nate Rosenblum
@@ -520,6 +508,7 @@
     Joshua Schaeffer
     Alexander Scheel
     Jens Schleusener
+    Ryan Schmidt
     Andreas Schneider
     Paul Seyfert
     Tom Shaw
@@ -537,6 +526,7 @@
     Joe Travaglini
     Sergei Trofimovich
     Greg Troxel
+    Fraser Tweedale
     Tim Uglow
     Rathor Vipin
     Denis Vlasenko
@@ -562,6 +552,7 @@
     Xu Qiang
     Neng Xue
     Zhaomo Yang
+    Tianjiao Yin
     Nickolai Zeldovich
     Bean Zhang
     Hanz van Zijst

_service:tar_scm:krb5-1.19.2.tar.gz/doc/admin/admin_commands/ktutil.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/admin/admin_commands/ktutil.rst Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/admin/conf_files/kdc_conf.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/admin/conf_files/kdc_conf.rst Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/admin/conf_files/krb5_conf.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/admin/conf_files/krb5_conf.rst Changed

@@ -546,15 +546,12 @@
 domain_realm
 ~~~~~~~~~~~~~~
 
-The domain_realm section provides a translation from a domain name
-or hostname to a Kerberos realm name.  The tag name can be a host name
-or domain name, where domain names are indicated by a prefix of a
-period (``.``).  The value of the relation is the Kerberos realm name
-for that particular host or domain.  A host name relation implicitly
-provides the corresponding domain name relation, unless an explicit domain
-name relation is provided.  The Kerberos realm may be
+The domain_realm section provides a translation from hostnames to
+Kerberos realms.  Each tag is a domain name, providing the mapping for
+that domain and all subdomains.  If the tag begins with a period
+(``.``) then it applies only to subdomains.  The Kerberos realm may be
 identified either in the realms_ section or using DNS SRV records.
-Host names and domain names should be in lower case.  For example::
+Tag names should be in lower case.  For example::
 
     domain_realm
         crash.mit.edu = TEST.ATHENA.MIT.EDU

_service:tar_scm:krb5-1.19.2.tar.gz/doc/admin/conf_ldap.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/admin/conf_ldap.rst Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/admin/princ_dns.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/admin/princ_dns.rst Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/appdev/gssapi.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/appdev/gssapi.rst Changed

@@ -252,10 +252,8 @@
 
 * **ccache**: For acquiring initiator credentials, the name of the
   :ref:`credential cache <ccache_definition>` to which the handle will
-  refer.  For storing credentials, the name of the cache where the
-  credentials should be stored.  If a collection name is given, the
-  primary cache of the collection will be used; this behavior may
-  change in future releases to select a cache from the collection.
+  refer.  For storing credentials, the name of the cache or collection
+  where the credentials will be stored (see below).
 
 * **client_keytab**: For acquiring initiator credentials, the name of
   the :ref:`keytab <keytab_definition>` which will be used, if
@@ -285,6 +283,15 @@
   the empty string.  If the empty string is given, any ``host``
   service principal in the keytab may be used.  (New in release 1.19.)
 
+In release 1.20 or later, if a collection name is specified for
+**cache** in a call to gss_store_cred_into(), an existing cache for
+the client principal within the collection will be selected, or a new
+cache will be created within the collection.  If *overwrite_cred* is
+false and the selected credential cache already exists, a
+**GSS_S_DUPLICATE_ELEMENT** error will be returned.  If *default_cred*
+is true, the primary cache of the collection will be switched to the
+selected cache.
+
 
 Importing and exporting credentials
 -----------------------------------

_service:tar_scm:krb5-1.19.2.tar.gz/doc/appdev/refs/api/index.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/appdev/refs/api/index.rst Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/appdev/refs/macros/index.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/appdev/refs/macros/index.rst Changed

@@ -43,6 +43,7 @@
    CKSUMTYPE_RSA_MD4_DES.rst
    CKSUMTYPE_RSA_MD5.rst
    CKSUMTYPE_RSA_MD5_DES.rst
+   CKSUMTYPE_SHA1.rst
    ENCTYPE_AES128_CTS_HMAC_SHA1_96.rst
    ENCTYPE_AES128_CTS_HMAC_SHA256_128.rst
    ENCTYPE_AES256_CTS_HMAC_SHA1_96.rst
@@ -234,12 +235,18 @@
    KRB5_NT_UNKNOWN.rst
    KRB5_NT_WELLKNOWN.rst
    KRB5_NT_X500_PRINCIPAL.rst
+   KRB5_PAC_ATTRIBUTES_INFO.rst
    KRB5_PAC_CLIENT_INFO.rst
+   KRB5_PAC_CLIENT_CLAIMS.rst
    KRB5_PAC_CREDENTIALS_INFO.rst
    KRB5_PAC_DELEGATION_INFO.rst
+   KRB5_PAC_DEVICE_CLAIMS.rst
+   KRB5_PAC_DEVICE_INFO.rst
    KRB5_PAC_LOGON_INFO.rst
    KRB5_PAC_PRIVSVR_CHECKSUM.rst
+   KRB5_PAC_REQUESTOR.rst
    KRB5_PAC_SERVER_CHECKSUM.rst
+   KRB5_PAC_TICKET_CHECKSUM.rst
    KRB5_PAC_UPN_DNS_INFO.rst
    KRB5_PADATA_AFS3_SALT.rst
    KRB5_PADATA_AP_REQ.rst
@@ -278,6 +285,7 @@
    KRB5_PADATA_SAM_RESPONSE_2.rst
    KRB5_PADATA_SESAME.rst
    KRB5_PADATA_SPAKE.rst
+   KRB5_PADATA_REDHAT_IDP_OAUTH2.rst
    KRB5_PADATA_SVR_REFERRAL_INFO.rst
    KRB5_PADATA_TGS_REQ.rst
    KRB5_PADATA_USE_SPECIFIED_KVNO.rst

_service:tar_scm:krb5-1.19.2.tar.gz/doc/build/doing_build.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/build/doing_build.rst Changed

@@ -99,24 +99,14 @@
 
     make check
 
-However, there are several prerequisites that must be satisfied first:
-
-* Configure and build Kerberos with Tcl support. Tcl is used to drive
-  the test suite.  This often means passing **-**\ **-with-tcl** to
-  configure to tell it the location of the Tcl configuration
-  script. (See :ref:`options2configure`.)
-* In addition to Tcl, DejaGnu must be available on the system for some
-  of the tests to run.  The test suite will still run the other tests
-  if DejaGnu is not present, but the test coverage will be reduced
-  accordingly.
-* On some operating systems, you have to run ``make install`` before
-  running ``make check``, or the test suite will pick up installed
-  versions of Kerberos libraries rather than the newly built ones.
-  You can install into a prefix that isn't in the system library
-  search path, though. Alternatively, you can configure with
-  **-**\ **-disable-rpath**, which renders the build tree less suitable for
-  installation, but allows testing without interference from
-  previously installed libraries.
+On some operating systems, you have to run ``make install`` before
+running ``make check``, or the test suite will pick up installed
+versions of Kerberos libraries rather than the newly built ones.  You
+can install into a prefix that isn't in the system library search
+path, though.  Alternatively, you can configure with
+**-**\ **-disable-rpath**, which renders the build tree less suitable
+for installation, but allows testing without interference from
+previously installed libraries.
 
 There are additional regression tests available, which are not run
 by ``make check``.  These tests require manual setup and teardown of

_service:tar_scm:krb5-1.19.2.tar.gz/doc/build/options2configure.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/build/options2configure.rst Changed

@@ -39,12 +39,6 @@
     library or fails to pass the tests in ``src/tests/resolv``, you
     will need to use this option.
 
-**-**\ **-with-tcl=**\ *TCLPATH*
-    Some of the unit-tests in the build tree rely upon using a program
-    in Tcl.  The directory specified by *TCLPATH* specifies where the
-    Tcl header file (TCLPATH/include/tcl.h) as well as where the Tcl
-    library (TCLPATH/lib) should be found.
-
 **-**\ **-enable-dns-for-realm**
     Enable the use of DNS to look up a host's Kerberos realm,
     if the information is not provided in
@@ -332,11 +326,6 @@
 **-**\ **-with-lmdb**
     Compile LMDB database backend module.
 
-**-**\ **-with-tcl=**\ *path*
-    Specifies that *path* is the location of a Tcl installation.
-    Tcl is needed for some of the tests run by 'make check'; such tests
-    will be skipped if this option is not set.
-
 **-**\ **-with-vague-errors**
     Do not send helpful errors to client.  For example, if the KDC
     should return only vague error codes to clients.
@@ -348,11 +337,6 @@
     implemented crypto backend is ``openssl``.  (See
     :ref:`mitK5features`)
 
-**-**\ **-with-prng-alg=**\ *ALG*
-    Use specified PRNG algorithm.  For example, to use the OS native
-    prng specify ``--with-prng-alg=os``.  The default is ``fortuna``.
-    (See :ref:`mitK5features`)
-
 **-**\ **-without-libedit**
     Do not compile and link against libedit.  Some utilities will no
     longer offer command history or completion in interactive mode if
@@ -360,8 +344,6 @@
 
 **-**\ **-with-readline**
     Compile and link against GNU readline, as an alternative to libedit.
-    Building with readline breaks the dejagnu test suite, which is a
-    subset of the tests run by 'make check'.
 
 **-**\ **-with-system-verto**
     Use an installed version of libverto.  If the libverto header and

_service:tar_scm:krb5-1.19.2.tar.gz/doc/conf.py -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/conf.py Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/copyright.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/copyright.rst Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/.buildinfo -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/.buildinfo Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/admin/admin_commands/ktutil.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/admin/admin_commands/ktutil.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/admin/conf_files/kdc_conf.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/admin/conf_files/kdc_conf.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/admin/conf_files/krb5_conf.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/admin/conf_files/krb5_conf.rst.txt Changed

@@ -546,15 +546,12 @@
 domain_realm
 ~~~~~~~~~~~~~~
 
-The domain_realm section provides a translation from a domain name
-or hostname to a Kerberos realm name.  The tag name can be a host name
-or domain name, where domain names are indicated by a prefix of a
-period (``.``).  The value of the relation is the Kerberos realm name
-for that particular host or domain.  A host name relation implicitly
-provides the corresponding domain name relation, unless an explicit domain
-name relation is provided.  The Kerberos realm may be
+The domain_realm section provides a translation from hostnames to
+Kerberos realms.  Each tag is a domain name, providing the mapping for
+that domain and all subdomains.  If the tag begins with a period
+(``.``) then it applies only to subdomains.  The Kerberos realm may be
 identified either in the realms_ section or using DNS SRV records.
-Host names and domain names should be in lower case.  For example::
+Tag names should be in lower case.  For example::
 
     domain_realm
         crash.mit.edu = TEST.ATHENA.MIT.EDU

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/admin/conf_ldap.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/admin/conf_ldap.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/admin/princ_dns.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/admin/princ_dns.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/gssapi.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/gssapi.rst.txt Changed

@@ -252,10 +252,8 @@
 
 * **ccache**: For acquiring initiator credentials, the name of the
   :ref:`credential cache <ccache_definition>` to which the handle will
-  refer.  For storing credentials, the name of the cache where the
-  credentials should be stored.  If a collection name is given, the
-  primary cache of the collection will be used; this behavior may
-  change in future releases to select a cache from the collection.
+  refer.  For storing credentials, the name of the cache or collection
+  where the credentials will be stored (see below).
 
 * **client_keytab**: For acquiring initiator credentials, the name of
   the :ref:`keytab <keytab_definition>` which will be used, if
@@ -285,6 +283,15 @@
   the empty string.  If the empty string is given, any ``host``
   service principal in the keytab may be used.  (New in release 1.19.)
 
+In release 1.20 or later, if a collection name is specified for
+**cache** in a call to gss_store_cred_into(), an existing cache for
+the client principal within the collection will be selected, or a new
+cache will be created within the collection.  If *overwrite_cred* is
+false and the selected credential cache already exists, a
+**GSS_S_DUPLICATE_ELEMENT** error will be returned.  If *default_cred*
+is true, the primary cache of the collection will be switched to the
+selected cache.
+
 
 Importing and exporting credentials
 -----------------------------------

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/index.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/index.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_address_order.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_address_order.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_build_principal.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_build_principal.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_build_principal_ext.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_build_principal_ext.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_c_random_add_entropy.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_c_random_add_entropy.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_c_random_os_entropy.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_c_random_os_entropy.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_c_random_seed.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_c_random_seed.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_cccol_have_content.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_cccol_have_content.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize.rst.txt Changed

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_kdc_sign_ticket.rst.txt Added

@@ -0,0 +1,65 @@
+krb5_kdc_sign_ticket -  Sign a PAC, possibly including a ticket signature. 
+===========================================================================
+
+..
+
+.. c:function:: krb5_error_code krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part * enc_tkt, const krb5_pac pac, krb5_const_principal server_princ, krb5_const_principal client_princ, const krb5_keyblock * server, const krb5_keyblock * privsvr, krb5_boolean with_realm)
+
+..
+
+
+:param:
+
+	          **in** **context** - Library context
+
+	          **in** **enc_tkt** - The ticket for the signature
+
+	          **in** **pac** - PAC handle
+
+	          **in** **server_princ** - Canonical ticket server name
+
+	          **in** **client_princ** - PAC_CLIENT_INFO principal (or NULL)
+
+	          **in** **server** - Key for server checksum
+
+	          **in** **privsvr** - Key for KDC and ticket checksum
+
+	          **in** **with_realm** - If true, include the realm of *principal*
+
+
+..
+
+
+:retval:
+         -   0   on success, otherwise - Kerberos error codes
+
+
+..
+
+
+
+
+
+
+
+Sign *pac* using the keys *server* and *privsvr* . Include a ticket signature over *enc_tkt* if *server_princ* is not a TGS or kadmin/changepw principal name. Add the signed PAC's encoding to the authorization data of *enc_tkt* in the first slot, wrapped in an AD-IF-RELEVANT container. If *client_princ* is non-null, add a PAC_CLIENT_INFO buffer, including the realm if *with_realm* is true.
+
+
+
+
+
+
+
+
+
+
+..
+
+
+
+
+.. note::
+
+	 New in 1.20
+ 
+

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_kdc_verify_ticket.rst.txt Added

@@ -0,0 +1,73 @@
+krb5_kdc_verify_ticket -  Verify a PAC, possibly including ticket signature. 
+=============================================================================
+
+..
+
+.. c:function:: krb5_error_code krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part * enc_tkt, krb5_const_principal server_princ, const krb5_keyblock * server, const krb5_keyblock * privsvr, krb5_pac * pac_out)
+
+..
+
+
+:param:
+
+	          **in** **context** - Library context
+
+	          **in** **enc_tkt** - Ticket enc-part, possibly containing a PAC
+
+	          **in** **server_princ** - Canonicalized name of ticket server
+
+	          **in** **server** - Key to validate server checksum (or NULL)
+
+	          **in** **privsvr** - Key to validate KDC checksum (or NULL)
+
+	          **out** **pac_out** - Verified PAC (NULL if no PAC included)
+
+
+..
+
+
+:retval:
+         -   0   Success; otherwise - Kerberos error codes
+
+
+..
+
+
+
+
+
+
+
+If a PAC is present in *enc_tkt* , verify its signatures. If *privsvr* is not NULL and *server_princ* is not a krbtgt or kadmin/changepw service, require a ticket signature over *enc_tkt* in addition to the KDC signature. Place the verified PAC in *pac_out* . If an invalid PAC signature is found, return an error matching the Windows KDC protocol code for that condition as closely as possible.
+
+
+
+If no PAC is present in *enc_tkt* , set *pac_out* to NULL and return successfully.
+
+
+
+
+
+
+
+
+
+
+..
+
+
+
+
+
+
+.. note::
+
+	 This function does not validate the PAC_CLIENT_INFO buffer. If a specific value is expected, the caller can make a separate call to :c:func:`krb5_pac_verify_ext()` with a principal but no keys.
+ 
+
+
+.. note::
+
+	 New in 1.20
+ 
+

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_marshal_credentials.rst.txt Added

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_pac_get_client_info.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_pac_get_client_info.rst.txt Changed

@@ -1,5 +1,5 @@
-krb5_pac_get_client_info
-========================
+krb5_pac_get_client_info -  Read client information from a PAC. 
+================================================================
 
 ..
 
@@ -10,18 +10,21 @@
 
 :param:
 
-	          **context**
+	          **in** **context** - Library context
 
-	          **pac**
+	          **in** **pac** - PAC handle
 
-	          **authtime_out**
+	          **out** **authtime_out** - Authentication timestamp (NULL if not needed)
 
-	          **princname_out**
+	          **out** **princname_out** - Client account name
 
 
 ..
 
 
+:retval:
+         -   0   on success, ENOENT if no PAC_CLIENT_INFO buffer is present in pac , ERANGE if the buffer contains invalid lengths.
+
 
 ..
 
@@ -31,6 +34,13 @@
 
 
 
+Read the PAC_CLIENT_INFO buffer in *pac* . Place the client account name as a string in *princname_out* . If *authtime_out* is not NULL, place the initial authentication timestamp in *authtime_out* .
+
+
+
+
+
+
 
 
 
@@ -40,4 +50,8 @@
 
 
 
+.. note::
+
+	 New in 1.18
+

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_pac_sign.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_pac_sign.rst.txt Changed

@@ -1,5 +1,5 @@
-krb5_pac_sign -  Sign a PAC. 
-=============================
+krb5_pac_sign
+=============
 
 ..
 
@@ -10,19 +10,19 @@
 
 :param:
 
-	          **in** **context** - Library context
+	          **context**
 
-	          **in** **pac** - PAC handle
+	          **pac**
 
-	          **in** **authtime** - Expected timestamp
+	          **authtime**
 
-	          **in** **principal** - Expected principal name (or NULL)
+	          **principal**
 
-	          **in** **server_key** - Key for server checksum
+	          **server_key**
 
-	          **in** **privsvr_key** - Key for KDC checksum
+	          **privsvr_key**
 
-	          **out** **data** - Signed PAC encoding
+	          **data**
 
 
 ..
@@ -32,14 +32,12 @@
 ..
 
 
+DEPRECATED Use krb5_kdc_sign_ticket() instead. 
 
 
 
 
 
-This function signs *pac* using the keys *server_key* and *privsvr_key* and returns the signed encoding in *data* . *pac* is modified to include the server and KDC checksum buffers. Use :c:func:`krb5_free_data_contents()` to free *data* when it is no longer needed.
-
-
 
 
 
@@ -53,8 +51,4 @@
 
 
 
-.. note::
-
-	 New in 1.10
-

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_pac_sign_ext.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_pac_sign_ext.rst.txt Changed

@@ -1,5 +1,5 @@
-krb5_pac_sign_ext -  Sign a PAC, possibly with a specified realm. 
-==================================================================
+krb5_pac_sign_ext
+=================
 
 ..
 
@@ -10,21 +10,21 @@
 
 :param:
 
-	          **in** **context** - Library context
+	          **context**
 
-	          **in** **pac** - PAC handle
+	          **pac**
 
-	          **in** **authtime** - Expected timestamp
+	          **authtime**
 
-	          **in** **principal** - Principal name (or NULL)
+	          **principal**
 
-	          **in** **server_key** - Key for server checksum
+	          **server_key**
 
-	          **in** **privsvr_key** - Key for KDC checksum
+	          **privsvr_key**
 
-	          **in** **with_realm** - If true, include the realm of *principal*
+	          **with_realm**
 
-	          **out** **data** - Signed PAC encoding
+	          **data**
 
 
 ..
@@ -34,14 +34,12 @@
 ..
 
 
+DEPRECATED Use krb5_kdc_sign_ticket() instead. 
 
 
 
 
 
-This function is similar to :c:func:`krb5_pac_sign()` , but adds a parameter *with_realm* . If *with_realm* is true, the PAC_CLIENT_INFO field of the signed PAC will include the realm of *principal* as well as the name. This flag is necessary to generate PACs for cross-realm S4U2Self referrals.
-
-
 
 
 
@@ -55,8 +53,4 @@
 
 
 
-.. note::
-
-	 New in 1.17
-

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/api/krb5_parse_name.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_parse_name.rst.txt Changed

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/api/krb5_unmarshal_credentials.rst.txt Added

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/CKSUMTYPE_SHA1.rst.txt Added

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET.rst.txt Changed

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO.rst.txt Added

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS.rst.txt Added

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS.rst.txt Added

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_PAC_DEVICE_INFO.rst.txt Added

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_PAC_REQUESTOR.rst.txt Added

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM.rst.txt Added

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2.rst.txt Added

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT.rst.txt Changed

@@ -11,23 +11,23 @@
 
 PKINIT responder question.
 
-The PKINIT responder question is asked when the client needs a password that's being used to protect key information, and is formatted as a JSON object. A specific identity's flags value, if not zero, is the bitwise-OR of one or more of the KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_* flags defined below, and possibly other flags to be added later. Any resemblance to similarly-named CKF_* values in the PKCS#11 API should not be depended on. 
+The PKINIT responder question is asked when the client needs a password that's being used to protect key information, and is formatted as a JSON object. A specific identity's flags value, if not zero, is the bitwise-OR of one or more of the KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_* flags defined below, and possibly other flags to be added later. Any resemblance to similarly-named CKF_* values in the PKCS#11 API should not be depended on.
 ::
 
-     {
+    {
         identity <string> : flags <number>,
         ...
     }
- 
 
-The answer to the question MUST be JSON formatted: 
+
+The answer to the question MUST be JSON formatted:
 ::
 
-     {
+    {
         identity <string> : password <string>,
         ...
     }
- 
+

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/macros/index.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/macros/index.rst.txt Changed

@@ -43,6 +43,7 @@
    CKSUMTYPE_RSA_MD4_DES.rst
    CKSUMTYPE_RSA_MD5.rst
    CKSUMTYPE_RSA_MD5_DES.rst
+   CKSUMTYPE_SHA1.rst
    ENCTYPE_AES128_CTS_HMAC_SHA1_96.rst
    ENCTYPE_AES128_CTS_HMAC_SHA256_128.rst
    ENCTYPE_AES256_CTS_HMAC_SHA1_96.rst
@@ -234,12 +235,18 @@
    KRB5_NT_UNKNOWN.rst
    KRB5_NT_WELLKNOWN.rst
    KRB5_NT_X500_PRINCIPAL.rst
+   KRB5_PAC_ATTRIBUTES_INFO.rst
    KRB5_PAC_CLIENT_INFO.rst
+   KRB5_PAC_CLIENT_CLAIMS.rst
    KRB5_PAC_CREDENTIALS_INFO.rst
    KRB5_PAC_DELEGATION_INFO.rst
+   KRB5_PAC_DEVICE_CLAIMS.rst
+   KRB5_PAC_DEVICE_INFO.rst
    KRB5_PAC_LOGON_INFO.rst
    KRB5_PAC_PRIVSVR_CHECKSUM.rst
+   KRB5_PAC_REQUESTOR.rst
    KRB5_PAC_SERVER_CHECKSUM.rst
+   KRB5_PAC_TICKET_CHECKSUM.rst
    KRB5_PAC_UPN_DNS_INFO.rst
    KRB5_PADATA_AFS3_SALT.rst
    KRB5_PADATA_AP_REQ.rst
@@ -278,6 +285,7 @@
    KRB5_PADATA_SAM_RESPONSE_2.rst
    KRB5_PADATA_SESAME.rst
    KRB5_PADATA_SPAKE.rst
+   KRB5_PADATA_REDHAT_IDP_OAUTH2.rst
    KRB5_PADATA_SVR_REFERRAL_INFO.rst
    KRB5_PADATA_TGS_REQ.rst
    KRB5_PADATA_USE_SPECIFIED_KVNO.rst

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/appdev/refs/types/krb5_pre_send_fn.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/appdev/refs/types/krb5_pre_send_fn.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/build/doing_build.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/build/doing_build.rst.txt Changed

@@ -99,24 +99,14 @@
 
     make check
 
-However, there are several prerequisites that must be satisfied first:
-
-* Configure and build Kerberos with Tcl support. Tcl is used to drive
-  the test suite.  This often means passing **-**\ **-with-tcl** to
-  configure to tell it the location of the Tcl configuration
-  script. (See :ref:`options2configure`.)
-* In addition to Tcl, DejaGnu must be available on the system for some
-  of the tests to run.  The test suite will still run the other tests
-  if DejaGnu is not present, but the test coverage will be reduced
-  accordingly.
-* On some operating systems, you have to run ``make install`` before
-  running ``make check``, or the test suite will pick up installed
-  versions of Kerberos libraries rather than the newly built ones.
-  You can install into a prefix that isn't in the system library
-  search path, though. Alternatively, you can configure with
-  **-**\ **-disable-rpath**, which renders the build tree less suitable for
-  installation, but allows testing without interference from
-  previously installed libraries.
+On some operating systems, you have to run ``make install`` before
+running ``make check``, or the test suite will pick up installed
+versions of Kerberos libraries rather than the newly built ones.  You
+can install into a prefix that isn't in the system library search
+path, though.  Alternatively, you can configure with
+**-**\ **-disable-rpath**, which renders the build tree less suitable
+for installation, but allows testing without interference from
+previously installed libraries.
 
 There are additional regression tests available, which are not run
 by ``make check``.  These tests require manual setup and teardown of

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/build/options2configure.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/build/options2configure.rst.txt Changed

@@ -39,12 +39,6 @@
     library or fails to pass the tests in ``src/tests/resolv``, you
     will need to use this option.
 
-**-**\ **-with-tcl=**\ *TCLPATH*
-    Some of the unit-tests in the build tree rely upon using a program
-    in Tcl.  The directory specified by *TCLPATH* specifies where the
-    Tcl header file (TCLPATH/include/tcl.h) as well as where the Tcl
-    library (TCLPATH/lib) should be found.
-
 **-**\ **-enable-dns-for-realm**
     Enable the use of DNS to look up a host's Kerberos realm,
     if the information is not provided in
@@ -332,11 +326,6 @@
 **-**\ **-with-lmdb**
     Compile LMDB database backend module.
 
-**-**\ **-with-tcl=**\ *path*
-    Specifies that *path* is the location of a Tcl installation.
-    Tcl is needed for some of the tests run by 'make check'; such tests
-    will be skipped if this option is not set.
-
 **-**\ **-with-vague-errors**
     Do not send helpful errors to client.  For example, if the KDC
     should return only vague error codes to clients.
@@ -348,11 +337,6 @@
     implemented crypto backend is ``openssl``.  (See
     :ref:`mitK5features`)
 
-**-**\ **-with-prng-alg=**\ *ALG*
-    Use specified PRNG algorithm.  For example, to use the OS native
-    prng specify ``--with-prng-alg=os``.  The default is ``fortuna``.
-    (See :ref:`mitK5features`)
-
 **-**\ **-without-libedit**
     Do not compile and link against libedit.  Some utilities will no
     longer offer command history or completion in interactive mode if
@@ -360,8 +344,6 @@
 
 **-**\ **-with-readline**
     Compile and link against GNU readline, as an alternative to libedit.
-    Building with readline breaks the dejagnu test suite, which is a
-    subset of the tests run by 'make check'.
 
 **-**\ **-with-system-verto**
     Use an installed version of libverto.  If the libverto header and

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/copyright.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/copyright.rst.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/mitK5features.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/mitK5features.rst.txt Changed

@@ -19,8 +19,8 @@
 License - :ref:`mitK5license`
 
 Releases:
-    - Latest stable: https://web.mit.edu/kerberos/krb5-1.18/
-    - Supported: https://web.mit.edu/kerberos/krb5-1.17/
+    - Latest stable: https://web.mit.edu/kerberos/krb5-1.20/
+    - Supported: https://web.mit.edu/kerberos/krb5-1.19/
     - Release cycle: approximately 12 months
 
 Supported platforms \/ OS distributions:
@@ -594,6 +594,55 @@
   - Added kvno flags --out-cache, --no-store, and --cached-only
     (inspired by Heimdal's kgetcred).
 
+Release 1.20
+
+* Administrator experience:
+
+  - Added a "disable_pac" realm relation to suppress adding PAC
+    authdata to tickets, for realms which do not need to support S4U
+    requests.
+
+  - Most credential cache types will use atomic replacement when a
+    cache is reinitialized using kinit or refreshed from the client
+    keytab.
+
+  - kprop can now propagate databases with a dump size larger than
+    4GB, if both the client and server are upgraded.
+
+  - kprop can now work over NATs that change the destination IP
+    address, if the client is upgraded.
+
+* Developer experience:
+
+  - Updated the KDB interface.  The sign_authdata() method is replaced
+    with the issue_pac() method, allowing KDB modules to add logon
+    info and other buffers to the PAC issued by the KDC.
+
+  - Host-based initiator names are better supported in the GSS krb5
+    mechanism.
+
+* Protocol evolution:
+
+  - Replaced AD-SIGNEDPATH authdata with minimal PACs.
+
+  - To avoid spurious replay errors, password change requests will not
+    be attempted over UDP until the attempt over TCP fails.
+
+  - PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
+
+* Code quality:
+
+  - Updated all code using OpenSSL to be compatible with OpenSSL 3.
+
+  - Reorganized the libk5crypto build system to allow the OpenSSL
+    back-end to pull in material from the builtin back-end depending
+    on the OpenSSL version.
+
+  - Simplified the PRNG logic to always use the platform PRNG.
+
+  - Converted the remaining Tcl tests to Python.
+
+
 `Pre-authentication mechanisms`
 
 - PW-SALT                                         :rfc:`4120#section-5.2.7.3`
@@ -606,10 +655,3 @@
 - S4U-X509-USER                (release 1.8)      https://msdn.microsoft.com/en-us/library/cc246091
 - OTP                          (release 1.12)     :ref:`otp_preauth`
 - SPAKE                        (release 1.17)     :ref:`spake`
-
-`PRNG`
-
-- modularity       (release 1.9)
-- Yarrow PRNG      (release < 1.10)
-- Fortuna PRNG     (release 1.9)       https://www.schneier.com/book-practical.html
-- OS PRNG          (release 1.10)      OS's native PRNG

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/plugindev/certauth.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/plugindev/certauth.rst.txt Changed

@@ -13,13 +13,19 @@
 whether a client's certificate is authorized to authenticate a client
 principal.  **authorize** receives the DER-encoded certificate, the
 requested client principal, and a pointer to the client's
-krb5_db_entry (for modules that link against libkdb5).  It returns the
+krb5_db_entry (for modules that link against libkdb5).  The method
+must decode the certificate and inspect its attributes to determine if
+it should authorize PKINIT authentication.  It returns the
 authorization status and optionally outputs a list of authentication
-indicator strings to be added to the ticket.  Beginning in release
-1.19, the authorize method can request that the hardware
-authentication bit be set in the ticket by returning
-**KRB5_CERTAUTH_HWAUTH**.  A module must use its own internal or
-library-provided ASN.1 certificate decoder.
+indicator strings to be added to the ticket.
+
+Beginning in release 1.19, the authorize method can request that the
+hardware authentication bit be set in the ticket by returning
+**KRB5_CERTAUTH_HWAUTH**.  Beginning in release 1.20, the authorize
+method can return **KRB5_CERTAUTH_HWAUTH_PASS** to request that the
+hardware authentication bit be set in the ticket but otherwise defer
+authorization to another certauth module.  A module must use its own
+internal or library-provided ASN.1 certificate decoder.
 
 A module can optionally create and destroy module data with the
 **init** and **fini** methods.  Module data objects last for the

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/_sources/plugindev/gssapi.rst.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/_sources/plugindev/gssapi.rst.txt Changed

@@ -75,13 +75,18 @@
 gss_add_oid_set_member functions.
 
 An interposer module must use the prefix ``gssi_`` for the GSSAPI
-functions it exports, instead of the prefix ``gss_``.
+functions it exports, instead of the prefix ``gss_``.  In most cases,
+unexported ``gssi_`` functions will result in failure from their
+corresponding ``gss_`` calls.
 
 An interposer module can link against the GSSAPI library in order to
 make calls to the original mechanism.  To do so, it must specify a
 special mechanism OID which is the concatention of the interposer's
 own OID byte string and the original mechanism's OID byte string.
 
+Functions that do not accept a mechanism argument directly require no
+special handling, with the following exceptions:
+
 Since **gss_accept_sec_context** does not accept a mechanism argument,
 an interposer mechanism must, in order to invoke the original
 mechanism's function, acquire a credential for the concatenated OID
@@ -107,19 +112,23 @@
 
 To re-enter the original mechanism when importing tokens for the above
 functions, the interposer module must wrap the mechanism token in the
-mechglue's format, using the concatenated OID.  The mechglue token
-formats are:
+mechglue's format, using the concatenated OID (except in
+**gss_import_name**).  The mechglue token formats are:
 
 * For **gss_import_sec_context**, a four-byte OID length in big-endian
-  order, followed by the mechanism OID, followed by the mechanism
+  order, followed by the concatenated OID, followed by the mechanism
   token.
 
 * For **gss_import_name**, the bytes 04 01, followed by a two-byte OID
   length in big-endian order, followed by the mechanism OID, followed
-  by the bytes 06, followed by the OID length as a single byte,
-  followed by the mechanism OID, followed by the mechanism token.
+  by a four-byte token length in big-endian order, followed by the
+  mechanism token.  Unlike most uses of OIDs in the API, the mechanism
+  OID encoding must include the DER tag and length for an object
+  identifier (06 followed by the DER length of the OID byte string),
+  and this prefix must be included in the two-byte OID length.
+  input_name_type must also be set to GSS_C_NT_EXPORT_NAME.
 
 * For **gss_import_cred**, a four-byte OID length in big-endian order,
-  followed by the mechanism OID, followed by a four-byte token length
-  in big-endian order, followed by the mechanism token.  This sequence
-  may be repeated multiple times.
+  followed by the concatenated OID, followed by a four-byte token
+  length in big-endian order, followed by the mechanism token.  This
+  sequence may be repeated multiple times.

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/about.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/about.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/k5srvutil.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/k5srvutil.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/kadmin_local.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/kadmin_local.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/kadmind.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/kadmind.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/kdb5_ldap_util.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/kdb5_ldap_util.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/kdb5_util.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/kdb5_util.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/kprop.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/kprop.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/kpropd.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/kpropd.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/kproplog.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/kproplog.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/krb5kdc.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/krb5kdc.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/ktutil.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/ktutil.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -149,7 +149,7 @@
 <span class="n">ktutil</span><span class="p">:</span>  <span class="n">add_entry</span> <span class="o">-</span><span class="n">password</span> <span class="o">-</span><span class="n">p</span> <span class="n">alice</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span> <span class="o">-</span><span class="n">k</span> <span class="mi">1</span> <span class="o">-</span><span class="n">e</span>
     <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span>
 <span class="n">Password</span> <span class="k">for</span> <span class="n">alice</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span><span class="p">:</span>
-<span class="n">ktutil</span><span class="p">:</span>  <span class="n">write_kt</span> <span class="n">keytab</span>
+<span class="n">ktutil</span><span class="p">:</span>  <span class="n">write_kt</span> <span class="n">alice</span><span class="o">.</span><span class="n">keytab</span>
 <span class="n">ktutil</span><span class="p">:</span>
 </pre></div>
 </div>
@@ -266,8 +266,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/admin_commands/sserver.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/admin_commands/sserver.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/advanced/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/advanced/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/advanced/retiring-des.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/advanced/retiring-des.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/appl_servers.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/appl_servers.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/auth_indicator.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/auth_indicator.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/backup_host.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/backup_host.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/conf_files/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/conf_files/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/conf_files/kadm5_acl.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/conf_files/kadm5_acl.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/conf_files/kdc_conf.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/conf_files/kdc_conf.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -248,6 +248,11 @@
 per line, with no additional whitespace.  If none is specified or
 if there is no policy assigned to the principal, no dictionary
 checks of passwords will be performed.</dd>
+<dt><strong>disable_pac</strong></dt>
+<dd>(Boolean value.)  If true, the KDC will not issue PACs for this
+realm, and S4U2Self and S4U2Proxy operations will be disabled.
+The default is false, which will permit the KDC to issue PACs.
+New in release 1.20.</dd>
 <dt><strong>encrypted_challenge_indicator</strong></dt>
 <dd>(String.)  Specifies the authentication indicator value that the KDC
 asserts into tickets obtained using FAST encrypted challenge
@@ -1056,8 +1061,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/conf_files/krb5_conf.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/conf_files/krb5_conf.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -563,15 +563,12 @@
 </div>
 <div class="section" id="domain-realm">
 <span id="id3"></span><h3>domain_realm<a class="headerlink" href="#domain-realm" title="Permalink to this headline">¶</a></h3>
-<p>The domain_realm section provides a translation from a domain name
-or hostname to a Kerberos realm name.  The tag name can be a host name
-or domain name, where domain names are indicated by a prefix of a
-period (<code class="docutils literal"><span class="pre">.</span></code>).  The value of the relation is the Kerberos realm name
-for that particular host or domain.  A host name relation implicitly
-provides the corresponding domain name relation, unless an explicit domain
-name relation is provided.  The Kerberos realm may be
+<p>The domain_realm section provides a translation from hostnames to
+Kerberos realms.  Each tag is a domain name, providing the mapping for
+that domain and all subdomains.  If the tag begins with a period
+(<code class="docutils literal"><span class="pre">.</span></code>) then it applies only to subdomains.  The Kerberos realm may be
 identified either in the <a class="reference internal" href="#realms">realms</a> section or using DNS SRV records.
-Host names and domain names should be in lower case.  For example:</p>
+Tag names should be in lower case.  For example:</p>
 <div class="highlight-default"><div class="highlight"><pre><span></span><span class="p"></span><span class="n">domain_realm</span><span class="p"></span>
     <span class="n">crash</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="o">=</span> <span class="n">TEST</span><span class="o">.</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>
     <span class="o">.</span><span class="n">dev</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="o">=</span> <span class="n">TEST</span><span class="o">.</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>
@@ -1328,8 +1325,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/conf_ldap.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/conf_ldap.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -67,7 +67,7 @@
 <div><ol class="arabic">
 <li><p class="first">Make sure the LDAP server is using local authentication
 (<code class="docutils literal"><span class="pre">ldapi://</span></code>) or TLS (<code class="docutils literal"><span class="pre">ldaps</span></code>).  See
-<a class="reference external" href="https://www.openldap.org/doc/admin24/tls.html">https://www.openldap.org/doc/admin24/tls.html</a> for instructions on
+<a class="reference external" href="https://www.openldap.org/doc/admin/tls.html">https://www.openldap.org/doc/admin/tls.html</a> for instructions on
 configuring TLS support in OpenLDAP.</p>
 </li>
 <li><p class="first">Add the Kerberos schema file to the LDAP Server using the OpenLDAP
@@ -168,7 +168,7 @@
 </li>
 <li><p class="first">Add an <code class="docutils literal"><span class="pre">eq</span></code> index for <code class="docutils literal"><span class="pre">krbPrincipalName</span></code> to speed up principal
 lookup operations.  See
-<a class="reference external" href="https://www.openldap.org/doc/admin24/tuning.html#Indexes">https://www.openldap.org/doc/admin24/tuning.html#Indexes</a> for
+<a class="reference external" href="https://www.openldap.org/doc/admin/tuning.html#Indexes">https://www.openldap.org/doc/admin/tuning.html#Indexes</a> for
 details.</p>
 </li>
 </ol>
@@ -261,8 +261,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/database.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/database.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/dbtypes.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/dbtypes.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/dictionary.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/dictionary.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/enctypes.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/enctypes.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/env_variables.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/env_variables.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/host_config.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/host_config.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/https.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/https.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/install.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/install.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/install_appl_srv.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/install_appl_srv.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/install_clients.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/install_clients.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/install_kdc.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/install_kdc.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/lockout.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/lockout.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/otp.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/otp.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/pkinit.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/pkinit.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/princ_dns.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/princ_dns.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -158,6 +158,14 @@
 (typically the name that <code class="docutils literal"><span class="pre">gethostname()</span></code> returns).  This requires
 krb5-1.10 or later.</p>
 </div>
+<div class="section" id="openldap-ldapsearch-etc">
+<h3>OpenLDAP (ldapsearch, etc.)<a class="headerlink" href="#openldap-ldapsearch-etc" title="Permalink to this headline">¶</a></h3>
+<p>OpenLDAP’s SASL implementation performs reverse DNS lookup in order to
+canonicalize service principal names, even if <strong>rdns</strong> is set to
+<code class="docutils literal"><span class="pre">false</span></code> in the Kerberos configuration.  To disable this behavior,
+add <code class="docutils literal"><span class="pre">SASL_NOCANON</span> <span class="pre">on</span></code> to <code class="docutils literal"><span class="pre">ldap.conf</span></code>, or set the
+<code class="docutils literal"><span class="pre">LDAPSASL_NOCANON</span></code> environment variable.</p>
+</div>
 </div>
 </div>
 
@@ -177,6 +185,7 @@
 <li><a class="reference internal" href="#provisioning-keytabs">Provisioning keytabs</a></li>
 <li><a class="reference internal" href="#specific-application-advice">Specific application advice</a><ul>
 <li><a class="reference internal" href="#secure-shell-ssh">Secure shell (ssh)</a></li>
+<li><a class="reference internal" href="#openldap-ldapsearch-etc">OpenLDAP (ldapsearch, etc.)</a></li>
 </ul>
 </li>
 </ul>
@@ -241,8 +250,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/realm_config.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/realm_config.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/spake.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/spake.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/troubleshoot.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/troubleshoot.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/admin/various_envs.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/admin/various_envs.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/gssapi.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/gssapi.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -281,10 +281,8 @@
 <ul class="simple">
 <li><strong>ccache</strong>: For acquiring initiator credentials, the name of the
 <a class="reference internal" href="../basic/ccache_def.html#ccache-definition"><span class="std std-ref">credential cache</span></a> to which the handle will
-refer.  For storing credentials, the name of the cache where the
-credentials should be stored.  If a collection name is given, the
-primary cache of the collection will be used; this behavior may
-change in future releases to select a cache from the collection.</li>
+refer.  For storing credentials, the name of the cache or collection
+where the credentials will be stored (see below).</li>
 <li><strong>client_keytab</strong>: For acquiring initiator credentials, the name of
 the <a class="reference internal" href="../basic/keytab_def.html#keytab-definition"><span class="std std-ref">keytab</span></a> which will be used, if
 necessary, to refresh the credentials in the cache.</li>
@@ -309,6 +307,14 @@
 the empty string.  If the empty string is given, any <code class="docutils literal"><span class="pre">host</span></code>
 service principal in the keytab may be used.  (New in release 1.19.)</li>
 </ul>
+<p>In release 1.20 or later, if a collection name is specified for
+<strong>cache</strong> in a call to gss_store_cred_into(), an existing cache for
+the client principal within the collection will be selected, or a new
+cache will be created within the collection.  If <em>overwrite_cred</em> is
+false and the selected credential cache already exists, a
+<strong>GSS_S_DUPLICATE_ELEMENT</strong> error will be returned.  If <em>default_cred</em>
+is true, the primary cache of the collection will be switched to the
+selected cache.</p>
 </div>
 <div class="section" id="importing-and-exporting-credentials">
 <h2>Importing and exporting credentials<a class="headerlink" href="#importing-and-exporting-credentials" title="Permalink to this headline">¶</a></h2>
@@ -773,8 +779,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/h5l_mit_apidiff.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/h5l_mit_apidiff.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/init_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/init_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/princ_handle.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/princ_handle.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/index.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -99,7 +99,7 @@
 <li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_get_fast_flags.html">krb5_get_init_creds_opt_get_fast_flags -  Retrieve FAST flags from initial credential options.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_set_address_list.html">krb5_get_init_creds_opt_set_address_list -  Set address restrictions in initial credential options.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_set_anonymous.html">krb5_get_init_creds_opt_set_anonymous -  Set or unset the anonymous flag in initial credential options.</a></li>
-<li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_set_canonicalize.html">krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initial credential options.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_set_canonicalize.html">krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initialcredential options.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_set_change_password_prompt.html">krb5_get_init_creds_opt_set_change_password_prompt -  Set or unset change-password-prompt flag in initial credential options.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_set_etype_list.html">krb5_get_init_creds_opt_set_etype_list -  Set allowable encryption types in initial credential options.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_get_init_creds_opt_set_expire_callback.html">krb5_get_init_creds_opt_set_expire_callback -  Set an expiration callback in initial credential options.</a></li>
@@ -231,7 +231,7 @@
 <li class="toctree-l1"><a class="reference internal" href="krb5_cccol_cursor_free.html">krb5_cccol_cursor_free -  Free a credential cache collection cursor.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_cccol_cursor_new.html">krb5_cccol_cursor_new -  Prepare to iterate over the collection of known credential caches.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_cccol_cursor_next.html">krb5_cccol_cursor_next -  Get the next credential cache in the collection.</a></li>
-<li class="toctree-l1"><a class="reference internal" href="krb5_cccol_have_content.html">krb5_cccol_have_content -  Check if the credential cache collection contains any credentials.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_cccol_have_content.html">krb5_cccol_have_content -  Check if the credential cache collection contains any initialized caches.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_clear_error_message.html">krb5_clear_error_message -  Clear the extended error message in a context.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_check_clockskew.html">krb5_check_clockskew -  Check if a timestamp is within the allowed clock skew of the current time.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_copy_addresses.html">krb5_copy_addresses -  Copy an array of addresses.</a></li>
@@ -282,6 +282,8 @@
 <li class="toctree-l1"><a class="reference internal" href="krb5_init_creds_step.html">krb5_init_creds_step -  Get the next KDC request for acquiring initial credentials.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_init_keyblock.html">krb5_init_keyblock -  Initialize an empty krb5_keyblock .</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_is_referral_realm.html">krb5_is_referral_realm -  Check for a match with KRB5_REFERRAL_REALM.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_kdc_sign_ticket.html">krb5_kdc_sign_ticket -  Sign a PAC, possibly including a ticket signature.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_kdc_verify_ticket.html">krb5_kdc_verify_ticket -  Verify a PAC, possibly including ticket signature.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_kt_add_entry.html">krb5_kt_add_entry -  Add a new entry to a key table.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_kt_end_seq_get.html">krb5_kt_end_seq_get -  Release a keytab cursor.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_kt_get_entry.html">krb5_kt_get_entry -  Get an entry from a key table.</a></li>
@@ -291,6 +293,7 @@
 <li class="toctree-l1"><a class="reference internal" href="krb5_kt_remove_entry.html">krb5_kt_remove_entry -  Remove an entry from a key table.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_kt_start_seq_get.html">krb5_kt_start_seq_get -  Start a sequential retrieval of key table entries.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_make_authdata_kdc_issued.html">krb5_make_authdata_kdc_issued -  Encode and sign AD-KDCIssued authorization data.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_marshal_credentials.html">krb5_marshal_credentials -  Serialize a krb5_creds object.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_merge_authdata.html">krb5_merge_authdata -  Merge two authorization data lists into a new list.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_mk_1cred.html">krb5_mk_1cred -  Format a KRB-CRED message for a single set of credentials.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_mk_error.html">krb5_mk_error -  Format and encode a KRB_ERROR message.</a></li>
@@ -308,11 +311,11 @@
 <li class="toctree-l1"><a class="reference internal" href="krb5_pac_get_types.html">krb5_pac_get_types -  Return an array of buffer types in a PAC handle.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_pac_init.html">krb5_pac_init -  Create an empty Privilege Attribute Certificate (PAC) handle.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_pac_parse.html">krb5_pac_parse -  Unparse an encoded PAC into a new handle.</a></li>
-<li class="toctree-l1"><a class="reference internal" href="krb5_pac_sign.html">krb5_pac_sign -  Sign a PAC.</a></li>
-<li class="toctree-l1"><a class="reference internal" href="krb5_pac_sign_ext.html">krb5_pac_sign_ext -  Sign a PAC, possibly with a specified realm.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_pac_sign.html">krb5_pac_sign</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_pac_sign_ext.html">krb5_pac_sign_ext</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_pac_verify.html">krb5_pac_verify -  Verify a PAC.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_pac_verify_ext.html">krb5_pac_verify_ext -  Verify a PAC, possibly from a specified realm.</a></li>
-<li class="toctree-l1"><a class="reference internal" href="krb5_pac_get_client_info.html">krb5_pac_get_client_info</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_pac_get_client_info.html">krb5_pac_get_client_info -  Read client information from a PAC.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_prepend_error_message.html">krb5_prepend_error_message -  Add a prefix to the message for an error code.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_principal2salt.html">krb5_principal2salt -  Convert a principal name into the default salt for that principal.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_rd_cred.html">krb5_rd_cred -  Read and validate a KRB-CRED message.</a></li>
@@ -344,6 +347,7 @@
 <li class="toctree-l1"><a class="reference internal" href="krb5_tkt_creds_get_times.html">krb5_tkt_creds_get_times -  Retrieve ticket times from a TGS request context.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_tkt_creds_init.html">krb5_tkt_creds_init -  Create a context to get credentials from a KDC’s Ticket Granting Service.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_tkt_creds_step.html">krb5_tkt_creds_step -  Get the next KDC request in a TGS exchange.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_unmarshal_credentials.html">krb5_unmarshal_credentials -  Deserialize a krb5_creds object.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_verify_init_creds.html">krb5_verify_init_creds -  Verify initial credentials against a keytab.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_verify_init_creds_opt_init.html">krb5_verify_init_creds_opt_init -  Initialize a credential verification options structure.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_verify_init_creds_opt_set_ap_req_nofail.html">krb5_verify_init_creds_opt_set_ap_req_nofail -  Set whether credential verification is required.</a></li>
@@ -383,9 +387,9 @@
 <li class="toctree-l1"><a class="reference internal" href="krb5_c_prf.html">krb5_c_prf -  Generate enctype-specific pseudo-random bytes.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_c_prfplus.html">krb5_c_prfplus -  Generate pseudo-random bytes using RFC 6113 PRF+.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_c_prf_length.html">krb5_c_prf_length -  Get the output length of pseudo-random functions for an encryption type.</a></li>
-<li class="toctree-l1"><a class="reference internal" href="krb5_c_random_add_entropy.html">krb5_c_random_add_entropy -  Add entropy to the pseudo-random number generator.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_c_random_add_entropy.html">krb5_c_random_add_entropy</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_c_random_make_octets.html">krb5_c_random_make_octets -  Generate pseudo-random bytes.</a></li>
-<li class="toctree-l1"><a class="reference internal" href="krb5_c_random_os_entropy.html">krb5_c_random_os_entropy -  Collect entropy from the OS if possible.</a></li>
+<li class="toctree-l1"><a class="reference internal" href="krb5_c_random_os_entropy.html">krb5_c_random_os_entropy</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_c_random_to_key.html">krb5_c_random_to_key -  Generate an enctype-specific key from random data.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_c_string_to_key.html">krb5_c_string_to_key -  Convert a string (such a password) to a key.</a></li>
 <li class="toctree-l1"><a class="reference internal" href="krb5_c_string_to_key_with_params.html">krb5_c_string_to_key_with_params -  Convert a string (such as a password) to a key with additional parameters.</a></li>
@@ -531,8 +535,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_425_conv_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_425_conv_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_524_conv_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_524_conv_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_524_convert_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_524_convert_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_address_compare.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_address_compare.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_address_order.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_address_order.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -84,8 +84,9 @@
 <col class="field-body" />
 <tbody valign="top">
 <tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
-<li>0   The two addresses are the same</li>
-<li></li>
+<li>0   if The two addresses are the same</li>
+<li>&lt;   0 First address is less than second</li>
+<li>&gt;   0 First address is greater than second</li>
 </ul>
 </td>
 </tr>
@@ -149,8 +150,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_address_search.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_address_search.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_allow_weak_crypto.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_allow_weak_crypto.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_aname_to_localname.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_aname_to_localname.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_anonymous_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_anonymous_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_anonymous_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_anonymous_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_appdefault_boolean.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_appdefault_boolean.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_appdefault_string.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_appdefault_string.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_genaddrs.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_genaddrs.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_get_checksum_func.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_get_checksum_func.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getaddrs.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getaddrs.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getauthenticator.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getauthenticator.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getflags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getflags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getkey_k.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getkey_k.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getlocalseqnumber.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getlocalseqnumber.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getlocalsubkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getlocalsubkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getrcache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getrcache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getrecvsubkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getrecvsubkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getrecvsubkey_k.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getrecvsubkey_k.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getremoteseqnumber.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getremoteseqnumber.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getremotesubkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getremotesubkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getsendsubkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getsendsubkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getsendsubkey_k.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_getsendsubkey_k.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_init.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_init.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_initivector.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_initivector.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_set_checksum_func.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_set_checksum_func.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_set_req_cksumtype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_set_req_cksumtype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setaddrs.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setaddrs.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setflags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setflags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setports.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setports.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setrcache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setrcache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setrecvsubkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setrecvsubkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setrecvsubkey_k.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setrecvsubkey_k.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setsendsubkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setsendsubkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setsendsubkey_k.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setsendsubkey_k.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setuseruserkey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_auth_con_setuseruserkey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_build_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_build_principal.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -97,6 +97,7 @@
 </tbody>
 </table>
 <p>Call <a class="reference internal" href="krb5_free_principal.html#c.krb5_free_principal" title="krb5_free_principal"><code class="xref c c-func docutils literal"><span class="pre">krb5_free_principal()</span></code></a> to free <em>princ</em> when it is no longer needed.</p>
+<p>Beginning with release 1.20, the name type of the principal will be inferred as <strong>KRB5_NT_SRV_INST</strong> or <strong>KRB5_NT_WELLKNOWN</strong> based on the principal name. The type will be <strong>KRB5_NT_PRINCIPAL</strong> if a type cannot be inferred.</p>
 <div class="admonition note">
 <p class="first admonition-title">Note</p>
 <p class="last"><a class="reference internal" href="#c.krb5_build_principal" title="krb5_build_principal"><code class="xref c c-func docutils literal"><span class="pre">krb5_build_principal()</span></code></a> and <a class="reference internal" href="krb5_build_principal_alloc_va.html#c.krb5_build_principal_alloc_va" title="krb5_build_principal_alloc_va"><code class="xref c c-func docutils literal"><span class="pre">krb5_build_principal_alloc_va()</span></code></a> perform the same task. <a class="reference internal" href="#c.krb5_build_principal" title="krb5_build_principal"><code class="xref c c-func docutils literal"><span class="pre">krb5_build_principal()</span></code></a> takes variadic arguments. <a class="reference internal" href="krb5_build_principal_alloc_va.html#c.krb5_build_principal_alloc_va" title="krb5_build_principal_alloc_va"><code class="xref c c-func docutils literal"><span class="pre">krb5_build_principal_alloc_va()</span></code></a> takes a pre-computed <em>varargs</em> pointer.</p>
@@ -159,8 +160,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_build_principal_alloc_va.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_build_principal_alloc_va.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_build_principal_ext.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_build_principal_ext.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -97,6 +97,7 @@
 </tbody>
 </table>
 <p>This function creates a principal from a length-counted string and a variable-length list of length-counted components. The list of components ends with the first 0 length argument (so it is not possible to specify an empty component with this function). Call <a class="reference internal" href="krb5_free_principal.html#c.krb5_free_principal" title="krb5_free_principal"><code class="xref c c-func docutils literal"><span class="pre">krb5_free_principal()</span></code></a> to free allocated memory for principal when it is no longer needed.</p>
+<p>Beginning with release 1.20, the name type of the principal will be inferred as <strong>KRB5_NT_SRV_INST</strong> or <strong>KRB5_NT_WELLKNOWN</strong> based on the principal name. The type will be <strong>KRB5_NT_PRINCIPAL</strong> if a type cannot be inferred.</p>
 </div>
 
 
@@ -155,8 +156,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_build_principal_va.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_build_principal_va.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_block_size.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_block_size.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_checksum_length.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_checksum_length.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_crypto_length.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_crypto_length.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_crypto_length_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_crypto_length_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_decrypt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_decrypt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_decrypt_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_decrypt_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_derive_prfplus.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_derive_prfplus.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_encrypt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_encrypt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_encrypt_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_encrypt_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_encrypt_length.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_encrypt_length.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_enctype_compare.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_enctype_compare.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_free_state.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_free_state.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_fx_cf2_simple.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_fx_cf2_simple.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_init_state.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_init_state.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_is_coll_proof_cksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_is_coll_proof_cksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_is_keyed_cksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_is_keyed_cksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_keyed_checksum_types.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_keyed_checksum_types.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_keylengths.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_keylengths.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_make_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_make_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_make_checksum_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_make_checksum_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_make_random_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_make_random_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_padding_length.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_padding_length.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_prf.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_prf.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_prf_length.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_prf_length.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_c_random_add_entropy - Add entropy to the pseudo-random number generator." href="krb5_c_random_add_entropy.html" />
+    <link rel="next" title="krb5_c_random_add_entropy" href="krb5_c_random_add_entropy.html" />
     <link rel="prev" title="krb5_c_prfplus - Generate pseudo-random bytes using RFC 6113 PRF+." href="krb5_c_prfplus.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_c_prfplus.html" title="krb5_c_prfplus - Generate pseudo-random bytes using RFC 6113 PRF+."
             accesskey="P">previous</a> |
-        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy - Add entropy to the pseudo-random number generator."
+        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -148,8 +148,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -157,7 +157,7 @@
             >Contents</a> |
         <a href="krb5_c_prfplus.html" title="krb5_c_prfplus - Generate pseudo-random bytes using RFC 6113 PRF+."
             >previous</a> |
-        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy - Add entropy to the pseudo-random number generator."
+        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_prfplus.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_prfplus.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_random_add_entropy.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_random_add_entropy.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>krb5_c_random_add_entropy - Add entropy to the pseudo-random number generator. &#8212; MIT Kerberos Documentation</title>
+    <title>krb5_c_random_add_entropy &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -48,7 +48,7 @@
             accesskey="I">index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_add_entropy -  Add entropy to the pseudo-random number generator.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_add_entropy">feedback</a>
             </div>
         </div>
     </div>
@@ -61,8 +61,8 @@
         <div class="bodywrapper">
           <div class="body" role="main">
             
-  <div class="section" id="krb5-c-random-add-entropy-add-entropy-to-the-pseudo-random-number-generator">
-<h1>krb5_c_random_add_entropy -  Add entropy to the pseudo-random number generator.<a class="headerlink" href="#krb5-c-random-add-entropy-add-entropy-to-the-pseudo-random-number-generator" title="Permalink to this headline">¶</a></h1>
+  <div class="section" id="krb5-c-random-add-entropy">
+<h1>krb5_c_random_add_entropy<a class="headerlink" href="#krb5-c-random-add-entropy" title="Permalink to this headline">¶</a></h1>
 <dl class="function">
 <dt id="c.krb5_c_random_add_entropy">
 <a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_c_random_add_entropy</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, unsigned int<em>&nbsp;randsource</em>, const <a class="reference internal" href="../types/krb5_data.html#c.krb5_data" title="krb5_data">krb5_data</a> *<em>&nbsp;data</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_c_random_add_entropy" title="Permalink to this definition">¶</a></dt>
@@ -72,25 +72,14 @@
 <col class="field-name" />
 <col class="field-body" />
 <tbody valign="top">
-<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
-<p><strong>in</strong> <strong>randsource</strong> - Entropy source (see KRB5_RANDSOURCE types)</p>
-<p class="last"><strong>in</strong> <strong>data</strong> - Data</p>
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>context</strong></p>
+<p><strong>randsource</strong></p>
+<p class="last"><strong>data</strong></p>
 </td>
 </tr>
 </tbody>
 </table>
-<table class="docutils field-list" frame="void" rules="none">
-<col class="field-name" />
-<col class="field-body" />
-<tbody valign="top">
-<tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
-<li>0   Success; otherwise - Kerberos error codes</li>
-</ul>
-</td>
-</tr>
-</tbody>
-</table>
-<p>Contribute entropy to the PRNG used by krb5 crypto operations. This may or may not affect the output of the next crypto operation requiring random data.</p>
+<p>DEPRECATED This call is no longer necessary.</p>
 </div>
 
 
@@ -101,7 +90,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">krb5_c_random_add_entropy -  Add entropy to the pseudo-random number generator.</a></li>
+<li><a class="reference internal" href="#">krb5_c_random_add_entropy</a></li>
 </ul>
 
     <br/>
@@ -149,8 +138,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -164,7 +153,7 @@
             >index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_add_entropy -  Add entropy to the pseudo-random number generator.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_add_entropy">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_random_make_octets.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_random_make_octets.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,8 +26,8 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_c_random_os_entropy - Collect entropy from the OS if possible." href="krb5_c_random_os_entropy.html" />
-    <link rel="prev" title="krb5_c_random_add_entropy - Add entropy to the pseudo-random number generator." href="krb5_c_random_add_entropy.html" /> 
+    <link rel="next" title="krb5_c_random_os_entropy" href="krb5_c_random_os_entropy.html" />
+    <link rel="prev" title="krb5_c_random_add_entropy" href="krb5_c_random_add_entropy.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,9 +40,9 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy - Add entropy to the pseudo-random number generator."
+        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy"
             accesskey="P">previous</a> |
-        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy - Collect entropy from the OS if possible."
+        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -148,16 +148,16 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy - Add entropy to the pseudo-random number generator."
+        <a href="krb5_c_random_add_entropy.html" title="krb5_c_random_add_entropy"
             >previous</a> |
-        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy - Collect entropy from the OS if possible."
+        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_random_os_entropy.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_random_os_entropy.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>krb5_c_random_os_entropy - Collect entropy from the OS if possible. &#8212; MIT Kerberos Documentation</title>
+    <title>krb5_c_random_os_entropy &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -48,7 +48,7 @@
             accesskey="I">index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_os_entropy -  Collect entropy from the OS if possible.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_os_entropy">feedback</a>
             </div>
         </div>
     </div>
@@ -61,8 +61,8 @@
         <div class="bodywrapper">
           <div class="body" role="main">
             
-  <div class="section" id="krb5-c-random-os-entropy-collect-entropy-from-the-os-if-possible">
-<h1>krb5_c_random_os_entropy -  Collect entropy from the OS if possible.<a class="headerlink" href="#krb5-c-random-os-entropy-collect-entropy-from-the-os-if-possible" title="Permalink to this headline">¶</a></h1>
+  <div class="section" id="krb5-c-random-os-entropy">
+<h1>krb5_c_random_os_entropy<a class="headerlink" href="#krb5-c-random-os-entropy" title="Permalink to this headline">¶</a></h1>
 <dl class="function">
 <dt id="c.krb5_c_random_os_entropy">
 <a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_c_random_os_entropy</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, int<em>&nbsp;strong</em>, int *<em>&nbsp;success</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_c_random_os_entropy" title="Permalink to this definition">¶</a></dt>
@@ -72,25 +72,14 @@
 <col class="field-name" />
 <col class="field-body" />
 <tbody valign="top">
-<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
-<p><strong>in</strong> <strong>strong</strong> - Strongest available source of entropy</p>
-<p class="last"><strong>out</strong> <strong>success</strong> - 1 if OS provides entropy, 0 otherwise</p>
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>context</strong></p>
+<p><strong>strong</strong></p>
+<p class="last"><strong>success</strong></p>
 </td>
 </tr>
 </tbody>
 </table>
-<table class="docutils field-list" frame="void" rules="none">
-<col class="field-name" />
-<col class="field-body" />
-<tbody valign="top">
-<tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
-<li>0   Success; otherwise - Kerberos error codes</li>
-</ul>
-</td>
-</tr>
-</tbody>
-</table>
-<p>If <em>strong</em> is non-zero, this function attempts to use the strongest available source of entropy. Setting this flag may cause the function to block on some operating systems. Good uses include seeding the PRNG for kadmind and realm setup.</p>
+<p>DEPRECATED This call is no longer necessary.</p>
 </div>
 
 
@@ -101,7 +90,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">krb5_c_random_os_entropy -  Collect entropy from the OS if possible.</a></li>
+<li><a class="reference internal" href="#">krb5_c_random_os_entropy</a></li>
 </ul>
 
     <br/>
@@ -149,8 +138,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -164,7 +153,7 @@
             >index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_os_entropy -  Collect entropy from the OS if possible.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_c_random_os_entropy">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_random_seed.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_random_seed.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_random_to_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_random_to_key.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_c_string_to_key - Convert a string (such a password) to a key." href="krb5_c_string_to_key.html" />
-    <link rel="prev" title="krb5_c_random_os_entropy - Collect entropy from the OS if possible." href="krb5_c_random_os_entropy.html" /> 
+    <link rel="prev" title="krb5_c_random_os_entropy" href="krb5_c_random_os_entropy.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy - Collect entropy from the OS if possible."
+        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy"
             accesskey="P">previous</a> |
         <a href="krb5_c_string_to_key.html" title="krb5_c_string_to_key - Convert a string (such a password) to a key."
             accesskey="N">next</a> |
@@ -158,14 +158,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy - Collect entropy from the OS if possible."
+        <a href="krb5_c_random_os_entropy.html" title="krb5_c_random_os_entropy"
             >previous</a> |
         <a href="krb5_c_string_to_key.html" title="krb5_c_string_to_key - Convert a string (such a password) to a key."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_string_to_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_string_to_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_string_to_key_with_params.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_string_to_key_with_params.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_valid_cksumtype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_valid_cksumtype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_valid_enctype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_valid_enctype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_verify_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_verify_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_c_verify_checksum_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_c_verify_checksum_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_calculate_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_calculate_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_cache_match.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_cache_match.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_close.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_close.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_copy_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_copy_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_default.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_default.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_default_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_default_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_destroy.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_destroy.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_dup.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_dup.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_end_seq_get.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_end_seq_get.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_gen_new.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_gen_new.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_config.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_config.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_full_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_full_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_type.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_get_type.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_initialize.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_initialize.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_move.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_move.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_new_unique.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_new_unique.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_next_cred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_next_cred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_remove_cred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_remove_cred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_resolve.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_resolve.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_retrieve_cred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_retrieve_cred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_select.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_select.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_set_config.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_set_config.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_set_default_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_set_default_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_set_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_set_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_start_seq_get.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_start_seq_get.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_store_cred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_store_cred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_support_switch.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_support_switch.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cc_switch.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cc_switch.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cccol_cursor_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cccol_cursor_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cccol_cursor_new.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cccol_cursor_new.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cccol_cursor_next.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cccol_cursor_next.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_cccol_have_content - Check if the credential cache collection contains any credentials." href="krb5_cccol_have_content.html" />
+    <link rel="next" title="krb5_cccol_have_content - Check if the credential cache collection contains any initialized caches." href="krb5_cccol_have_content.html" />
     <link rel="prev" title="krb5_cccol_cursor_new - Prepare to iterate over the collection of known credential caches." href="krb5_cccol_cursor_new.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_cccol_cursor_new.html" title="krb5_cccol_cursor_new - Prepare to iterate over the collection of known credential caches."
             accesskey="P">previous</a> |
-        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any credentials."
+        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any initialized caches."
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -157,8 +157,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -166,7 +166,7 @@
             >Contents</a> |
         <a href="krb5_cccol_cursor_new.html" title="krb5_cccol_cursor_new - Prepare to iterate over the collection of known credential caches."
             >previous</a> |
-        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any credentials."
+        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any initialized caches."
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cccol_have_content.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cccol_have_content.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>krb5_cccol_have_content - Check if the credential cache collection contains any credentials. &#8212; MIT Kerberos Documentation</title>
+    <title>krb5_cccol_have_content - Check if the credential cache collection contains any initialized caches. &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -48,7 +48,7 @@
             accesskey="I">index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_cccol_have_content -  Check if the credential cache collection contains any credentials.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_cccol_have_content -  Check if the credential cache collection contains any initialized caches.">feedback</a>
             </div>
         </div>
     </div>
@@ -61,8 +61,8 @@
         <div class="bodywrapper">
           <div class="body" role="main">
             
-  <div class="section" id="krb5-cccol-have-content-check-if-the-credential-cache-collection-contains-any-credentials">
-<h1>krb5_cccol_have_content -  Check if the credential cache collection contains any credentials.<a class="headerlink" href="#krb5-cccol-have-content-check-if-the-credential-cache-collection-contains-any-credentials" title="Permalink to this headline">¶</a></h1>
+  <div class="section" id="krb5-cccol-have-content-check-if-the-credential-cache-collection-contains-any-initialized-caches">
+<h1>krb5_cccol_have_content -  Check if the credential cache collection contains any initialized caches.<a class="headerlink" href="#krb5-cccol-have-content-check-if-the-credential-cache-collection-contains-any-initialized-caches" title="Permalink to this headline">¶</a></h1>
 <dl class="function">
 <dt id="c.krb5_cccol_have_content">
 <a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_cccol_have_content</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_cccol_have_content" title="Permalink to this definition">¶</a></dt>
@@ -81,8 +81,8 @@
 <col class="field-body" />
 <tbody valign="top">
 <tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
-<li>0   Credentials are available in the collection</li>
-<li>KRB5_CC_NOTFOUND   The collection contains no credentials</li>
+<li>0   At least one initialized cache is present in the collection</li>
+<li>KRB5_CC_NOTFOUND   The collection contains no caches</li>
 </ul>
 </td>
 </tr>
@@ -102,7 +102,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">krb5_cccol_have_content -  Check if the credential cache collection contains any credentials.</a></li>
+<li><a class="reference internal" href="#">krb5_cccol_have_content -  Check if the credential cache collection contains any initialized caches.</a></li>
 </ul>
 
     <br/>
@@ -150,8 +150,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -165,7 +165,7 @@
             >index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_cccol_have_content -  Check if the credential cache collection contains any credentials.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_cccol_have_content -  Check if the credential cache collection contains any initialized caches.">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_change_password.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_change_password.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_check_clockskew.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_check_clockskew.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_checksum_size.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_checksum_size.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_chpw_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_chpw_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_cksumtype_to_string.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_cksumtype_to_string.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_clear_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_clear_error_message.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_check_clockskew - Check if a timestamp is within the allowed clock skew of the current time." href="krb5_check_clockskew.html" />
-    <link rel="prev" title="krb5_cccol_have_content - Check if the credential cache collection contains any credentials." href="krb5_cccol_have_content.html" /> 
+    <link rel="prev" title="krb5_cccol_have_content - Check if the credential cache collection contains any initialized caches." href="krb5_cccol_have_content.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any credentials."
+        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any initialized caches."
             accesskey="P">previous</a> |
         <a href="krb5_check_clockskew.html" title="krb5_check_clockskew - Check if a timestamp is within the allowed clock skew of the current time."
             accesskey="N">next</a> |
@@ -135,14 +135,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any credentials."
+        <a href="krb5_cccol_have_content.html" title="krb5_cccol_have_content - Check if the credential cache collection contains any initialized caches."
             >previous</a> |
         <a href="krb5_check_clockskew.html" title="krb5_check_clockskew - Check if a timestamp is within the allowed clock skew of the current time."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_addresses.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_addresses.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_authdata.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_authdata.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_authenticator.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_authenticator.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_keyblock.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_keyblock.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_keyblock_contents.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_keyblock_contents.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_copy_ticket.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_copy_ticket.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_decode_authdata_container.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_decode_authdata_container.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_decode_ticket.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_decode_ticket.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_decrypt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_decrypt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_deltat_to_string.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_deltat_to_string.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_eblock_enctype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_eblock_enctype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_encode_authdata_container.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_encode_authdata_container.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_encrypt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_encrypt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_encrypt_size.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_encrypt_size.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_enctype_to_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_enctype_to_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_enctype_to_string.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_enctype_to_string.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_expand_hostname.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_expand_hostname.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_find_authdata.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_find_authdata.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_finish_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_finish_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_finish_random_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_finish_random_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_addresses.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_addresses.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_ap_rep_enc_part.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_ap_rep_enc_part.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_authdata.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_authdata.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_authenticator.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_authenticator.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_checksum_contents.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_checksum_contents.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_cksumtypes.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_cksumtypes.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_cred_contents.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_cred_contents.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_data_contents.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_data_contents.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_default_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_default_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_enctypes.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_enctypes.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_error.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_error.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_host_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_host_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_keyblock.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_keyblock.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_keyblock_contents.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_keyblock_contents.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_keytab_entry_contents.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_keytab_entry_contents.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_string.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_string.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_tgt_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_tgt_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_ticket.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_ticket.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_free_unparsed_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_free_unparsed_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_fwd_tgt_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_fwd_tgt_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_credentials.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_credentials.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_credentials_renew.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_credentials_renew.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_credentials_validate.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_credentials_validate.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_default_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_default_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_etype_info.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_etype_info.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_fallback_host_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_fallback_host_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_host_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_host_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_in_tkt_with_keytab.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_in_tkt_with_keytab.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_in_tkt_with_password.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_in_tkt_with_password.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_in_tkt_with_skey.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_in_tkt_with_skey.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_keytab.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_keytab.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_alloc.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_alloc.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_init.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_init.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_address_list.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_address_list.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_anonymous.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_anonymous.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initial credential options." href="krb5_get_init_creds_opt_set_canonicalize.html" />
+    <link rel="next" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initialcredential options." href="krb5_get_init_creds_opt_set_canonicalize.html" />
     <link rel="prev" title="krb5_get_init_creds_opt_set_address_list - Set address restrictions in initial credential options." href="krb5_get_init_creds_opt_set_address_list.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_get_init_creds_opt_set_address_list.html" title="krb5_get_init_creds_opt_set_address_list - Set address restrictions in initial credential options."
             accesskey="P">previous</a> |
-        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initial credential options."
+        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initialcredential options."
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -137,8 +137,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -146,7 +146,7 @@
             >Contents</a> |
         <a href="krb5_get_init_creds_opt_set_address_list.html" title="krb5_get_init_creds_opt_set_address_list - Set address restrictions in initial credential options."
             >previous</a> |
-        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initial credential options."
+        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initialcredential options."
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initial credential options. &#8212; MIT Kerberos Documentation</title>
+    <title>krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initialcredential options. &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -48,7 +48,7 @@
             accesskey="I">index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initial credential options.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initialcredential options.">feedback</a>
             </div>
         </div>
     </div>
@@ -61,8 +61,8 @@
         <div class="bodywrapper">
           <div class="body" role="main">
             
-  <div class="section" id="krb5-get-init-creds-opt-set-canonicalize-set-or-unset-the-canonicalize-flag-in-initial-credential-options">
-<h1>krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initial credential options.<a class="headerlink" href="#krb5-get-init-creds-opt-set-canonicalize-set-or-unset-the-canonicalize-flag-in-initial-credential-options" title="Permalink to this headline">¶</a></h1>
+  <div class="section" id="krb5-get-init-creds-opt-set-canonicalize-set-or-unset-the-canonicalize-flag-in-initialcredential-options">
+<h1>krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initialcredential options.<a class="headerlink" href="#krb5-get-init-creds-opt-set-canonicalize-set-or-unset-the-canonicalize-flag-in-initialcredential-options" title="Permalink to this headline">¶</a></h1>
 <dl class="function">
 <dt id="c.krb5_get_init_creds_opt_set_canonicalize">
 void <code class="descname">krb5_get_init_creds_opt_set_canonicalize</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_get_init_creds_opt.html#c.krb5_get_init_creds_opt" title="krb5_get_init_creds_opt">krb5_get_init_creds_opt</a> *<em>&nbsp;opt</em>, int<em>&nbsp;canonicalize</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_get_init_creds_opt_set_canonicalize" title="Permalink to this definition">¶</a></dt>
@@ -88,7 +88,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initial credential options.</a></li>
+<li><a class="reference internal" href="#">krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initialcredential options.</a></li>
 </ul>
 
     <br/>
@@ -136,8 +136,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -151,7 +151,7 @@
             >index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initial credential options.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initialcredential options.">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_get_init_creds_opt_set_etype_list - Set allowable encryption types in initial credential options." href="krb5_get_init_creds_opt_set_etype_list.html" />
-    <link rel="prev" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initial credential options." href="krb5_get_init_creds_opt_set_canonicalize.html" /> 
+    <link rel="prev" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initialcredential options." href="krb5_get_init_creds_opt_set_canonicalize.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initial credential options."
+        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initialcredential options."
             accesskey="P">previous</a> |
         <a href="krb5_get_init_creds_opt_set_etype_list.html" title="krb5_get_init_creds_opt_set_etype_list - Set allowable encryption types in initial credential options."
             accesskey="N">next</a> |
@@ -137,14 +137,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initial credential options."
+        <a href="krb5_get_init_creds_opt_set_canonicalize.html" title="krb5_get_init_creds_opt_set_canonicalize - Set or unset the canonicalize flag in initialcredential options."
             >previous</a> |
         <a href="krb5_get_init_creds_opt_set_etype_list.html" title="krb5_get_init_creds_opt_set_etype_list - Set allowable encryption types in initial credential options."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_etype_list.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_etype_list.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_forwardable.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_forwardable.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_pa.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_pa.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_pac_request.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_pac_request.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_proxiable.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_proxiable.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_renew_life.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_renew_life.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_responder.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_responder.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_salt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_salt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_password.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_init_creds_password.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_permitted_enctypes.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_permitted_enctypes.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_profile.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_profile.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_prompt_types.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_prompt_types.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_renewed_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_renewed_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_server_rcache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_server_rcache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_time_offsets.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_time_offsets.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_get_validated_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_get_validated_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_context_profile.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_context_profile.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get_error.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get_error.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get_times.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_get_times.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_init.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_init.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_set_keytab.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_set_keytab.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_set_password.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_set_password.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_set_service.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_set_service.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_step.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_creds_step.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_keyblock.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_keyblock.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_random_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_random_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_init_secure_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_init_secure_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_is_config_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_is_config_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_is_referral_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_is_referral_realm.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_kt_add_entry - Add a new entry to a key table." href="krb5_kt_add_entry.html" />
+    <link rel="next" title="krb5_kdc_sign_ticket - Sign a PAC, possibly including a ticket signature." href="krb5_kdc_sign_ticket.html" />
     <link rel="prev" title="krb5_init_keyblock - Initialize an empty krb5_keyblock ." href="krb5_init_keyblock.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_init_keyblock.html" title="krb5_init_keyblock - Initialize an empty krb5_keyblock ."
             accesskey="P">previous</a> |
-        <a href="krb5_kt_add_entry.html" title="krb5_kt_add_entry - Add a new entry to a key table."
+        <a href="krb5_kdc_sign_ticket.html" title="krb5_kdc_sign_ticket - Sign a PAC, possibly including a ticket signature."
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -145,8 +145,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -154,7 +154,7 @@
             >Contents</a> |
         <a href="krb5_init_keyblock.html" title="krb5_init_keyblock - Initialize an empty krb5_keyblock ."
             >previous</a> |
-        <a href="krb5_kt_add_entry.html" title="krb5_kt_add_entry - Add a new entry to a key table."
+        <a href="krb5_kdc_sign_ticket.html" title="krb5_kdc_sign_ticket - Sign a PAC, possibly including a ticket signature."
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_is_thread_safe.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_is_thread_safe.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_create_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_create_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_decrypt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_decrypt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_decrypt_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_decrypt_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_encrypt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_encrypt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_encrypt_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_encrypt_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_free_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_free_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_key_enctype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_key_enctype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_key_keyblock.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_key_keyblock.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_make_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_make_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_make_checksum_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_make_checksum_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_prf.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_prf.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_reference_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_reference_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_verify_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_verify_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_k_verify_checksum_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_k_verify_checksum_iov.html Changed

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kdc_sign_ticket.html Added

@@ -0,0 +1,182 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>krb5_kdc_sign_ticket - Sign a PAC, possibly including a ticket signature. &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="krb5_kdc_verify_ticket - Verify a PAC, possibly including ticket signature." href="krb5_kdc_verify_ticket.html" />
+    <link rel="prev" title="krb5_is_referral_realm - Check for a match with KRB5_REFERRAL_REALM." href="krb5_is_referral_realm.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="krb5_is_referral_realm.html" title="krb5_is_referral_realm - Check for a match with KRB5_REFERRAL_REALM."
+            accesskey="P">previous</a> |
+        <a href="krb5_kdc_verify_ticket.html" title="krb5_kdc_verify_ticket - Verify a PAC, possibly including ticket signature."
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_kdc_sign_ticket -  Sign a PAC, possibly including a ticket signature.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-kdc-sign-ticket-sign-a-pac-possibly-including-a-ticket-signature">
+<h1>krb5_kdc_sign_ticket -  Sign a PAC, possibly including a ticket signature.<a class="headerlink" href="#krb5-kdc-sign-ticket-sign-a-pac-possibly-including-a-ticket-signature" title="Permalink to this headline">¶</a></h1>
+<dl class="function">
+<dt id="c.krb5_kdc_sign_ticket">
+<a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_kdc_sign_ticket</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, <a class="reference internal" href="../types/krb5_enc_tkt_part.html#c.krb5_enc_tkt_part" title="krb5_enc_tkt_part">krb5_enc_tkt_part</a> *<em>&nbsp;enc_tkt</em>, const <a class="reference internal" href="../types/krb5_pac.html#c.krb5_pac" title="krb5_pac">krb5_pac</a><em>&nbsp;pac</em>, <a class="reference internal" href="../types/krb5_const_principal.html#c.krb5_const_principal" title="krb5_const_principal">krb5_const_principal</a><em>&nbsp;server_princ</em>, <a class="reference internal" href="../types/krb5_const_principal.html#c.krb5_const_principal" title="krb5_const_principal">krb5_const_principal</a><em>&nbsp;client_princ</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;server</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;privsvr</em>, <a class="reference internal" href="../types/krb5_boolean.html#c.krb5_boolean" title="krb5_boolean">krb5_boolean</a><em>&nbsp;with_realm</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_kdc_sign_ticket" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
+<p><strong>in</strong> <strong>enc_tkt</strong> - The ticket for the signature</p>
+<p><strong>in</strong> <strong>pac</strong> - PAC handle</p>
+<p><strong>in</strong> <strong>server_princ</strong> - Canonical ticket server name</p>
+<p><strong>in</strong> <strong>client_princ</strong> - PAC_CLIENT_INFO principal (or NULL)</p>
+<p><strong>in</strong> <strong>server</strong> - Key for server checksum</p>
+<p><strong>in</strong> <strong>privsvr</strong> - Key for KDC and ticket checksum</p>
+<p class="last"><strong>in</strong> <strong>with_realm</strong> - If true, include the realm of <em>principal</em></p>
+</td>
+</tr>
+</tbody>
+</table>
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
+<li>0   on success, otherwise - Kerberos error codes</li>
+</ul>
+</td>
+</tr>
+</tbody>
+</table>
+<p>Sign <em>pac</em> using the keys <em>server</em> and <em>privsvr</em> . Include a ticket signature over <em>enc_tkt</em> if <em>server_princ</em> is not a TGS or kadmin/changepw principal name. Add the signed PAC’s encoding to the authorization data of <em>enc_tkt</em> in the first slot, wrapped in an AD-IF-RELEVANT container. If <em>client_princ</em> is non-null, add a PAC_CLIENT_INFO buffer, including the realm if <em>with_realm</em> is true.</p>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">New in 1.20</p>
+</div>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">krb5_kdc_sign_ticket -  Sign a PAC, possibly including a ticket signature.</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../macros/index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="krb5_is_referral_realm.html" title="krb5_is_referral_realm - Check for a match with KRB5_REFERRAL_REALM."
+            >previous</a> |
+        <a href="krb5_kdc_verify_ticket.html" title="krb5_kdc_verify_ticket - Verify a PAC, possibly including ticket signature."
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_kdc_sign_ticket -  Sign a PAC, possibly including a ticket signature.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kdc_verify_ticket.html Added

@@ -0,0 +1,185 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>krb5_kdc_verify_ticket - Verify a PAC, possibly including ticket signature. &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="krb5_kt_add_entry - Add a new entry to a key table." href="krb5_kt_add_entry.html" />
+    <link rel="prev" title="krb5_kdc_sign_ticket - Sign a PAC, possibly including a ticket signature." href="krb5_kdc_sign_ticket.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="krb5_kdc_sign_ticket.html" title="krb5_kdc_sign_ticket - Sign a PAC, possibly including a ticket signature."
+            accesskey="P">previous</a> |
+        <a href="krb5_kt_add_entry.html" title="krb5_kt_add_entry - Add a new entry to a key table."
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_kdc_verify_ticket -  Verify a PAC, possibly including ticket signature.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-kdc-verify-ticket-verify-a-pac-possibly-including-ticket-signature">
+<h1>krb5_kdc_verify_ticket -  Verify a PAC, possibly including ticket signature.<a class="headerlink" href="#krb5-kdc-verify-ticket-verify-a-pac-possibly-including-ticket-signature" title="Permalink to this headline">¶</a></h1>
+<dl class="function">
+<dt id="c.krb5_kdc_verify_ticket">
+<a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_kdc_verify_ticket</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, const <a class="reference internal" href="../types/krb5_enc_tkt_part.html#c.krb5_enc_tkt_part" title="krb5_enc_tkt_part">krb5_enc_tkt_part</a> *<em>&nbsp;enc_tkt</em>, <a class="reference internal" href="../types/krb5_const_principal.html#c.krb5_const_principal" title="krb5_const_principal">krb5_const_principal</a><em>&nbsp;server_princ</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;server</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;privsvr</em>, <a class="reference internal" href="../types/krb5_pac.html#c.krb5_pac" title="krb5_pac">krb5_pac</a> *<em>&nbsp;pac_out</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_kdc_verify_ticket" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
+<p><strong>in</strong> <strong>enc_tkt</strong> - Ticket enc-part, possibly containing a PAC</p>
+<p><strong>in</strong> <strong>server_princ</strong> - Canonicalized name of ticket server</p>
+<p><strong>in</strong> <strong>server</strong> - Key to validate server checksum (or NULL)</p>
+<p><strong>in</strong> <strong>privsvr</strong> - Key to validate KDC checksum (or NULL)</p>
+<p class="last"><strong>out</strong> <strong>pac_out</strong> - Verified PAC (NULL if no PAC included)</p>
+</td>
+</tr>
+</tbody>
+</table>
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
+<li>0   Success; otherwise - Kerberos error codes</li>
+</ul>
+</td>
+</tr>
+</tbody>
+</table>
+<p>If a PAC is present in <em>enc_tkt</em> , verify its signatures. If <em>privsvr</em> is not NULL and <em>server_princ</em> is not a krbtgt or kadmin/changepw service, require a ticket signature over <em>enc_tkt</em> in addition to the KDC signature. Place the verified PAC in <em>pac_out</em> . If an invalid PAC signature is found, return an error matching the Windows KDC protocol code for that condition as closely as possible.</p>
+<p>If no PAC is present in <em>enc_tkt</em> , set <em>pac_out</em> to NULL and return successfully.</p>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">This function does not validate the PAC_CLIENT_INFO buffer. If a specific value is expected, the caller can make a separate call to <a class="reference internal" href="krb5_pac_verify_ext.html#c.krb5_pac_verify_ext" title="krb5_pac_verify_ext"><code class="xref c c-func docutils literal"><span class="pre">krb5_pac_verify_ext()</span></code></a> with a principal but no keys.</p>
+</div>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">New in 1.20</p>
+</div>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">krb5_kdc_verify_ticket -  Verify a PAC, possibly including ticket signature.</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../macros/index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="krb5_kdc_sign_ticket.html" title="krb5_kdc_sign_ticket - Sign a PAC, possibly including a ticket signature."
+            >previous</a> |
+        <a href="krb5_kt_add_entry.html" title="krb5_kt_add_entry - Add a new entry to a key table."
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_kdc_verify_ticket -  Verify a PAC, possibly including ticket signature.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_add_entry.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_add_entry.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_kt_end_seq_get - Release a keytab cursor." href="krb5_kt_end_seq_get.html" />
-    <link rel="prev" title="krb5_is_referral_realm - Check for a match with KRB5_REFERRAL_REALM." href="krb5_is_referral_realm.html" /> 
+    <link rel="prev" title="krb5_kdc_verify_ticket - Verify a PAC, possibly including ticket signature." href="krb5_kdc_verify_ticket.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_is_referral_realm.html" title="krb5_is_referral_realm - Check for a match with KRB5_REFERRAL_REALM."
+        <a href="krb5_kdc_verify_ticket.html" title="krb5_kdc_verify_ticket - Verify a PAC, possibly including ticket signature."
             accesskey="P">previous</a> |
         <a href="krb5_kt_end_seq_get.html" title="krb5_kt_end_seq_get - Release a keytab cursor."
             accesskey="N">next</a> |
@@ -155,14 +155,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_is_referral_realm.html" title="krb5_is_referral_realm - Check for a match with KRB5_REFERRAL_REALM."
+        <a href="krb5_kdc_verify_ticket.html" title="krb5_kdc_verify_ticket - Verify a PAC, possibly including ticket signature."
             >previous</a> |
         <a href="krb5_kt_end_seq_get.html" title="krb5_kt_end_seq_get - Release a keytab cursor."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_client_default.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_client_default.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_close.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_close.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_default.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_default.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_default_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_default_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_dup.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_dup.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_end_seq_get.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_end_seq_get.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_free_entry.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_free_entry.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_get_entry.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_get_entry.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_get_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_get_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_get_type.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_get_type.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_have_content.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_have_content.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_next_entry.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_next_entry.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_read_service_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_read_service_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_remove_entry.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_remove_entry.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_resolve.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_resolve.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kt_start_seq_get.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kt_start_seq_get.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_kuserok.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_kuserok.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_make_authdata_kdc_issued.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_make_authdata_kdc_issued.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_merge_authdata - Merge two authorization data lists into a new list." href="krb5_merge_authdata.html" />
+    <link rel="next" title="krb5_marshal_credentials - Serialize a krb5_creds object." href="krb5_marshal_credentials.html" />
     <link rel="prev" title="krb5_kt_start_seq_get - Start a sequential retrieval of key table entries." href="krb5_kt_start_seq_get.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_kt_start_seq_get.html" title="krb5_kt_start_seq_get - Start a sequential retrieval of key table entries."
             accesskey="P">previous</a> |
-        <a href="krb5_merge_authdata.html" title="krb5_merge_authdata - Merge two authorization data lists into a new list."
+        <a href="krb5_marshal_credentials.html" title="krb5_marshal_credentials - Serialize a krb5_creds object."
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -140,8 +140,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -149,7 +149,7 @@
             >Contents</a> |
         <a href="krb5_kt_start_seq_get.html" title="krb5_kt_start_seq_get - Start a sequential retrieval of key table entries."
             >previous</a> |
-        <a href="krb5_merge_authdata.html" title="krb5_merge_authdata - Merge two authorization data lists into a new list."
+        <a href="krb5_marshal_credentials.html" title="krb5_marshal_credentials - Serialize a krb5_creds object."
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_marshal_credentials.html Added

@@ -0,0 +1,174 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>krb5_marshal_credentials - Serialize a krb5_creds object. &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="krb5_merge_authdata - Merge two authorization data lists into a new list." href="krb5_merge_authdata.html" />
+    <link rel="prev" title="krb5_make_authdata_kdc_issued - Encode and sign AD-KDCIssued authorization data." href="krb5_make_authdata_kdc_issued.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="krb5_make_authdata_kdc_issued.html" title="krb5_make_authdata_kdc_issued - Encode and sign AD-KDCIssued authorization data."
+            accesskey="P">previous</a> |
+        <a href="krb5_merge_authdata.html" title="krb5_merge_authdata - Merge two authorization data lists into a new list."
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_marshal_credentials -  Serialize a krb5_creds object.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-marshal-credentials-serialize-a-krb5-creds-object">
+<h1>krb5_marshal_credentials -  Serialize a krb5_creds object.<a class="headerlink" href="#krb5-marshal-credentials-serialize-a-krb5-creds-object" title="Permalink to this headline">¶</a></h1>
+<dl class="function">
+<dt id="c.krb5_marshal_credentials">
+<a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_marshal_credentials</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, <a class="reference internal" href="../types/krb5_creds.html#c.krb5_creds" title="krb5_creds">krb5_creds</a> *<em>&nbsp;in_creds</em>, <a class="reference internal" href="../types/krb5_data.html#c.krb5_data" title="krb5_data">krb5_data</a> **<em>&nbsp;data_out</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_marshal_credentials" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
+<p><strong>in</strong> <strong>in_creds</strong> - The credentials object to serialize</p>
+<p class="last"><strong>out</strong> <strong>data_out</strong> - The serialized credentials</p>
+</td>
+</tr>
+</tbody>
+</table>
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
+<li>0   Success; otherwise - Kerberos error codes</li>
+</ul>
+</td>
+</tr>
+</tbody>
+</table>
+<p>Serialize <em>creds</em> in the format used by the FILE ccache format (vesion 4) and KCM ccache protocol.</p>
+<p>Use <a class="reference internal" href="krb5_free_data.html#c.krb5_free_data" title="krb5_free_data"><code class="xref c c-func docutils literal"><span class="pre">krb5_free_data()</span></code></a> to free <em>data_out</em> when it is no longer needed.</p>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">krb5_marshal_credentials -  Serialize a krb5_creds object.</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../macros/index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="krb5_make_authdata_kdc_issued.html" title="krb5_make_authdata_kdc_issued - Encode and sign AD-KDCIssued authorization data."
+            >previous</a> |
+        <a href="krb5_merge_authdata.html" title="krb5_merge_authdata - Merge two authorization data lists into a new list."
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_marshal_credentials -  Serialize a krb5_creds object.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_merge_authdata.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_merge_authdata.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_mk_1cred - Format a KRB-CRED message for a single set of credentials." href="krb5_mk_1cred.html" />
-    <link rel="prev" title="krb5_make_authdata_kdc_issued - Encode and sign AD-KDCIssued authorization data." href="krb5_make_authdata_kdc_issued.html" /> 
+    <link rel="prev" title="krb5_marshal_credentials - Serialize a krb5_creds object." href="krb5_marshal_credentials.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_make_authdata_kdc_issued.html" title="krb5_make_authdata_kdc_issued - Encode and sign AD-KDCIssued authorization data."
+        <a href="krb5_marshal_credentials.html" title="krb5_marshal_credentials - Serialize a krb5_creds object."
             accesskey="P">previous</a> |
         <a href="krb5_mk_1cred.html" title="krb5_mk_1cred - Format a KRB-CRED message for a single set of credentials."
             accesskey="N">next</a> |
@@ -154,14 +154,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_make_authdata_kdc_issued.html" title="krb5_make_authdata_kdc_issued - Encode and sign AD-KDCIssued authorization data."
+        <a href="krb5_marshal_credentials.html" title="krb5_marshal_credentials - Serialize a krb5_creds object."
             >previous</a> |
         <a href="krb5_mk_1cred.html" title="krb5_mk_1cred - Format a KRB-CRED message for a single set of credentials."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_1cred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_1cred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_error.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_error.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_ncred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_ncred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_priv.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_priv.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_rep.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_rep.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_rep_dce.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_rep_dce.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_req.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_req.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_req_extended.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_req_extended.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_mk_safe.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_mk_safe.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_os_localaddr.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_os_localaddr.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_add_buffer.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_add_buffer.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_get_buffer.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_get_buffer.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_get_client_info.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_get_client_info.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>krb5_pac_get_client_info &#8212; MIT Kerberos Documentation</title>
+    <title>krb5_pac_get_client_info - Read client information from a PAC. &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -48,7 +48,7 @@
             accesskey="I">index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_get_client_info">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_get_client_info -  Read client information from a PAC.">feedback</a>
             </div>
         </div>
     </div>
@@ -61,8 +61,8 @@
         <div class="bodywrapper">
           <div class="body" role="main">
             
-  <div class="section" id="krb5-pac-get-client-info">
-<h1>krb5_pac_get_client_info<a class="headerlink" href="#krb5-pac-get-client-info" title="Permalink to this headline">¶</a></h1>
+  <div class="section" id="krb5-pac-get-client-info-read-client-information-from-a-pac">
+<h1>krb5_pac_get_client_info -  Read client information from a PAC.<a class="headerlink" href="#krb5-pac-get-client-info-read-client-information-from-a-pac" title="Permalink to this headline">¶</a></h1>
 <dl class="function">
 <dt id="c.krb5_pac_get_client_info">
 <a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_pac_get_client_info</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, const <a class="reference internal" href="../types/krb5_pac.html#c.krb5_pac" title="krb5_pac">krb5_pac</a><em>&nbsp;pac</em>, <a class="reference internal" href="../types/krb5_timestamp.html#c.krb5_timestamp" title="krb5_timestamp">krb5_timestamp</a> *<em>&nbsp;authtime_out</em>, char **<em>&nbsp;princname_out</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_pac_get_client_info" title="Permalink to this definition">¶</a></dt>
@@ -72,14 +72,30 @@
 <col class="field-name" />
 <col class="field-body" />
 <tbody valign="top">
-<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>context</strong></p>
-<p><strong>pac</strong></p>
-<p><strong>authtime_out</strong></p>
-<p class="last"><strong>princname_out</strong></p>
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
+<p><strong>in</strong> <strong>pac</strong> - PAC handle</p>
+<p><strong>out</strong> <strong>authtime_out</strong> - Authentication timestamp (NULL if not needed)</p>
+<p class="last"><strong>out</strong> <strong>princname_out</strong> - Client account name</p>
 </td>
 </tr>
 </tbody>
 </table>
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
+<li>0   on success, ENOENT if no PAC_CLIENT_INFO buffer is present in pac , ERANGE if the buffer contains invalid lengths.</li>
+</ul>
+</td>
+</tr>
+</tbody>
+</table>
+<p>Read the PAC_CLIENT_INFO buffer in <em>pac</em> . Place the client account name as a string in <em>princname_out</em> . If <em>authtime_out</em> is not NULL, place the initial authentication timestamp in <em>authtime_out</em> .</p>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">New in 1.18</p>
+</div>
 </div>
 
 
@@ -90,7 +106,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">krb5_pac_get_client_info</a></li>
+<li><a class="reference internal" href="#">krb5_pac_get_client_info -  Read client information from a PAC.</a></li>
 </ul>
 
     <br/>
@@ -138,8 +154,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -153,7 +169,7 @@
             >index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_get_client_info">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_get_client_info -  Read client information from a PAC.">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_get_types.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_get_types.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_init.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_init.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_parse.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_parse.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_pac_sign - Sign a PAC." href="krb5_pac_sign.html" />
+    <link rel="next" title="krb5_pac_sign" href="krb5_pac_sign.html" />
     <link rel="prev" title="krb5_pac_init - Create an empty Privilege Attribute Certificate (PAC) handle." href="krb5_pac_init.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_pac_init.html" title="krb5_pac_init - Create an empty Privilege Attribute Certificate (PAC) handle."
             accesskey="P">previous</a> |
-        <a href="krb5_pac_sign.html" title="krb5_pac_sign - Sign a PAC."
+        <a href="krb5_pac_sign.html" title="krb5_pac_sign"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -150,8 +150,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -159,7 +159,7 @@
             >Contents</a> |
         <a href="krb5_pac_init.html" title="krb5_pac_init - Create an empty Privilege Attribute Certificate (PAC) handle."
             >previous</a> |
-        <a href="krb5_pac_sign.html" title="krb5_pac_sign - Sign a PAC."
+        <a href="krb5_pac_sign.html" title="krb5_pac_sign"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_sign.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_sign.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>krb5_pac_sign - Sign a PAC. &#8212; MIT Kerberos Documentation</title>
+    <title>krb5_pac_sign &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_pac_sign_ext - Sign a PAC, possibly with a specified realm." href="krb5_pac_sign_ext.html" />
+    <link rel="next" title="krb5_pac_sign_ext" href="krb5_pac_sign_ext.html" />
     <link rel="prev" title="krb5_pac_parse - Unparse an encoded PAC into a new handle." href="krb5_pac_parse.html" /> 
   </head>
   <body>
@@ -42,13 +42,13 @@
             accesskey="C">Contents</a> |
         <a href="krb5_pac_parse.html" title="krb5_pac_parse - Unparse an encoded PAC into a new handle."
             accesskey="P">previous</a> |
-        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext - Sign a PAC, possibly with a specified realm."
+        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign -  Sign a PAC.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign">feedback</a>
             </div>
         </div>
     </div>
@@ -61,8 +61,8 @@
         <div class="bodywrapper">
           <div class="body" role="main">
             
-  <div class="section" id="krb5-pac-sign-sign-a-pac">
-<h1>krb5_pac_sign -  Sign a PAC.<a class="headerlink" href="#krb5-pac-sign-sign-a-pac" title="Permalink to this headline">¶</a></h1>
+  <div class="section" id="krb5-pac-sign">
+<h1>krb5_pac_sign<a class="headerlink" href="#krb5-pac-sign" title="Permalink to this headline">¶</a></h1>
 <dl class="function">
 <dt id="c.krb5_pac_sign">
 <a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_pac_sign</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, <a class="reference internal" href="../types/krb5_pac.html#c.krb5_pac" title="krb5_pac">krb5_pac</a><em>&nbsp;pac</em>, <a class="reference internal" href="../types/krb5_timestamp.html#c.krb5_timestamp" title="krb5_timestamp">krb5_timestamp</a><em>&nbsp;authtime</em>, <a class="reference internal" href="../types/krb5_const_principal.html#c.krb5_const_principal" title="krb5_const_principal">krb5_const_principal</a><em>&nbsp;principal</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;server_key</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;privsvr_key</em>, <a class="reference internal" href="../types/krb5_data.html#c.krb5_data" title="krb5_data">krb5_data</a> *<em>&nbsp;data</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_pac_sign" title="Permalink to this definition">¶</a></dt>
@@ -72,22 +72,18 @@
 <col class="field-name" />
 <col class="field-body" />
 <tbody valign="top">
-<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
-<p><strong>in</strong> <strong>pac</strong> - PAC handle</p>
-<p><strong>in</strong> <strong>authtime</strong> - Expected timestamp</p>
-<p><strong>in</strong> <strong>principal</strong> - Expected principal name (or NULL)</p>
-<p><strong>in</strong> <strong>server_key</strong> - Key for server checksum</p>
-<p><strong>in</strong> <strong>privsvr_key</strong> - Key for KDC checksum</p>
-<p class="last"><strong>out</strong> <strong>data</strong> - Signed PAC encoding</p>
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>context</strong></p>
+<p><strong>pac</strong></p>
+<p><strong>authtime</strong></p>
+<p><strong>principal</strong></p>
+<p><strong>server_key</strong></p>
+<p><strong>privsvr_key</strong></p>
+<p class="last"><strong>data</strong></p>
 </td>
 </tr>
 </tbody>
 </table>
-<p>This function signs <em>pac</em> using the keys <em>server_key</em> and <em>privsvr_key</em> and returns the signed encoding in <em>data</em> . <em>pac</em> is modified to include the server and KDC checksum buffers. Use <a class="reference internal" href="krb5_free_data_contents.html#c.krb5_free_data_contents" title="krb5_free_data_contents"><code class="xref c c-func docutils literal"><span class="pre">krb5_free_data_contents()</span></code></a> to free <em>data</em> when it is no longer needed.</p>
-<div class="admonition note">
-<p class="first admonition-title">Note</p>
-<p class="last">New in 1.10</p>
-</div>
+<p>DEPRECATED Use krb5_kdc_sign_ticket() instead.</p>
 </div>
 
 
@@ -98,7 +94,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">krb5_pac_sign -  Sign a PAC.</a></li>
+<li><a class="reference internal" href="#">krb5_pac_sign</a></li>
 </ul>
 
     <br/>
@@ -146,8 +142,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -155,13 +151,13 @@
             >Contents</a> |
         <a href="krb5_pac_parse.html" title="krb5_pac_parse - Unparse an encoded PAC into a new handle."
             >previous</a> |
-        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext - Sign a PAC, possibly with a specified realm."
+        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign -  Sign a PAC.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_sign_ext.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_sign_ext.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>krb5_pac_sign_ext - Sign a PAC, possibly with a specified realm. &#8212; MIT Kerberos Documentation</title>
+    <title>krb5_pac_sign_ext &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_pac_verify - Verify a PAC." href="krb5_pac_verify.html" />
-    <link rel="prev" title="krb5_pac_sign - Sign a PAC." href="krb5_pac_sign.html" /> 
+    <link rel="prev" title="krb5_pac_sign" href="krb5_pac_sign.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_pac_sign.html" title="krb5_pac_sign - Sign a PAC."
+        <a href="krb5_pac_sign.html" title="krb5_pac_sign"
             accesskey="P">previous</a> |
         <a href="krb5_pac_verify.html" title="krb5_pac_verify - Verify a PAC."
             accesskey="N">next</a> |
@@ -48,7 +48,7 @@
             accesskey="I">index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign_ext -  Sign a PAC, possibly with a specified realm.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign_ext">feedback</a>
             </div>
         </div>
     </div>
@@ -61,8 +61,8 @@
         <div class="bodywrapper">
           <div class="body" role="main">
             
-  <div class="section" id="krb5-pac-sign-ext-sign-a-pac-possibly-with-a-specified-realm">
-<h1>krb5_pac_sign_ext -  Sign a PAC, possibly with a specified realm.<a class="headerlink" href="#krb5-pac-sign-ext-sign-a-pac-possibly-with-a-specified-realm" title="Permalink to this headline">¶</a></h1>
+  <div class="section" id="krb5-pac-sign-ext">
+<h1>krb5_pac_sign_ext<a class="headerlink" href="#krb5-pac-sign-ext" title="Permalink to this headline">¶</a></h1>
 <dl class="function">
 <dt id="c.krb5_pac_sign_ext">
 <a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_pac_sign_ext</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, <a class="reference internal" href="../types/krb5_pac.html#c.krb5_pac" title="krb5_pac">krb5_pac</a><em>&nbsp;pac</em>, <a class="reference internal" href="../types/krb5_timestamp.html#c.krb5_timestamp" title="krb5_timestamp">krb5_timestamp</a><em>&nbsp;authtime</em>, <a class="reference internal" href="../types/krb5_const_principal.html#c.krb5_const_principal" title="krb5_const_principal">krb5_const_principal</a><em>&nbsp;principal</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;server_key</em>, const <a class="reference internal" href="../types/krb5_keyblock.html#c.krb5_keyblock" title="krb5_keyblock">krb5_keyblock</a> *<em>&nbsp;privsvr_key</em>, <a class="reference internal" href="../types/krb5_boolean.html#c.krb5_boolean" title="krb5_boolean">krb5_boolean</a><em>&nbsp;with_realm</em>, <a class="reference internal" href="../types/krb5_data.html#c.krb5_data" title="krb5_data">krb5_data</a> *<em>&nbsp;data</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_pac_sign_ext" title="Permalink to this definition">¶</a></dt>
@@ -72,23 +72,19 @@
 <col class="field-name" />
 <col class="field-body" />
 <tbody valign="top">
-<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
-<p><strong>in</strong> <strong>pac</strong> - PAC handle</p>
-<p><strong>in</strong> <strong>authtime</strong> - Expected timestamp</p>
-<p><strong>in</strong> <strong>principal</strong> - Principal name (or NULL)</p>
-<p><strong>in</strong> <strong>server_key</strong> - Key for server checksum</p>
-<p><strong>in</strong> <strong>privsvr_key</strong> - Key for KDC checksum</p>
-<p><strong>in</strong> <strong>with_realm</strong> - If true, include the realm of <em>principal</em></p>
-<p class="last"><strong>out</strong> <strong>data</strong> - Signed PAC encoding</p>
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>context</strong></p>
+<p><strong>pac</strong></p>
+<p><strong>authtime</strong></p>
+<p><strong>principal</strong></p>
+<p><strong>server_key</strong></p>
+<p><strong>privsvr_key</strong></p>
+<p><strong>with_realm</strong></p>
+<p class="last"><strong>data</strong></p>
 </td>
 </tr>
 </tbody>
 </table>
-<p>This function is similar to <a class="reference internal" href="krb5_pac_sign.html#c.krb5_pac_sign" title="krb5_pac_sign"><code class="xref c c-func docutils literal"><span class="pre">krb5_pac_sign()</span></code></a> , but adds a parameter <em>with_realm</em> . If <em>with_realm</em> is true, the PAC_CLIENT_INFO field of the signed PAC will include the realm of <em>principal</em> as well as the name. This flag is necessary to generate PACs for cross-realm S4U2Self referrals.</p>
-<div class="admonition note">
-<p class="first admonition-title">Note</p>
-<p class="last">New in 1.17</p>
-</div>
+<p>DEPRECATED Use krb5_kdc_sign_ticket() instead.</p>
 </div>
 
 
@@ -99,7 +95,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">krb5_pac_sign_ext -  Sign a PAC, possibly with a specified realm.</a></li>
+<li><a class="reference internal" href="#">krb5_pac_sign_ext</a></li>
 </ul>
 
     <br/>
@@ -147,14 +143,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_pac_sign.html" title="krb5_pac_sign - Sign a PAC."
+        <a href="krb5_pac_sign.html" title="krb5_pac_sign"
             >previous</a> |
         <a href="krb5_pac_verify.html" title="krb5_pac_verify - Verify a PAC."
             >next</a> |
@@ -162,7 +158,7 @@
             >index</a> |
         <a href="../../../search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign_ext -  Sign a PAC, possibly with a specified realm.">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_pac_sign_ext">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_verify.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_verify.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_pac_verify_ext - Verify a PAC, possibly from a specified realm." href="krb5_pac_verify_ext.html" />
-    <link rel="prev" title="krb5_pac_sign_ext - Sign a PAC, possibly with a specified realm." href="krb5_pac_sign_ext.html" /> 
+    <link rel="prev" title="krb5_pac_sign_ext" href="krb5_pac_sign_ext.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext - Sign a PAC, possibly with a specified realm."
+        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext"
             accesskey="P">previous</a> |
         <a href="krb5_pac_verify_ext.html" title="krb5_pac_verify_ext - Verify a PAC, possibly from a specified realm."
             accesskey="N">next</a> |
@@ -157,14 +157,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext - Sign a PAC, possibly with a specified realm."
+        <a href="krb5_pac_sign_ext.html" title="krb5_pac_sign_ext"
             >previous</a> |
         <a href="krb5_pac_verify_ext.html" title="krb5_pac_verify_ext - Verify a PAC, possibly from a specified realm."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_pac_verify_ext.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_pac_verify_ext.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_pac_get_client_info" href="krb5_pac_get_client_info.html" />
+    <link rel="next" title="krb5_pac_get_client_info - Read client information from a PAC." href="krb5_pac_get_client_info.html" />
     <link rel="prev" title="krb5_pac_verify - Verify a PAC." href="krb5_pac_verify.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_pac_verify.html" title="krb5_pac_verify - Verify a PAC."
             accesskey="P">previous</a> |
-        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info"
+        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info - Read client information from a PAC."
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -146,8 +146,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -155,7 +155,7 @@
             >Contents</a> |
         <a href="krb5_pac_verify.html" title="krb5_pac_verify - Verify a PAC."
             >previous</a> |
-        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info"
+        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info - Read client information from a PAC."
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_parse_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_parse_name.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -98,6 +98,7 @@
 <p>Convert a string representation of a principal name to a krb5_principal structure.</p>
 <p>A string representation of a Kerberos name consists of one or more principal name components, separated by slashes, optionally followed by the &#64; character and a realm name. If the realm name is not specified, the local realm is used.</p>
 <p>To use the slash and &#64; symbols as part of a component (quoted) instead of using them as a component separator or as a realm prefix), put a backslash () character in front of the symbol. Similarly, newline, tab, backspace, and NULL characters can be included in a component by using <strong>n</strong> , <strong>t</strong> , <strong>b</strong> or <strong>0</strong> , respectively.</p>
+<p>Beginning with release 1.20, the name type of the principal will be inferred as <strong>KRB5_NT_SRV_INST</strong> or <strong>KRB5_NT_WELLKNOWN</strong> based on the principal name. The type will be <strong>KRB5_NT_PRINCIPAL</strong> if a type cannot be inferred.</p>
 <p>Use <a class="reference internal" href="krb5_free_principal.html#c.krb5_free_principal" title="krb5_free_principal"><code class="xref c c-func docutils literal"><span class="pre">krb5_free_principal()</span></code></a> to free <em>principal_out</em> when it is no longer needed.</p>
 <div class="admonition note">
 <p class="first admonition-title">Note</p>
@@ -161,8 +162,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_parse_name_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_parse_name_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_prepend_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_prepend_error_message.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_principal2salt - Convert a principal name into the default salt for that principal." href="krb5_principal2salt.html" />
-    <link rel="prev" title="krb5_pac_get_client_info" href="krb5_pac_get_client_info.html" /> 
+    <link rel="prev" title="krb5_pac_get_client_info - Read client information from a PAC." href="krb5_pac_get_client_info.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info"
+        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info - Read client information from a PAC."
             accesskey="P">previous</a> |
         <a href="krb5_principal2salt.html" title="krb5_principal2salt - Convert a principal name into the default salt for that principal."
             accesskey="N">next</a> |
@@ -138,14 +138,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info"
+        <a href="krb5_pac_get_client_info.html" title="krb5_pac_get_client_info - Read client information from a PAC."
             >previous</a> |
         <a href="krb5_principal2salt.html" title="krb5_principal2salt - Convert a principal name into the default salt for that principal."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_principal2salt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_principal2salt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_principal_compare.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_principal_compare.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_principal_compare_any_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_principal_compare_any_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_principal_compare_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_principal_compare_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_process_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_process_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_prompter_posix.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_prompter_posix.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_random_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_random_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_rd_cred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_rd_cred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_rd_error.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_rd_error.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_rd_priv.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_rd_priv.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_rd_rep.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_rd_rep.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_rd_rep_dce.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_rd_rep_dce.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_rd_req.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_rd_req.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_rd_safe.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_rd_safe.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_read_password.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_read_password.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_realm_compare.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_realm_compare.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_recvauth.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_recvauth.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_recvauth_version.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_recvauth_version.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_get_challenge.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_get_challenge.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_list_questions.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_list_questions.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_otp_challenge_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_otp_challenge_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_otp_get_challenge.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_otp_get_challenge.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_otp_set_answer.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_otp_set_answer.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_pkinit_challenge_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_pkinit_challenge_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_pkinit_get_challenge.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_pkinit_get_challenge.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_pkinit_set_answer.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_pkinit_set_answer.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_responder_set_answer.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_responder_set_answer.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_salttype_to_string.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_salttype_to_string.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_sendauth.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_sendauth.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_server_decrypt_ticket_keytab.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_server_decrypt_ticket_keytab.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_default_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_default_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_default_tgs_enctypes.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_default_tgs_enctypes.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_kdc_recv_hook.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_kdc_recv_hook.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_kdc_send_hook.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_kdc_send_hook.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_password.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_password.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_password_using_ccache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_password_using_ccache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_principal_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_principal_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_real_time.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_real_time.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_trace_callback.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_trace_callback.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_set_trace_filename.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_set_trace_filename.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_sname_match.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_sname_match.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_sname_to_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_sname_to_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_string_to_cksumtype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_string_to_cksumtype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_string_to_deltat.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_string_to_deltat.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_string_to_enctype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_string_to_enctype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_string_to_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_string_to_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_string_to_salttype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_string_to_salttype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_string_to_timestamp.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_string_to_timestamp.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_timeofday.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_timeofday.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_timestamp_to_sfstring.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_timestamp_to_sfstring.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_timestamp_to_string.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_timestamp_to_string.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_free.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_free.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_get.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_get.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_get_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_get_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_get_times.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_get_times.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_init.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_init.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_step.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_tkt_creds_step.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="krb5_verify_init_creds - Verify initial credentials against a keytab." href="krb5_verify_init_creds.html" />
+    <link rel="next" title="krb5_unmarshal_credentials - Deserialize a krb5_creds object." href="krb5_unmarshal_credentials.html" />
     <link rel="prev" title="krb5_tkt_creds_init - Create a context to get credentials from a KDC’s Ticket Granting Service." href="krb5_tkt_creds_init.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="krb5_tkt_creds_init.html" title="krb5_tkt_creds_init - Create a context to get credentials from a KDC’s Ticket Granting Service."
             accesskey="P">previous</a> |
-        <a href="krb5_verify_init_creds.html" title="krb5_verify_init_creds - Verify initial credentials against a keytab."
+        <a href="krb5_unmarshal_credentials.html" title="krb5_unmarshal_credentials - Deserialize a krb5_creds object."
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -158,8 +158,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -167,7 +167,7 @@
             >Contents</a> |
         <a href="krb5_tkt_creds_init.html" title="krb5_tkt_creds_init - Create a context to get credentials from a KDC’s Ticket Granting Service."
             >previous</a> |
-        <a href="krb5_verify_init_creds.html" title="krb5_verify_init_creds - Verify initial credentials against a keytab."
+        <a href="krb5_unmarshal_credentials.html" title="krb5_unmarshal_credentials - Deserialize a krb5_creds object."
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_unmarshal_credentials.html Added

@@ -0,0 +1,174 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>krb5_unmarshal_credentials - Deserialize a krb5_creds object. &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="krb5_verify_init_creds - Verify initial credentials against a keytab." href="krb5_verify_init_creds.html" />
+    <link rel="prev" title="krb5_tkt_creds_step - Get the next KDC request in a TGS exchange." href="krb5_tkt_creds_step.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="krb5_tkt_creds_step.html" title="krb5_tkt_creds_step - Get the next KDC request in a TGS exchange."
+            accesskey="P">previous</a> |
+        <a href="krb5_verify_init_creds.html" title="krb5_verify_init_creds - Verify initial credentials against a keytab."
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_unmarshal_credentials -  Deserialize a krb5_creds object.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-unmarshal-credentials-deserialize-a-krb5-creds-object">
+<h1>krb5_unmarshal_credentials -  Deserialize a krb5_creds object.<a class="headerlink" href="#krb5-unmarshal-credentials-deserialize-a-krb5-creds-object" title="Permalink to this headline">¶</a></h1>
+<dl class="function">
+<dt id="c.krb5_unmarshal_credentials">
+<a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <code class="descname">krb5_unmarshal_credentials</code><span class="sig-paren">(</span><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, const <a class="reference internal" href="../types/krb5_data.html#c.krb5_data" title="krb5_data">krb5_data</a> *<em>&nbsp;data</em>, <a class="reference internal" href="../types/krb5_creds.html#c.krb5_creds" title="krb5_creds">krb5_creds</a> **<em>&nbsp;creds_out</em><span class="sig-paren">)</span><a class="headerlink" href="#c.krb5_unmarshal_credentials" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>in</strong> <strong>context</strong> - Library context</p>
+<p><strong>in</strong> <strong>data</strong> - The serialized credentials</p>
+<p class="last"><strong>out</strong> <strong>creds_out</strong> - The resulting creds object</p>
+</td>
+</tr>
+</tbody>
+</table>
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
+<li>0   Success; otherwise - Kerberos error codes</li>
+</ul>
+</td>
+</tr>
+</tbody>
+</table>
+<p>Deserialize <em>data</em> to credentials in the format used by the FILE ccache format (vesion 4) and KCM ccache protocol.</p>
+<p>Use <a class="reference internal" href="krb5_free_creds.html#c.krb5_free_creds" title="krb5_free_creds"><code class="xref c c-func docutils literal"><span class="pre">krb5_free_creds()</span></code></a> to free <em>creds_out</em> when it is no longer needed.</p>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">krb5_unmarshal_credentials -  Deserialize a krb5_creds object.</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../macros/index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="krb5_tkt_creds_step.html" title="krb5_tkt_creds_step - Get the next KDC request in a TGS exchange."
+            >previous</a> |
+        <a href="krb5_verify_init_creds.html" title="krb5_verify_init_creds - Verify initial credentials against a keytab."
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_unmarshal_credentials -  Deserialize a krb5_creds object.">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name_ext.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name_ext.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name_flags_ext.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_unparse_name_flags_ext.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_us_timeofday.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_us_timeofday.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_use_enctype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_use_enctype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_verify_authdata_kdc_issued.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_verify_authdata_kdc_issued.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_verify_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_verify_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_verify_init_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_verify_init_creds.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="krb5_verify_init_creds_opt_init - Initialize a credential verification options structure." href="krb5_verify_init_creds_opt_init.html" />
-    <link rel="prev" title="krb5_tkt_creds_step - Get the next KDC request in a TGS exchange." href="krb5_tkt_creds_step.html" /> 
+    <link rel="prev" title="krb5_unmarshal_credentials - Deserialize a krb5_creds object." href="krb5_unmarshal_credentials.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="krb5_tkt_creds_step.html" title="krb5_tkt_creds_step - Get the next KDC request in a TGS exchange."
+        <a href="krb5_unmarshal_credentials.html" title="krb5_unmarshal_credentials - Deserialize a krb5_creds object."
             accesskey="P">previous</a> |
         <a href="krb5_verify_init_creds_opt_init.html" title="krb5_verify_init_creds_opt_init - Initialize a credential verification options structure."
             accesskey="N">next</a> |
@@ -154,14 +154,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="krb5_tkt_creds_step.html" title="krb5_tkt_creds_step - Get the next KDC request in a TGS exchange."
+        <a href="krb5_unmarshal_credentials.html" title="krb5_unmarshal_credentials - Deserialize a krb5_creds object."
             >previous</a> |
         <a href="krb5_verify_init_creds_opt_init.html" title="krb5_verify_init_creds_opt_init - Initialize a credential verification options structure."
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_verify_init_creds_opt_init.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_verify_init_creds_opt_init.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_vprepend_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_vprepend_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_vset_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_vset_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_vwrap_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_vwrap_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/api/krb5_wrap_error_message.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/api/krb5_wrap_error_message.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_ADDRPORT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_ADDRPORT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_CHAOS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_CHAOS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_DDP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_DDP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_INET.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_INET.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_INET6.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_INET6.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_IPPORT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_IPPORT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_ISO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_ISO.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_IS_LOCAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_IS_LOCAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_NETBIOS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_NETBIOS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_XNS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ADDRTYPE_XNS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_EXTERNAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_EXTERNAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_REGISTERED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_REGISTERED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_RESERVED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AD_TYPE_RESERVED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_RESERVED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_RESERVED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_USE_SESSION_KEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_USE_SESSION_KEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_USE_SUBKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_USE_SUBKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_WIRE_MASK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/AP_OPTS_WIRE_MASK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_CRC32.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_CRC32.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_DESCBC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_DESCBC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_NIST_SHA.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_NIST_SHA.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD4.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD4.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD5.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD5.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="ENCTYPE_AES128_CTS_HMAC_SHA1_96" href="ENCTYPE_AES128_CTS_HMAC_SHA1_96.html" />
+    <link rel="next" title="CKSUMTYPE_SHA1" href="CKSUMTYPE_SHA1.html" />
     <link rel="prev" title="CKSUMTYPE_RSA_MD5" href="CKSUMTYPE_RSA_MD5.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="CKSUMTYPE_RSA_MD5.html" title="CKSUMTYPE_RSA_MD5"
             accesskey="P">previous</a> |
-        <a href="ENCTYPE_AES128_CTS_HMAC_SHA1_96.html" title="ENCTYPE_AES128_CTS_HMAC_SHA1_96"
+        <a href="CKSUMTYPE_SHA1.html" title="CKSUMTYPE_SHA1"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -137,8 +137,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -146,7 +146,7 @@
             >Contents</a> |
         <a href="CKSUMTYPE_RSA_MD5.html" title="CKSUMTYPE_RSA_MD5"
             >previous</a> |
-        <a href="ENCTYPE_AES128_CTS_HMAC_SHA1_96.html" title="ENCTYPE_AES128_CTS_HMAC_SHA1_96"
+        <a href="CKSUMTYPE_SHA1.html" title="CKSUMTYPE_SHA1"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/CKSUMTYPE_SHA1.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>CKSUMTYPE_SHA1 &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="ENCTYPE_AES128_CTS_HMAC_SHA1_96" href="ENCTYPE_AES128_CTS_HMAC_SHA1_96.html" />
+    <link rel="prev" title="CKSUMTYPE_RSA_MD5_DES" href="CKSUMTYPE_RSA_MD5_DES.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="CKSUMTYPE_RSA_MD5_DES.html" title="CKSUMTYPE_RSA_MD5_DES"
+            accesskey="P">previous</a> |
+        <a href="ENCTYPE_AES128_CTS_HMAC_SHA1_96.html" title="ENCTYPE_AES128_CTS_HMAC_SHA1_96"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__CKSUMTYPE_SHA1">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="cksumtype-sha1">
+<span id="cksumtype-sha1-data"></span><h1>CKSUMTYPE_SHA1<a class="headerlink" href="#cksumtype-sha1" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="CKSUMTYPE_SHA1">
+<code class="descname">CKSUMTYPE_SHA1</code><a class="headerlink" href="#CKSUMTYPE_SHA1" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>RFC 3961.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="49%" />
+<col width="51%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">CKSUMTYPE_SHA1</span></code></td>
+<td><code class="docutils literal"><span class="pre">0x000e</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">CKSUMTYPE_SHA1</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="CKSUMTYPE_RSA_MD5_DES.html" title="CKSUMTYPE_RSA_MD5_DES"
+            >previous</a> |
+        <a href="ENCTYPE_AES128_CTS_HMAC_SHA1_96.html" title="ENCTYPE_AES128_CTS_HMAC_SHA1_96"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__CKSUMTYPE_SHA1">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="ENCTYPE_AES128_CTS_HMAC_SHA256_128" href="ENCTYPE_AES128_CTS_HMAC_SHA256_128.html" />
-    <link rel="prev" title="CKSUMTYPE_RSA_MD5_DES" href="CKSUMTYPE_RSA_MD5_DES.html" /> 
+    <link rel="prev" title="CKSUMTYPE_SHA1" href="CKSUMTYPE_SHA1.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="CKSUMTYPE_RSA_MD5_DES.html" title="CKSUMTYPE_RSA_MD5_DES"
+        <a href="CKSUMTYPE_SHA1.html" title="CKSUMTYPE_SHA1"
             accesskey="P">previous</a> |
         <a href="ENCTYPE_AES128_CTS_HMAC_SHA256_128.html" title="ENCTYPE_AES128_CTS_HMAC_SHA256_128"
             accesskey="N">next</a> |
@@ -138,14 +138,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="CKSUMTYPE_RSA_MD5_DES.html" title="CKSUMTYPE_RSA_MD5_DES"
+        <a href="CKSUMTYPE_SHA1.html" title="CKSUMTYPE_SHA1"
             >previous</a> |
         <a href="ENCTYPE_AES128_CTS_HMAC_SHA256_128.html" title="ENCTYPE_AES128_CTS_HMAC_SHA256_128"
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_ENV.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_ENV.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_RAW.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_RAW.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_SHA.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_SHA.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_CRC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_CRC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_MD4.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_MD4.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_MD5.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_MD5.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_RAW.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_CBC_RAW.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_MD5_RSA_CMS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_MD5_RSA_CMS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_NULL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_NULL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_RC2_CBC_ENV.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_RC2_CBC_ENV.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_RSA_ENV.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_RSA_ENV.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_UNKNOWN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/ENCTYPE_UNKNOWN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_CANONICALIZE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_CANONICALIZE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_FORWARDABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_FORWARDABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_FORWARDED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_FORWARDED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_POSTDATED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_POSTDATED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_PROXIABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_PROXIABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_PROXY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_PROXY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_RENEW.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_RENEW.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_RENEWABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_RENEWABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_RENEWABLE_OK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_RENEWABLE_OK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_VALIDATE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_OPT_VALIDATE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KDC_TKT_COMMON_MASK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KDC_TKT_COMMON_MASK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AP_REP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AP_REP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AP_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AP_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AS_REP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AS_REP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AS_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AS_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_AND_OR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_AND_OR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_CAMMAC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_CAMMAC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_SESAME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_SESAME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -68,7 +68,6 @@
 <code class="descname">KRB5_AUTHDATA_SIGNTICKET</code><a class="headerlink" href="#KRB5_AUTHDATA_SIGNTICKET" title="Permalink to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<p>formerly 142 in krb5 1.8</p>
 <table border="1" class="docutils">
 <colgroup>
 <col width="58%" />
@@ -138,8 +137,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_CYBERSAFE_SECUREID.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_CYBERSAFE_SECUREID.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_ERROR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_ERROR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_FAST_REQUIRED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_FAST_REQUIRED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_CACHED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_CACHED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_CANONICALIZE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_CANONICALIZE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_FORWARDABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_FORWARDABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_NO_STORE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_NO_STORE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_USER_USER.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GC_USER_USER.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_INIT_CONTEXT_KDC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_INIT_CONTEXT_KDC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_INT16_MAX.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_INT16_MAX.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_INT16_MIN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_INT16_MIN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_INT32_MAX.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_INT32_MAX.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_INT32_MIN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_INT32_MIN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_SPAKE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_SPAKE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_AUTHERROR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_AUTHERROR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_HARDERROR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_HARDERROR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_MALFORMED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_MALFORMED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_SOFTERROR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_SOFTERROR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_SUCCESS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_KPASSWD_SUCCESS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_NONE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_NONE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_MS_PRINCIPAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_MS_PRINCIPAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_PRINCIPAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_PRINCIPAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SMTP_NAME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SMTP_NAME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SRV_HST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SRV_HST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SRV_INST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SRV_INST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SRV_XHST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_SRV_XHST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_UID.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_UID.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_UNKNOWN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_UNKNOWN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_WELLKNOWN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_WELLKNOWN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_X500_PRINCIPAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_NT_X500_PRINCIPAL.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="KRB5_PAC_CLIENT_INFO" href="KRB5_PAC_CLIENT_INFO.html" />
+    <link rel="next" title="KRB5_PAC_ATTRIBUTES_INFO" href="KRB5_PAC_ATTRIBUTES_INFO.html" />
     <link rel="prev" title="KRB5_NT_WELLKNOWN" href="KRB5_NT_WELLKNOWN.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="KRB5_NT_WELLKNOWN.html" title="KRB5_NT_WELLKNOWN"
             accesskey="P">previous</a> |
-        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+        <a href="KRB5_PAC_ATTRIBUTES_INFO.html" title="KRB5_PAC_ATTRIBUTES_INFO"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -138,8 +138,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -147,7 +147,7 @@
             >Contents</a> |
         <a href="KRB5_NT_WELLKNOWN.html" title="KRB5_NT_WELLKNOWN"
             >previous</a> |
-        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+        <a href="KRB5_PAC_ATTRIBUTES_INFO.html" title="KRB5_PAC_ATTRIBUTES_INFO"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>KRB5_PAC_ATTRIBUTES_INFO &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="KRB5_PAC_CLIENT_INFO" href="KRB5_PAC_CLIENT_INFO.html" />
+    <link rel="prev" title="KRB5_NT_X500_PRINCIPAL" href="KRB5_NT_X500_PRINCIPAL.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="KRB5_NT_X500_PRINCIPAL.html" title="KRB5_NT_X500_PRINCIPAL"
+            accesskey="P">previous</a> |
+        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_ATTRIBUTES_INFO">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-pac-attributes-info">
+<span id="krb5-pac-attributes-info-data"></span><h1>KRB5_PAC_ATTRIBUTES_INFO<a class="headerlink" href="#krb5-pac-attributes-info" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="KRB5_PAC_ATTRIBUTES_INFO">
+<code class="descname">KRB5_PAC_ATTRIBUTES_INFO</code><a class="headerlink" href="#KRB5_PAC_ATTRIBUTES_INFO" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>PAC attributes.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="58%" />
+<col width="42%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">KRB5_PAC_ATTRIBUTES_INFO</span></code></td>
+<td><code class="docutils literal"><span class="pre">17</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">KRB5_PAC_ATTRIBUTES_INFO</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="KRB5_NT_X500_PRINCIPAL.html" title="KRB5_NT_X500_PRINCIPAL"
+            >previous</a> |
+        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_ATTRIBUTES_INFO">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>KRB5_PAC_CLIENT_CLAIMS &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="KRB5_PAC_CREDENTIALS_INFO" href="KRB5_PAC_CREDENTIALS_INFO.html" />
+    <link rel="prev" title="KRB5_PAC_CLIENT_INFO" href="KRB5_PAC_CLIENT_INFO.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+            accesskey="P">previous</a> |
+        <a href="KRB5_PAC_CREDENTIALS_INFO.html" title="KRB5_PAC_CREDENTIALS_INFO"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_CLIENT_CLAIMS">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-pac-client-claims">
+<span id="krb5-pac-client-claims-data"></span><h1>KRB5_PAC_CLIENT_CLAIMS<a class="headerlink" href="#krb5-pac-client-claims" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="KRB5_PAC_CLIENT_CLAIMS">
+<code class="descname">KRB5_PAC_CLIENT_CLAIMS</code><a class="headerlink" href="#KRB5_PAC_CLIENT_CLAIMS" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>Client claims information.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="57%" />
+<col width="43%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">KRB5_PAC_CLIENT_CLAIMS</span></code></td>
+<td><code class="docutils literal"><span class="pre">13</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">KRB5_PAC_CLIENT_CLAIMS</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+            >previous</a> |
+        <a href="KRB5_PAC_CREDENTIALS_INFO.html" title="KRB5_PAC_CREDENTIALS_INFO"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_CLIENT_CLAIMS">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_CLIENT_INFO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_CLIENT_INFO.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,8 +26,8 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="KRB5_PAC_CREDENTIALS_INFO" href="KRB5_PAC_CREDENTIALS_INFO.html" />
-    <link rel="prev" title="KRB5_NT_X500_PRINCIPAL" href="KRB5_NT_X500_PRINCIPAL.html" /> 
+    <link rel="next" title="KRB5_PAC_CLIENT_CLAIMS" href="KRB5_PAC_CLIENT_CLAIMS.html" />
+    <link rel="prev" title="KRB5_PAC_ATTRIBUTES_INFO" href="KRB5_PAC_ATTRIBUTES_INFO.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,9 +40,9 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="KRB5_NT_X500_PRINCIPAL.html" title="KRB5_NT_X500_PRINCIPAL"
+        <a href="KRB5_PAC_ATTRIBUTES_INFO.html" title="KRB5_PAC_ATTRIBUTES_INFO"
             accesskey="P">previous</a> |
-        <a href="KRB5_PAC_CREDENTIALS_INFO.html" title="KRB5_PAC_CREDENTIALS_INFO"
+        <a href="KRB5_PAC_CLIENT_CLAIMS.html" title="KRB5_PAC_CLIENT_CLAIMS"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -138,16 +138,16 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="KRB5_NT_X500_PRINCIPAL.html" title="KRB5_NT_X500_PRINCIPAL"
+        <a href="KRB5_PAC_ATTRIBUTES_INFO.html" title="KRB5_PAC_ATTRIBUTES_INFO"
             >previous</a> |
-        <a href="KRB5_PAC_CREDENTIALS_INFO.html" title="KRB5_PAC_CREDENTIALS_INFO"
+        <a href="KRB5_PAC_CLIENT_CLAIMS.html" title="KRB5_PAC_CLIENT_CLAIMS"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="KRB5_PAC_DELEGATION_INFO" href="KRB5_PAC_DELEGATION_INFO.html" />
-    <link rel="prev" title="KRB5_PAC_CLIENT_INFO" href="KRB5_PAC_CLIENT_INFO.html" /> 
+    <link rel="prev" title="KRB5_PAC_CLIENT_CLAIMS" href="KRB5_PAC_CLIENT_CLAIMS.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+        <a href="KRB5_PAC_CLIENT_CLAIMS.html" title="KRB5_PAC_CLIENT_CLAIMS"
             accesskey="P">previous</a> |
         <a href="KRB5_PAC_DELEGATION_INFO.html" title="KRB5_PAC_DELEGATION_INFO"
             accesskey="N">next</a> |
@@ -138,14 +138,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="KRB5_PAC_CLIENT_INFO.html" title="KRB5_PAC_CLIENT_INFO"
+        <a href="KRB5_PAC_CLIENT_CLAIMS.html" title="KRB5_PAC_CLIENT_CLAIMS"
             >previous</a> |
         <a href="KRB5_PAC_DELEGATION_INFO.html" title="KRB5_PAC_DELEGATION_INFO"
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_DELEGATION_INFO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_DELEGATION_INFO.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="KRB5_PAC_LOGON_INFO" href="KRB5_PAC_LOGON_INFO.html" />
+    <link rel="next" title="KRB5_PAC_DEVICE_CLAIMS" href="KRB5_PAC_DEVICE_CLAIMS.html" />
     <link rel="prev" title="KRB5_PAC_CREDENTIALS_INFO" href="KRB5_PAC_CREDENTIALS_INFO.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="KRB5_PAC_CREDENTIALS_INFO.html" title="KRB5_PAC_CREDENTIALS_INFO"
             accesskey="P">previous</a> |
-        <a href="KRB5_PAC_LOGON_INFO.html" title="KRB5_PAC_LOGON_INFO"
+        <a href="KRB5_PAC_DEVICE_CLAIMS.html" title="KRB5_PAC_DEVICE_CLAIMS"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -138,8 +138,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -147,7 +147,7 @@
             >Contents</a> |
         <a href="KRB5_PAC_CREDENTIALS_INFO.html" title="KRB5_PAC_CREDENTIALS_INFO"
             >previous</a> |
-        <a href="KRB5_PAC_LOGON_INFO.html" title="KRB5_PAC_LOGON_INFO"
+        <a href="KRB5_PAC_DEVICE_CLAIMS.html" title="KRB5_PAC_DEVICE_CLAIMS"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>KRB5_PAC_DEVICE_CLAIMS &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="KRB5_PAC_DEVICE_INFO" href="KRB5_PAC_DEVICE_INFO.html" />
+    <link rel="prev" title="KRB5_PAC_DELEGATION_INFO" href="KRB5_PAC_DELEGATION_INFO.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="KRB5_PAC_DELEGATION_INFO.html" title="KRB5_PAC_DELEGATION_INFO"
+            accesskey="P">previous</a> |
+        <a href="KRB5_PAC_DEVICE_INFO.html" title="KRB5_PAC_DEVICE_INFO"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_DEVICE_CLAIMS">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-pac-device-claims">
+<span id="krb5-pac-device-claims-data"></span><h1>KRB5_PAC_DEVICE_CLAIMS<a class="headerlink" href="#krb5-pac-device-claims" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="KRB5_PAC_DEVICE_CLAIMS">
+<code class="descname">KRB5_PAC_DEVICE_CLAIMS</code><a class="headerlink" href="#KRB5_PAC_DEVICE_CLAIMS" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>Device claims information.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="57%" />
+<col width="43%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">KRB5_PAC_DEVICE_CLAIMS</span></code></td>
+<td><code class="docutils literal"><span class="pre">15</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">KRB5_PAC_DEVICE_CLAIMS</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="KRB5_PAC_DELEGATION_INFO.html" title="KRB5_PAC_DELEGATION_INFO"
+            >previous</a> |
+        <a href="KRB5_PAC_DEVICE_INFO.html" title="KRB5_PAC_DEVICE_INFO"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_DEVICE_CLAIMS">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_DEVICE_INFO.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>KRB5_PAC_DEVICE_INFO &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="KRB5_PAC_LOGON_INFO" href="KRB5_PAC_LOGON_INFO.html" />
+    <link rel="prev" title="KRB5_PAC_DEVICE_CLAIMS" href="KRB5_PAC_DEVICE_CLAIMS.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="KRB5_PAC_DEVICE_CLAIMS.html" title="KRB5_PAC_DEVICE_CLAIMS"
+            accesskey="P">previous</a> |
+        <a href="KRB5_PAC_LOGON_INFO.html" title="KRB5_PAC_LOGON_INFO"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_DEVICE_INFO">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-pac-device-info">
+<span id="krb5-pac-device-info-data"></span><h1>KRB5_PAC_DEVICE_INFO<a class="headerlink" href="#krb5-pac-device-info" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="KRB5_PAC_DEVICE_INFO">
+<code class="descname">KRB5_PAC_DEVICE_INFO</code><a class="headerlink" href="#KRB5_PAC_DEVICE_INFO" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>Device information.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="55%" />
+<col width="45%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">KRB5_PAC_DEVICE_INFO</span></code></td>
+<td><code class="docutils literal"><span class="pre">14</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">KRB5_PAC_DEVICE_INFO</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="KRB5_PAC_DEVICE_CLAIMS.html" title="KRB5_PAC_DEVICE_CLAIMS"
+            >previous</a> |
+        <a href="KRB5_PAC_LOGON_INFO.html" title="KRB5_PAC_LOGON_INFO"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_DEVICE_INFO">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_LOGON_INFO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_LOGON_INFO.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="KRB5_PAC_PRIVSVR_CHECKSUM" href="KRB5_PAC_PRIVSVR_CHECKSUM.html" />
-    <link rel="prev" title="KRB5_PAC_DELEGATION_INFO" href="KRB5_PAC_DELEGATION_INFO.html" /> 
+    <link rel="prev" title="KRB5_PAC_DEVICE_INFO" href="KRB5_PAC_DEVICE_INFO.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="KRB5_PAC_DELEGATION_INFO.html" title="KRB5_PAC_DELEGATION_INFO"
+        <a href="KRB5_PAC_DEVICE_INFO.html" title="KRB5_PAC_DEVICE_INFO"
             accesskey="P">previous</a> |
         <a href="KRB5_PAC_PRIVSVR_CHECKSUM.html" title="KRB5_PAC_PRIVSVR_CHECKSUM"
             accesskey="N">next</a> |
@@ -138,14 +138,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="KRB5_PAC_DELEGATION_INFO.html" title="KRB5_PAC_DELEGATION_INFO"
+        <a href="KRB5_PAC_DEVICE_INFO.html" title="KRB5_PAC_DEVICE_INFO"
             >previous</a> |
         <a href="KRB5_PAC_PRIVSVR_CHECKSUM.html" title="KRB5_PAC_PRIVSVR_CHECKSUM"
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="KRB5_PAC_SERVER_CHECKSUM" href="KRB5_PAC_SERVER_CHECKSUM.html" />
+    <link rel="next" title="KRB5_PAC_REQUESTOR" href="KRB5_PAC_REQUESTOR.html" />
     <link rel="prev" title="KRB5_PAC_LOGON_INFO" href="KRB5_PAC_LOGON_INFO.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="KRB5_PAC_LOGON_INFO.html" title="KRB5_PAC_LOGON_INFO"
             accesskey="P">previous</a> |
-        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+        <a href="KRB5_PAC_REQUESTOR.html" title="KRB5_PAC_REQUESTOR"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -138,8 +138,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -147,7 +147,7 @@
             >Contents</a> |
         <a href="KRB5_PAC_LOGON_INFO.html" title="KRB5_PAC_LOGON_INFO"
             >previous</a> |
-        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+        <a href="KRB5_PAC_REQUESTOR.html" title="KRB5_PAC_REQUESTOR"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_REQUESTOR.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>KRB5_PAC_REQUESTOR &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="KRB5_PAC_SERVER_CHECKSUM" href="KRB5_PAC_SERVER_CHECKSUM.html" />
+    <link rel="prev" title="KRB5_PAC_PRIVSVR_CHECKSUM" href="KRB5_PAC_PRIVSVR_CHECKSUM.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="KRB5_PAC_PRIVSVR_CHECKSUM.html" title="KRB5_PAC_PRIVSVR_CHECKSUM"
+            accesskey="P">previous</a> |
+        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_REQUESTOR">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-pac-requestor">
+<span id="krb5-pac-requestor-data"></span><h1>KRB5_PAC_REQUESTOR<a class="headerlink" href="#krb5-pac-requestor" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="KRB5_PAC_REQUESTOR">
+<code class="descname">KRB5_PAC_REQUESTOR</code><a class="headerlink" href="#KRB5_PAC_REQUESTOR" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>PAC requestor SID.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="53%" />
+<col width="47%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">KRB5_PAC_REQUESTOR</span></code></td>
+<td><code class="docutils literal"><span class="pre">18</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">KRB5_PAC_REQUESTOR</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="KRB5_PAC_PRIVSVR_CHECKSUM.html" title="KRB5_PAC_PRIVSVR_CHECKSUM"
+            >previous</a> |
+        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_REQUESTOR">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,8 +26,8 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="KRB5_PAC_UPN_DNS_INFO" href="KRB5_PAC_UPN_DNS_INFO.html" />
-    <link rel="prev" title="KRB5_PAC_PRIVSVR_CHECKSUM" href="KRB5_PAC_PRIVSVR_CHECKSUM.html" /> 
+    <link rel="next" title="KRB5_PAC_TICKET_CHECKSUM" href="KRB5_PAC_TICKET_CHECKSUM.html" />
+    <link rel="prev" title="KRB5_PAC_REQUESTOR" href="KRB5_PAC_REQUESTOR.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,9 +40,9 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="KRB5_PAC_PRIVSVR_CHECKSUM.html" title="KRB5_PAC_PRIVSVR_CHECKSUM"
+        <a href="KRB5_PAC_REQUESTOR.html" title="KRB5_PAC_REQUESTOR"
             accesskey="P">previous</a> |
-        <a href="KRB5_PAC_UPN_DNS_INFO.html" title="KRB5_PAC_UPN_DNS_INFO"
+        <a href="KRB5_PAC_TICKET_CHECKSUM.html" title="KRB5_PAC_TICKET_CHECKSUM"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -138,16 +138,16 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="KRB5_PAC_PRIVSVR_CHECKSUM.html" title="KRB5_PAC_PRIVSVR_CHECKSUM"
+        <a href="KRB5_PAC_REQUESTOR.html" title="KRB5_PAC_REQUESTOR"
             >previous</a> |
-        <a href="KRB5_PAC_UPN_DNS_INFO.html" title="KRB5_PAC_UPN_DNS_INFO"
+        <a href="KRB5_PAC_TICKET_CHECKSUM.html" title="KRB5_PAC_TICKET_CHECKSUM"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>KRB5_PAC_TICKET_CHECKSUM &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="KRB5_PAC_UPN_DNS_INFO" href="KRB5_PAC_UPN_DNS_INFO.html" />
+    <link rel="prev" title="KRB5_PAC_SERVER_CHECKSUM" href="KRB5_PAC_SERVER_CHECKSUM.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+            accesskey="P">previous</a> |
+        <a href="KRB5_PAC_UPN_DNS_INFO.html" title="KRB5_PAC_UPN_DNS_INFO"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_TICKET_CHECKSUM">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-pac-ticket-checksum">
+<span id="krb5-pac-ticket-checksum-data"></span><h1>KRB5_PAC_TICKET_CHECKSUM<a class="headerlink" href="#krb5-pac-ticket-checksum" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="KRB5_PAC_TICKET_CHECKSUM">
+<code class="descname">KRB5_PAC_TICKET_CHECKSUM</code><a class="headerlink" href="#KRB5_PAC_TICKET_CHECKSUM" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>Ticket checksum.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="58%" />
+<col width="42%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">KRB5_PAC_TICKET_CHECKSUM</span></code></td>
+<td><code class="docutils literal"><span class="pre">16</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">KRB5_PAC_TICKET_CHECKSUM</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+            >previous</a> |
+        <a href="KRB5_PAC_UPN_DNS_INFO.html" title="KRB5_PAC_UPN_DNS_INFO"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PAC_TICKET_CHECKSUM">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="KRB5_PADATA_AFS3_SALT" href="KRB5_PADATA_AFS3_SALT.html" />
-    <link rel="prev" title="KRB5_PAC_SERVER_CHECKSUM" href="KRB5_PAC_SERVER_CHECKSUM.html" /> 
+    <link rel="prev" title="KRB5_PAC_TICKET_CHECKSUM" href="KRB5_PAC_TICKET_CHECKSUM.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+        <a href="KRB5_PAC_TICKET_CHECKSUM.html" title="KRB5_PAC_TICKET_CHECKSUM"
             accesskey="P">previous</a> |
         <a href="KRB5_PADATA_AFS3_SALT.html" title="KRB5_PADATA_AFS3_SALT"
             accesskey="N">next</a> |
@@ -138,14 +138,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="KRB5_PAC_SERVER_CHECKSUM.html" title="KRB5_PAC_SERVER_CHECKSUM"
+        <a href="KRB5_PAC_TICKET_CHECKSUM.html" title="KRB5_PAC_TICKET_CHECKSUM"
             >previous</a> |
         <a href="KRB5_PADATA_AFS3_SALT.html" title="KRB5_PADATA_AFS3_SALT"
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AFS3_SALT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AFS3_SALT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AP_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AP_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ETYPE_INFO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ETYPE_INFO.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FOR_USER.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FOR_USER.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FX_COOKIE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FX_COOKIE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FX_ERROR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FX_ERROR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FX_FAST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_FX_FAST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_NONE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_NONE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OSF_DCE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OSF_DCE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OTP_REQUEST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_OTP_REQUEST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PAC_REQUEST.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PAC_REQUEST.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PKINIT_KX.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PKINIT_KX.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PW_SALT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_PW_SALT.html Changed

_service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2.html Added

@@ -0,0 +1,162 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>KRB5_PADATA_REDHAT_IDP_OAUTH2 &#8212; MIT Kerberos Documentation</title>
+    <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
+    <script type="text/javascript">
+      var DOCUMENTATION_OPTIONS = {
+        URL_ROOT:    '../../../',
+        VERSION:     '1.20.1',
+        COLLAPSE_INDEX: false,
+        FILE_SUFFIX: '.html',
+        HAS_SOURCE:  true,
+        SOURCELINK_SUFFIX: '.txt'
+      };
+    </script>
+    <script type="text/javascript" src="../../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../../_static/doctools.js"></script>
+    <link rel="author" title="About these documents" href="../../../about.html" />
+    <link rel="index" title="Index" href="../../../genindex.html" />
+    <link rel="search" title="Search" href="../../../search.html" />
+    <link rel="copyright" title="Copyright" href="../../../copyright.html" />
+    <link rel="next" title="KRB5_PADATA_SVR_REFERRAL_INFO" href="KRB5_PADATA_SVR_REFERRAL_INFO.html" />
+    <link rel="prev" title="KRB5_PADATA_SPAKE" href="KRB5_PADATA_SPAKE.html" /> 
+  </head>
+  <body>
+    <div class="header-wrapper">
+        <div class="header">
+            
+            
+            <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
+            
+            <div class="rel">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            accesskey="C">Contents</a> |
+        <a href="KRB5_PADATA_SPAKE.html" title="KRB5_PADATA_SPAKE"
+            accesskey="P">previous</a> |
+        <a href="KRB5_PADATA_SVR_REFERRAL_INFO.html" title="KRB5_PADATA_SVR_REFERRAL_INFO"
+            accesskey="N">next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            accesskey="I">index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            accesskey="S">Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PADATA_REDHAT_IDP_OAUTH2">feedback</a>
+            </div>
+        </div>
+    </div>
+
+    <div class="content-wrapper">
+      <div class="content">
+        <div class="document">
+            
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="krb5-padata-redhat-idp-oauth2">
+<span id="krb5-padata-redhat-idp-oauth2-data"></span><h1>KRB5_PADATA_REDHAT_IDP_OAUTH2<a class="headerlink" href="#krb5-padata-redhat-idp-oauth2" title="Permalink to this headline">¶</a></h1>
+<dl class="data">
+<dt id="KRB5_PADATA_REDHAT_IDP_OAUTH2">
+<code class="descname">KRB5_PADATA_REDHAT_IDP_OAUTH2</code><a class="headerlink" href="#KRB5_PADATA_REDHAT_IDP_OAUTH2" title="Permalink to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<p>Red Hat IdP mechanism.</p>
+<table border="1" class="docutils">
+<colgroup>
+<col width="62%" />
+<col width="38%" />
+</colgroup>
+<tbody valign="top">
+<tr class="row-odd"><td><code class="docutils literal"><span class="pre">KRB5_PADATA_REDHAT_IDP_OAUTH2</span></code></td>
+<td><code class="docutils literal"><span class="pre">152</span></code></td>
+</tr>
+</tbody>
+</table>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+        </div>
+        <div class="sidebar">
+    <h2>On this page</h2>
+    <ul>
+<li><a class="reference internal" href="#">KRB5_PADATA_REDHAT_IDP_OAUTH2</a></li>
+</ul>
+
+    <br/>
+    <h2>Table of contents</h2>
+    <ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
+<li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
+<li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../y2038.html">Year 2038 considerations for uses of krb5_timestamp</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
+<li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
+<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
+<li class="toctree-l3"><a class="reference internal" href="../api/index.html">krb5 API</a></li>
+<li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
+<li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 simple macros</a></li>
+</ul>
+</li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
+<li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
+</ul>
+
+    <br/>
+    <h4><a href="../../../index.html">Full Table of Contents</a></h4>
+    <h4>Search</h4>
+    <form class="search" action="../../../search.html" method="get">
+      <input type="text" name="q" size="18" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+        </div>
+        <div class="clearer"></div>
+      </div>
+    </div>
+
+    <div class="footer-wrapper">
+        <div class="footer" >
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
+            </div>
+            <div class="left">
+                
+        <a href="../../../index.html" title="Full Table of Contents"
+            >Contents</a> |
+        <a href="KRB5_PADATA_SPAKE.html" title="KRB5_PADATA_SPAKE"
+            >previous</a> |
+        <a href="KRB5_PADATA_SVR_REFERRAL_INFO.html" title="KRB5_PADATA_SVR_REFERRAL_INFO"
+            >next</a> |
+        <a href="../../../genindex.html" title="General Index"
+            >index</a> |
+        <a href="../../../search.html" title="Enter search criteria"
+            >Search</a> |
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__KRB5_PADATA_REDHAT_IDP_OAUTH2">feedback</a>
+            </div>
+        </div>
+    </div>
+
+  </body>
+</html>
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_REFERRAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_REFERRAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_S4U_X509_USER.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_S4U_X509_USER.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SESAME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SESAME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SPAKE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SPAKE.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -26,7 +26,7 @@
     <link rel="index" title="Index" href="../../../genindex.html" />
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
-    <link rel="next" title="KRB5_PADATA_SVR_REFERRAL_INFO" href="KRB5_PADATA_SVR_REFERRAL_INFO.html" />
+    <link rel="next" title="KRB5_PADATA_REDHAT_IDP_OAUTH2" href="KRB5_PADATA_REDHAT_IDP_OAUTH2.html" />
     <link rel="prev" title="KRB5_PADATA_SESAME" href="KRB5_PADATA_SESAME.html" /> 
   </head>
   <body>
@@ -42,7 +42,7 @@
             accesskey="C">Contents</a> |
         <a href="KRB5_PADATA_SESAME.html" title="KRB5_PADATA_SESAME"
             accesskey="P">previous</a> |
-        <a href="KRB5_PADATA_SVR_REFERRAL_INFO.html" title="KRB5_PADATA_SVR_REFERRAL_INFO"
+        <a href="KRB5_PADATA_REDHAT_IDP_OAUTH2.html" title="KRB5_PADATA_REDHAT_IDP_OAUTH2"
             accesskey="N">next</a> |
         <a href="../../../genindex.html" title="General Index"
             accesskey="I">index</a> |
@@ -137,8 +137,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -146,7 +146,7 @@
             >Contents</a> |
         <a href="KRB5_PADATA_SESAME.html" title="KRB5_PADATA_SESAME"
             >previous</a> |
-        <a href="KRB5_PADATA_SVR_REFERRAL_INFO.html" title="KRB5_PADATA_SVR_REFERRAL_INFO"
+        <a href="KRB5_PADATA_REDHAT_IDP_OAUTH2.html" title="KRB5_PADATA_REDHAT_IDP_OAUTH2"
             >next</a> |
         <a href="../../../genindex.html" title="General Index"
             >index</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../../../search.html" />
     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
     <link rel="next" title="KRB5_PADATA_TGS_REQ" href="KRB5_PADATA_TGS_REQ.html" />
-    <link rel="prev" title="KRB5_PADATA_SPAKE" href="KRB5_PADATA_SPAKE.html" /> 
+    <link rel="prev" title="KRB5_PADATA_REDHAT_IDP_OAUTH2" href="KRB5_PADATA_REDHAT_IDP_OAUTH2.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../../../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="KRB5_PADATA_SPAKE.html" title="KRB5_PADATA_SPAKE"
+        <a href="KRB5_PADATA_REDHAT_IDP_OAUTH2.html" title="KRB5_PADATA_REDHAT_IDP_OAUTH2"
             accesskey="P">previous</a> |
         <a href="KRB5_PADATA_TGS_REQ.html" title="KRB5_PADATA_TGS_REQ"
             accesskey="N">next</a> |
@@ -139,14 +139,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../../../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="KRB5_PADATA_SPAKE.html" title="KRB5_PADATA_SPAKE"
+        <a href="KRB5_PADATA_REDHAT_IDP_OAUTH2.html" title="KRB5_PADATA_REDHAT_IDP_OAUTH2"
             >previous</a> |
         <a href="KRB5_PADATA_TGS_REQ.html" title="KRB5_PADATA_TGS_REQ"
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_TGS_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_TGS_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PRIV.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PRIV.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_PVNO.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_PVNO.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_REALM_BRANCH_CHAR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_REALM_BRANCH_CHAR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_REFERRAL_REALM.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_REFERRAL_REALM.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -70,7 +70,7 @@
 
 <p>OTP responder question.</p>
 <p>The OTP responder question is asked when the KDC indicates that an OTP value is required in order to complete the authentication. The JSON format of the challenge is:</p>
-<div class="highlight-c"><div class="highlight"><pre><span></span> <span class="p">{</span>
+<div class="highlight-c"><div class="highlight"><pre><span></span><span class="p">{</span>
   <span class="s">&quot;service&quot;</span><span class="o">:</span> <span class="o">&lt;</span><span class="n">string</span> <span class="p">(</span><span class="n">optional</span><span class="p">)</span><span class="o">&gt;</span><span class="p">,</span>
   <span class="s">&quot;tokenInfo&quot;</span><span class="o">:</span> <span class="p"></span>
     <span class="p">{</span>
@@ -88,7 +88,7 @@
 </pre></div>
 </div>
 <p>The answer to the question MUST be JSON formatted:</p>
-<div class="highlight-c"><div class="highlight"><pre><span></span> <span class="p">{</span>
+<div class="highlight-c"><div class="highlight"><pre><span></span><span class="p">{</span>
   <span class="s">&quot;tokeninfo&quot;</span><span class="o">:</span> <span class="o">&lt;</span><span class="n">number</span><span class="o">&gt;</span><span class="p">,</span>
   <span class="s">&quot;value&quot;</span><span class="o">:</span>     <span class="o">&lt;</span><span class="n">string</span> <span class="p">(</span><span class="n">optional</span><span class="p">)</span><span class="o">&gt;</span><span class="p">,</span>
   <span class="s">&quot;pin&quot;</span><span class="o">:</span>       <span class="o">&lt;</span><span class="n">string</span> <span class="p">(</span><span class="n">optional</span><span class="p">)</span><span class="o">&gt;</span><span class="p">,</span>
@@ -165,8 +165,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -70,14 +70,14 @@
 
 <p>PKINIT responder question.</p>
 <p>The PKINIT responder question is asked when the client needs a password that’s being used to protect key information, and is formatted as a JSON object. A specific identity’s flags value, if not zero, is the bitwise-OR of one or more of the KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_* flags defined below, and possibly other flags to be added later. Any resemblance to similarly-named CKF_* values in the PKCS#11 API should not be depended on.</p>
-<div class="highlight-c"><div class="highlight"><pre><span></span> <span class="p">{</span>
+<div class="highlight-c"><div class="highlight"><pre><span></span><span class="p">{</span>
     <span class="n">identity</span> <span class="o">&lt;</span><span class="n">string</span><span class="o">&gt;</span> <span class="o">:</span> <span class="n">flags</span> <span class="o">&lt;</span><span class="n">number</span><span class="o">&gt;</span><span class="p">,</span>
     <span class="p">...</span>
 <span class="p">}</span>
 </pre></div>
 </div>
 <p>The answer to the question MUST be JSON formatted:</p>
-<div class="highlight-c"><div class="highlight"><pre><span></span> <span class="p">{</span>
+<div class="highlight-c"><div class="highlight"><pre><span></span><span class="p">{</span>
     <span class="n">identity</span> <span class="o">&lt;</span><span class="n">string</span><span class="o">&gt;</span> <span class="o">:</span> <span class="n">password</span> <span class="o">&lt;</span><span class="n">string</span><span class="o">&gt;</span><span class="p">,</span>
     <span class="p">...</span>
 <span class="p">}</span>
@@ -152,8 +152,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_SAFE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_SAFE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_FLAGS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_FLAGS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_KTYPE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_KTYPE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_TIMES.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_TIMES.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_NOTICKET.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_NOTICKET.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_OPENCLOSE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_OPENCLOSE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_NAME.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_NAME.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_NAME_SIZE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_NAME_SIZE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_REP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_REP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_REQ.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TGS_REQ.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/MAX_KEYTAB_NAME_LEN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/MAX_KEYTAB_NAME_LEN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/MSEC_DIRBIT.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/MSEC_DIRBIT.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/MSEC_VAL_MASK.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/MSEC_VAL_MASK.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/SALT_TYPE_AFS_LENGTH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/SALT_TYPE_AFS_LENGTH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/SALT_TYPE_NO_LENGTH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/SALT_TYPE_NO_LENGTH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/THREEPARAMOPEN.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/THREEPARAMOPEN.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_ANONYMOUS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_ANONYMOUS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_ENC_PA_REP.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_ENC_PA_REP.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_FORWARDABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_FORWARDABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_FORWARDED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_FORWARDED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_HW_AUTH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_HW_AUTH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_INITIAL.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_INITIAL.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_INVALID.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_INVALID.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_MAY_POSTDATE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_MAY_POSTDATE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_POSTDATED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_POSTDATED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_PRE_AUTH.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_PRE_AUTH.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_PROXIABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_PROXIABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_PROXY.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_PROXY.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_RENEWABLE.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_RENEWABLE.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/VALID_INT_BITS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/VALID_INT_BITS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/VALID_UINT_BITS.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/VALID_UINT_BITS.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/index.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -103,6 +103,7 @@
 <li class="toctree-l1"><a class="reference internal" href="CKSUMTYPE_RSA_MD4_DES.html">CKSUMTYPE_RSA_MD4_DES</a></li>
 <li class="toctree-l1"><a class="reference internal" href="CKSUMTYPE_RSA_MD5.html">CKSUMTYPE_RSA_MD5</a></li>
 <li class="toctree-l1"><a class="reference internal" href="CKSUMTYPE_RSA_MD5_DES.html">CKSUMTYPE_RSA_MD5_DES</a></li>
+<li class="toctree-l1"><a class="reference internal" href="CKSUMTYPE_SHA1.html">CKSUMTYPE_SHA1</a></li>
 <li class="toctree-l1"><a class="reference internal" href="ENCTYPE_AES128_CTS_HMAC_SHA1_96.html">ENCTYPE_AES128_CTS_HMAC_SHA1_96</a></li>
 <li class="toctree-l1"><a class="reference internal" href="ENCTYPE_AES128_CTS_HMAC_SHA256_128.html">ENCTYPE_AES128_CTS_HMAC_SHA256_128</a></li>
 <li class="toctree-l1"><a class="reference internal" href="ENCTYPE_AES256_CTS_HMAC_SHA1_96.html">ENCTYPE_AES256_CTS_HMAC_SHA1_96</a></li>
@@ -294,12 +295,18 @@
 <li class="toctree-l1"><a class="reference internal" href="KRB5_NT_UNKNOWN.html">KRB5_NT_UNKNOWN</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_NT_WELLKNOWN.html">KRB5_NT_WELLKNOWN</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_NT_X500_PRINCIPAL.html">KRB5_NT_X500_PRINCIPAL</a></li>
+<li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_ATTRIBUTES_INFO.html">KRB5_PAC_ATTRIBUTES_INFO</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_CLIENT_INFO.html">KRB5_PAC_CLIENT_INFO</a></li>
+<li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_CLIENT_CLAIMS.html">KRB5_PAC_CLIENT_CLAIMS</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_CREDENTIALS_INFO.html">KRB5_PAC_CREDENTIALS_INFO</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_DELEGATION_INFO.html">KRB5_PAC_DELEGATION_INFO</a></li>
+<li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_DEVICE_CLAIMS.html">KRB5_PAC_DEVICE_CLAIMS</a></li>
+<li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_DEVICE_INFO.html">KRB5_PAC_DEVICE_INFO</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_LOGON_INFO.html">KRB5_PAC_LOGON_INFO</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_PRIVSVR_CHECKSUM.html">KRB5_PAC_PRIVSVR_CHECKSUM</a></li>
+<li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_REQUESTOR.html">KRB5_PAC_REQUESTOR</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_SERVER_CHECKSUM.html">KRB5_PAC_SERVER_CHECKSUM</a></li>
+<li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_TICKET_CHECKSUM.html">KRB5_PAC_TICKET_CHECKSUM</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PAC_UPN_DNS_INFO.html">KRB5_PAC_UPN_DNS_INFO</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_AFS3_SALT.html">KRB5_PADATA_AFS3_SALT</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_AP_REQ.html">KRB5_PADATA_AP_REQ</a></li>
@@ -338,6 +345,7 @@
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_SAM_RESPONSE_2.html">KRB5_PADATA_SAM_RESPONSE_2</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_SESAME.html">KRB5_PADATA_SESAME</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_SPAKE.html">KRB5_PADATA_SPAKE</a></li>
+<li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_REDHAT_IDP_OAUTH2.html">KRB5_PADATA_REDHAT_IDP_OAUTH2</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_SVR_REFERRAL_INFO.html">KRB5_PADATA_SVR_REFERRAL_INFO</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_TGS_REQ.html">KRB5_PADATA_TGS_REQ</a></li>
 <li class="toctree-l1"><a class="reference internal" href="KRB5_PADATA_USE_SPECIFIED_KVNO.html">KRB5_PADATA_USE_SPECIFIED_KVNO</a></li>
@@ -510,8 +518,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb524_convert_creds_kdc.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb524_convert_creds_kdc.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb524_init_ets.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb524_init_ets.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_const.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_const.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_component.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_component.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_name.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_name.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_set_realm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_set_realm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_set_realm_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_set_realm_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_set_realm_length.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_set_realm_length.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_size.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_size.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_princ_type.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_princ_type.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_roundup.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_roundup.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_x.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_x.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/macros/krb5_xc.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/macros/krb5_xc.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_address.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_address.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_addrtype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_addrtype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ap_rep.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ap_rep.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ap_rep_enc_part.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ap_rep_enc_part.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ap_req.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ap_req.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_auth_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_auth_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_authdata.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_authdata.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_authdatatype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_authdatatype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_authenticator.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_authenticator.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_boolean.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_boolean.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_cc_cursor.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_cc_cursor.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ccache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ccache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_cccol_cursor.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_cccol_cursor.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_checksum.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_checksum.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_cksumtype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_cksumtype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_const_pointer.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_const_pointer.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_const_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_const_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_cred.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_cred.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_cred_enc_part.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_cred_enc_part.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_cred_info.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_cred_info.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_creds.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_creds.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_crypto_iov.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_crypto_iov.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_cryptotype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_cryptotype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_deltat.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_deltat.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_enc_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_enc_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_enc_kdc_rep_part.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_enc_kdc_rep_part.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_enc_tkt_part.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_enc_tkt_part.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_encrypt_block.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_encrypt_block.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_enctype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_enctype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_error.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_error.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_error_code.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_error_code.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_expire_callback_func.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_expire_callback_func.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_flags.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_flags.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_get_init_creds_opt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_get_init_creds_opt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_gic_opt_pa_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_gic_opt_pa_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_init_creds_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_init_creds_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_int16.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_int16.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_int32.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_int32.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_kdc_rep.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_kdc_rep.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_kdc_req.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_kdc_req.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_key.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_key.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_keyblock.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_keyblock.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_keytab.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_keytab.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_keytab_entry.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_keytab_entry.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_keyusage.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_keyusage.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_kt_cursor.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_kt_cursor.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_kvno.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_kvno.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_last_req_entry.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_last_req_entry.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_magic.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_magic.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_mk_req_checksum_func.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_mk_req_checksum_func.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_msgtype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_msgtype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_octet.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_octet.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pa_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pa_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pa_pac_req.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pa_pac_req.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pa_server_referral_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pa_server_referral_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pa_svr_referral_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pa_svr_referral_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pac.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pac.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pointer.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pointer.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_post_recv_fn.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_post_recv_fn.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pre_send_fn.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pre_send_fn.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../../../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -69,7 +69,7 @@
 <dd></dd></dl>
 
 <p>Hook function for inspecting or modifying messages sent to KDCs.</p>
-<p>If the hook function sets <em>reply_out</em> , <em>message</em> will not be sent to the KDC, and the given reply will used instead.
+<p>If the hook function sets <em>new_reply_out</em> , <em>message</em> will not be sent to the KDC, and the given reply will used instead.
 If the hook function sets <em>new_message_out</em> , the given message will be sent to the KDC in place of <em>message</em> .
 If the hook function returns successfully without setting either output, <em>message</em> will be sent to the KDC normally.
 The hook function should use <a class="reference internal" href="../api/krb5_copy_data.html#c.krb5_copy_data" title="krb5_copy_data"><code class="xref c c-func docutils literal"><span class="pre">krb5_copy_data()</span></code></a> to construct the value for <em>new_message_out</em> or <em>reply_out</em> , to ensure that it can be freed correctly by the library.</p>
@@ -138,8 +138,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../../../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_preauthtype.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_preauthtype.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_principal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_principal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_principal_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_principal_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_prompt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_prompt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_prompt_type.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_prompt_type.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_prompter_fct.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_prompter_fct.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_pwd_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_pwd_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_rcache.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_rcache.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_replay_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_replay_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_responder_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_responder_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_responder_fn.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_responder_fn.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_responder_otp_challenge.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_responder_otp_challenge.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_responder_otp_tokeninfo.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_responder_otp_tokeninfo.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_responder_pkinit_challenge.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_responder_pkinit_challenge.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_responder_pkinit_identity.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_responder_pkinit_identity.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_response.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_response.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ticket.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ticket.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ticket_times.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ticket_times.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_timestamp.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_timestamp.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_tkt_authent.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_tkt_authent.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_tkt_creds_context.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_tkt_creds_context.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_trace_callback.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_trace_callback.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_trace_info.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_trace_info.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_transited.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_transited.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_typed_data.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_typed_data.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ui_2.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ui_2.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_ui_4.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_ui_4.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/krb5_verify_init_creds_opt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/krb5_verify_init_creds_opt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/refs/types/passwd_phrase_element.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/refs/types/passwd_phrase_element.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/appdev/y2038.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/appdev/y2038.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/basic/ccache_def.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/basic/ccache_def.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/basic/date_format.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/basic/date_format.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/basic/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/basic/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/basic/keytab_def.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/basic/keytab_def.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/basic/rcache_def.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/basic/rcache_def.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/basic/stash_file_def.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/basic/stash_file_def.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/build/directory_org.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/build/directory_org.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/build/doing_build.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/build/doing_build.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -148,25 +148,14 @@
 <div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">make</span> <span class="n">check</span>
 </pre></div>
 </div>
-<p>However, there are several prerequisites that must be satisfied first:</p>
-<ul class="simple">
-<li>Configure and build Kerberos with Tcl support. Tcl is used to drive
-the test suite.  This often means passing <strong>-</strong><strong>-with-tcl</strong> to
-configure to tell it the location of the Tcl configuration
-script. (See <a class="reference internal" href="options2configure.html#options2configure"><span class="std std-ref">Options to configure</span></a>.)</li>
-<li>In addition to Tcl, DejaGnu must be available on the system for some
-of the tests to run.  The test suite will still run the other tests
-if DejaGnu is not present, but the test coverage will be reduced
-accordingly.</li>
-<li>On some operating systems, you have to run <code class="docutils literal"><span class="pre">make</span> <span class="pre">install</span></code> before
+<p>On some operating systems, you have to run <code class="docutils literal"><span class="pre">make</span> <span class="pre">install</span></code> before
 running <code class="docutils literal"><span class="pre">make</span> <span class="pre">check</span></code>, or the test suite will pick up installed
-versions of Kerberos libraries rather than the newly built ones.
-You can install into a prefix that isn’t in the system library
-search path, though. Alternatively, you can configure with
-<strong>-</strong><strong>-disable-rpath</strong>, which renders the build tree less suitable for
-installation, but allows testing without interference from
-previously installed libraries.</li>
-</ul>
+versions of Kerberos libraries rather than the newly built ones.  You
+can install into a prefix that isn’t in the system library search
+path, though.  Alternatively, you can configure with
+<strong>-</strong><strong>-disable-rpath</strong>, which renders the build tree less suitable
+for installation, but allows testing without interference from
+previously installed libraries.</p>
 <p>There are additional regression tests available, which are not run
 by <code class="docutils literal"><span class="pre">make</span> <span class="pre">check</span></code>.  These tests require manual setup and teardown of
 support infrastructure which is not easily automated, or require
@@ -263,8 +252,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/build/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/build/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/build/options2configure.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/build/options2configure.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -93,11 +93,6 @@
 <code class="docutils literal"><span class="pre">-lsocket</span></code>.  If your operating system has a broken resolver
 library or fails to pass the tests in <code class="docutils literal"><span class="pre">src/tests/resolv</span></code>, you
 will need to use this option.</dd>
-<dt><strong>-</strong><strong>-with-tcl=</strong><em>TCLPATH</em></dt>
-<dd>Some of the unit-tests in the build tree rely upon using a program
-in Tcl.  The directory specified by <em>TCLPATH</em> specifies where the
-Tcl header file (TCLPATH/include/tcl.h) as well as where the Tcl
-library (TCLPATH/lib) should be found.</dd>
 <dt><strong>-</strong><strong>-enable-dns-for-realm</strong></dt>
 <dd>Enable the use of DNS to look up a host’s Kerberos realm,
 if the information is not provided in
@@ -335,10 +330,6 @@
 <dd>Compile OpenLDAP database backend module.</dd>
 <dt><strong>-</strong><strong>-with-lmdb</strong></dt>
 <dd>Compile LMDB database backend module.</dd>
-<dt><strong>-</strong><strong>-with-tcl=</strong><em>path</em></dt>
-<dd>Specifies that <em>path</em> is the location of a Tcl installation.
-Tcl is needed for some of the tests run by ‘make check’; such tests
-will be skipped if this option is not set.</dd>
 <dt><strong>-</strong><strong>-with-vague-errors</strong></dt>
 <dd>Do not send helpful errors to client.  For example, if the KDC
 should return only vague error codes to clients.</dd>
@@ -347,18 +338,12 @@
 Kerberos implementation <code class="docutils literal"><span class="pre">builtin</span></code>.  The other currently
 implemented crypto backend is <code class="docutils literal"><span class="pre">openssl</span></code>.  (See
 <a class="reference internal" href="../mitK5features.html#mitk5features"><span class="std std-ref">MIT Kerberos features</span></a>)</dd>
-<dt><strong>-</strong><strong>-with-prng-alg=</strong><em>ALG</em></dt>
-<dd>Use specified PRNG algorithm.  For example, to use the OS native
-prng specify <code class="docutils literal"><span class="pre">--with-prng-alg=os</span></code>.  The default is <code class="docutils literal"><span class="pre">fortuna</span></code>.
-(See <a class="reference internal" href="../mitK5features.html#mitk5features"><span class="std std-ref">MIT Kerberos features</span></a>)</dd>
 <dt><strong>-</strong><strong>-without-libedit</strong></dt>
 <dd>Do not compile and link against libedit.  Some utilities will no
 longer offer command history or completion in interactive mode if
 libedit is disabled.</dd>
 <dt><strong>-</strong><strong>-with-readline</strong></dt>
-<dd>Compile and link against GNU readline, as an alternative to libedit.
-Building with readline breaks the dejagnu test suite, which is a
-subset of the tests run by ‘make check’.</dd>
+<dd>Compile and link against GNU readline, as an alternative to libedit.</dd>
 <dt><strong>-</strong><strong>-with-system-verto</strong></dt>
 <dd><p class="first">Use an installed version of libverto.  If the libverto header and
 library are not in default locations, you may wish to specify
@@ -465,8 +450,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/build/osconf.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/build/osconf.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/build_this.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/build_this.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/copyright.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/copyright.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    './',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -63,7 +63,7 @@
             
   <div class="section" id="copyright">
 <h1>Copyright<a class="headerlink" href="#copyright" title="Permalink to this headline">¶</a></h1>
-<p>Copyright © 1985-2021 by the Massachusetts Institute of
+<p>Copyright © 1985-2022 by the Massachusetts Institute of
 Technology and its contributors.  All rights reserved.</p>
 <p>See <a class="reference internal" href="mitK5license.html#mitk5license"><span class="std std-ref">MIT Kerberos License information</span></a> for additional copyright and license
 information.</p>
@@ -112,8 +112,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="#">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="#">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/formats/ccache_file_format.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/formats/ccache_file_format.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/formats/cookie.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/formats/cookie.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/formats/freshness_token.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/formats/freshness_token.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/formats/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/formats/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/formats/keytab_file_format.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/formats/keytab_file_format.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/formats/rcache_file_format.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/formats/rcache_file_format.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-A.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-A.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-C.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-C.html Changed

@@ -13,7 +13,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    './',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -77,10 +77,10 @@
 </li>
       <li><a href="appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3.html#CKSUMTYPE_HMAC_SHA1_DES3">CKSUMTYPE_HMAC_SHA1_DES3 (built-in variable)</a>
 </li>
-  </ul></td>
-  <td style="width: 33%; vertical-align: top;"><ul>
       <li><a href="appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128.html#CKSUMTYPE_HMAC_SHA256_128_AES128">CKSUMTYPE_HMAC_SHA256_128_AES128 (built-in variable)</a>
 </li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
       <li><a href="appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256.html#CKSUMTYPE_HMAC_SHA384_192_AES256">CKSUMTYPE_HMAC_SHA384_192_AES256 (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR.html#CKSUMTYPE_MD5_HMAC_ARCFOUR">CKSUMTYPE_MD5_HMAC_ARCFOUR (built-in variable)</a>
@@ -95,6 +95,8 @@
 </li>
       <li><a href="appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES.html#CKSUMTYPE_RSA_MD5_DES">CKSUMTYPE_RSA_MD5_DES (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/CKSUMTYPE_SHA1.html#CKSUMTYPE_SHA1">CKSUMTYPE_SHA1 (built-in variable)</a>
+</li>
   </ul></td>
 </tr></table>
 
@@ -138,8 +140,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-E.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-E.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-K.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-K.html Changed

@@ -13,7 +13,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    './',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -1027,8 +1027,6 @@
 </li>
       <li><a href="appdev/refs/api/krb5_is_config_principal.html#c.krb5_is_config_principal">krb5_is_config_principal (C function)</a>
 </li>
-  </ul></td>
-  <td style="width: 33%; vertical-align: top;"><ul>
       <li><a href="appdev/refs/api/krb5_is_referral_realm.html#c.krb5_is_referral_realm">krb5_is_referral_realm (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_is_thread_safe.html#c.krb5_is_thread_safe">krb5_is_thread_safe (C function)</a>
@@ -1041,6 +1039,8 @@
 </li>
       <li><a href="appdev/refs/api/krb5_k_encrypt.html#c.krb5_k_encrypt">krb5_k_encrypt (C function)</a>
 </li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
       <li><a href="appdev/refs/api/krb5_k_encrypt_iov.html#c.krb5_k_encrypt_iov">krb5_k_encrypt_iov (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_k_free_key.html#c.krb5_k_free_key">krb5_k_free_key (C function)</a>
@@ -1111,6 +1111,10 @@
 </li>
       <li><a href="appdev/refs/types/krb5_kdc_req.html#c.krb5_kdc_req.unenc_authdata">krb5_kdc_req.unenc_authdata (C member)</a>
 </li>
+      <li><a href="appdev/refs/api/krb5_kdc_sign_ticket.html#c.krb5_kdc_sign_ticket">krb5_kdc_sign_ticket (C function)</a>
+</li>
+      <li><a href="appdev/refs/api/krb5_kdc_verify_ticket.html#c.krb5_kdc_verify_ticket">krb5_kdc_verify_ticket (C function)</a>
+</li>
       <li><a href="appdev/refs/types/krb5_key.html#c.krb5_key">krb5_key (C type)</a>
 </li>
       <li><a href="appdev/refs/types/krb5_keyblock.html#c.krb5_keyblock">krb5_keyblock (C type)</a>
@@ -1325,6 +1329,8 @@
 </li>
       <li><a href="appdev/refs/api/krb5_make_authdata_kdc_issued.html#c.krb5_make_authdata_kdc_issued">krb5_make_authdata_kdc_issued (C function)</a>
 </li>
+      <li><a href="appdev/refs/api/krb5_marshal_credentials.html#c.krb5_marshal_credentials">krb5_marshal_credentials (C function)</a>
+</li>
       <li><a href="appdev/refs/api/krb5_merge_authdata.html#c.krb5_merge_authdata">krb5_merge_authdata (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_mk_1cred.html#c.krb5_mk_1cred">krb5_mk_1cred (C function)</a>
@@ -1413,12 +1419,20 @@
 </li>
       <li><a href="appdev/refs/api/krb5_pac_add_buffer.html#c.krb5_pac_add_buffer">krb5_pac_add_buffer (C function)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO.html#KRB5_PAC_ATTRIBUTES_INFO">KRB5_PAC_ATTRIBUTES_INFO (built-in variable)</a>
+</li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS.html#KRB5_PAC_CLIENT_CLAIMS">KRB5_PAC_CLIENT_CLAIMS (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PAC_CLIENT_INFO.html#KRB5_PAC_CLIENT_INFO">KRB5_PAC_CLIENT_INFO (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO.html#KRB5_PAC_CREDENTIALS_INFO">KRB5_PAC_CREDENTIALS_INFO (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/macros/KRB5_PAC_DELEGATION_INFO.html#KRB5_PAC_DELEGATION_INFO">KRB5_PAC_DELEGATION_INFO (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS.html#KRB5_PAC_DEVICE_CLAIMS">KRB5_PAC_DEVICE_CLAIMS (built-in variable)</a>
+</li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_DEVICE_INFO.html#KRB5_PAC_DEVICE_INFO">KRB5_PAC_DEVICE_INFO (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/api/krb5_pac_free.html#c.krb5_pac_free">krb5_pac_free (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_get_buffer.html#c.krb5_pac_get_buffer">krb5_pac_get_buffer (C function)</a>
@@ -1435,12 +1449,16 @@
 </li>
       <li><a href="appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM.html#KRB5_PAC_PRIVSVR_CHECKSUM">KRB5_PAC_PRIVSVR_CHECKSUM (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_REQUESTOR.html#KRB5_PAC_REQUESTOR">KRB5_PAC_REQUESTOR (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM.html#KRB5_PAC_SERVER_CHECKSUM">KRB5_PAC_SERVER_CHECKSUM (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_sign.html#c.krb5_pac_sign">krb5_pac_sign (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_sign_ext.html#c.krb5_pac_sign_ext">krb5_pac_sign_ext (C function)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM.html#KRB5_PAC_TICKET_CHECKSUM">KRB5_PAC_TICKET_CHECKSUM (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO.html#KRB5_PAC_UPN_DNS_INFO">KRB5_PAC_UPN_DNS_INFO (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_verify.html#c.krb5_pac_verify">krb5_pac_verify (C function)</a>
@@ -1503,6 +1521,8 @@
 </li>
       <li><a href="appdev/refs/macros/KRB5_PADATA_PW_SALT.html#KRB5_PADATA_PW_SALT">KRB5_PADATA_PW_SALT (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2.html#KRB5_PADATA_REDHAT_IDP_OAUTH2">KRB5_PADATA_REDHAT_IDP_OAUTH2 (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PADATA_REFERRAL.html#KRB5_PADATA_REFERRAL">KRB5_PADATA_REFERRAL (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/macros/KRB5_PADATA_S4U_X509_USER.html#KRB5_PADATA_S4U_X509_USER">KRB5_PADATA_S4U_X509_USER (built-in variable)</a>
@@ -1951,6 +1971,8 @@
 </li>
       <li><a href="appdev/refs/types/krb5_ui_4.html#c.krb5_ui_4">krb5_ui_4 (C type)</a>
 </li>
+      <li><a href="appdev/refs/api/krb5_unmarshal_credentials.html#c.krb5_unmarshal_credentials">krb5_unmarshal_credentials (C function)</a>
+</li>
       <li><a href="appdev/refs/api/krb5_unparse_name.html#c.krb5_unparse_name">krb5_unparse_name (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_unparse_name_ext.html#c.krb5_unparse_name_ext">krb5_unparse_name_ext (C function)</a>
@@ -2038,8 +2060,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-L.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-L.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-M.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-M.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-P.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-P.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-R.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-R.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-S.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-S.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-T.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-T.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-V.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-V.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex-all.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex-all.html Changed

@@ -13,7 +13,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    './',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -158,6 +158,8 @@
 </li>
       <li><a href="appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES.html#CKSUMTYPE_RSA_MD5_DES">CKSUMTYPE_RSA_MD5_DES (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/CKSUMTYPE_SHA1.html#CKSUMTYPE_SHA1">CKSUMTYPE_SHA1 (built-in variable)</a>
+</li>
   </ul></td>
 </tr></table>
 
@@ -1188,8 +1190,6 @@
 </li>
       <li><a href="appdev/refs/api/krb5_is_config_principal.html#c.krb5_is_config_principal">krb5_is_config_principal (C function)</a>
 </li>
-  </ul></td>
-  <td style="width: 33%; vertical-align: top;"><ul>
       <li><a href="appdev/refs/api/krb5_is_referral_realm.html#c.krb5_is_referral_realm">krb5_is_referral_realm (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_is_thread_safe.html#c.krb5_is_thread_safe">krb5_is_thread_safe (C function)</a>
@@ -1200,6 +1200,8 @@
 </li>
       <li><a href="appdev/refs/api/krb5_k_decrypt_iov.html#c.krb5_k_decrypt_iov">krb5_k_decrypt_iov (C function)</a>
 </li>
+  </ul></td>
+  <td style="width: 33%; vertical-align: top;"><ul>
       <li><a href="appdev/refs/api/krb5_k_encrypt.html#c.krb5_k_encrypt">krb5_k_encrypt (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_k_encrypt_iov.html#c.krb5_k_encrypt_iov">krb5_k_encrypt_iov (C function)</a>
@@ -1272,6 +1274,10 @@
 </li>
       <li><a href="appdev/refs/types/krb5_kdc_req.html#c.krb5_kdc_req.unenc_authdata">krb5_kdc_req.unenc_authdata (C member)</a>
 </li>
+      <li><a href="appdev/refs/api/krb5_kdc_sign_ticket.html#c.krb5_kdc_sign_ticket">krb5_kdc_sign_ticket (C function)</a>
+</li>
+      <li><a href="appdev/refs/api/krb5_kdc_verify_ticket.html#c.krb5_kdc_verify_ticket">krb5_kdc_verify_ticket (C function)</a>
+</li>
       <li><a href="appdev/refs/types/krb5_key.html#c.krb5_key">krb5_key (C type)</a>
 </li>
       <li><a href="appdev/refs/types/krb5_keyblock.html#c.krb5_keyblock">krb5_keyblock (C type)</a>
@@ -1486,6 +1492,8 @@
 </li>
       <li><a href="appdev/refs/api/krb5_make_authdata_kdc_issued.html#c.krb5_make_authdata_kdc_issued">krb5_make_authdata_kdc_issued (C function)</a>
 </li>
+      <li><a href="appdev/refs/api/krb5_marshal_credentials.html#c.krb5_marshal_credentials">krb5_marshal_credentials (C function)</a>
+</li>
       <li><a href="appdev/refs/api/krb5_merge_authdata.html#c.krb5_merge_authdata">krb5_merge_authdata (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_mk_1cred.html#c.krb5_mk_1cred">krb5_mk_1cred (C function)</a>
@@ -1574,12 +1582,20 @@
 </li>
       <li><a href="appdev/refs/api/krb5_pac_add_buffer.html#c.krb5_pac_add_buffer">krb5_pac_add_buffer (C function)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO.html#KRB5_PAC_ATTRIBUTES_INFO">KRB5_PAC_ATTRIBUTES_INFO (built-in variable)</a>
+</li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS.html#KRB5_PAC_CLIENT_CLAIMS">KRB5_PAC_CLIENT_CLAIMS (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PAC_CLIENT_INFO.html#KRB5_PAC_CLIENT_INFO">KRB5_PAC_CLIENT_INFO (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO.html#KRB5_PAC_CREDENTIALS_INFO">KRB5_PAC_CREDENTIALS_INFO (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/macros/KRB5_PAC_DELEGATION_INFO.html#KRB5_PAC_DELEGATION_INFO">KRB5_PAC_DELEGATION_INFO (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS.html#KRB5_PAC_DEVICE_CLAIMS">KRB5_PAC_DEVICE_CLAIMS (built-in variable)</a>
+</li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_DEVICE_INFO.html#KRB5_PAC_DEVICE_INFO">KRB5_PAC_DEVICE_INFO (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/api/krb5_pac_free.html#c.krb5_pac_free">krb5_pac_free (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_get_buffer.html#c.krb5_pac_get_buffer">krb5_pac_get_buffer (C function)</a>
@@ -1596,12 +1612,16 @@
 </li>
       <li><a href="appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM.html#KRB5_PAC_PRIVSVR_CHECKSUM">KRB5_PAC_PRIVSVR_CHECKSUM (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_REQUESTOR.html#KRB5_PAC_REQUESTOR">KRB5_PAC_REQUESTOR (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM.html#KRB5_PAC_SERVER_CHECKSUM">KRB5_PAC_SERVER_CHECKSUM (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_sign.html#c.krb5_pac_sign">krb5_pac_sign (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_sign_ext.html#c.krb5_pac_sign_ext">krb5_pac_sign_ext (C function)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM.html#KRB5_PAC_TICKET_CHECKSUM">KRB5_PAC_TICKET_CHECKSUM (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO.html#KRB5_PAC_UPN_DNS_INFO">KRB5_PAC_UPN_DNS_INFO (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_pac_verify.html#c.krb5_pac_verify">krb5_pac_verify (C function)</a>
@@ -1664,6 +1684,8 @@
 </li>
       <li><a href="appdev/refs/macros/KRB5_PADATA_PW_SALT.html#KRB5_PADATA_PW_SALT">KRB5_PADATA_PW_SALT (built-in variable)</a>
 </li>
+      <li><a href="appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2.html#KRB5_PADATA_REDHAT_IDP_OAUTH2">KRB5_PADATA_REDHAT_IDP_OAUTH2 (built-in variable)</a>
+</li>
       <li><a href="appdev/refs/macros/KRB5_PADATA_REFERRAL.html#KRB5_PADATA_REFERRAL">KRB5_PADATA_REFERRAL (built-in variable)</a>
 </li>
       <li><a href="appdev/refs/macros/KRB5_PADATA_S4U_X509_USER.html#KRB5_PADATA_S4U_X509_USER">KRB5_PADATA_S4U_X509_USER (built-in variable)</a>
@@ -2112,6 +2134,8 @@
 </li>
       <li><a href="appdev/refs/types/krb5_ui_4.html#c.krb5_ui_4">krb5_ui_4 (C type)</a>
 </li>
+      <li><a href="appdev/refs/api/krb5_unmarshal_credentials.html#c.krb5_unmarshal_credentials">krb5_unmarshal_credentials (C function)</a>
+</li>
       <li><a href="appdev/refs/api/krb5_unparse_name.html#c.krb5_unparse_name">krb5_unparse_name (C function)</a>
 </li>
       <li><a href="appdev/refs/api/krb5_unparse_name_ext.html#c.krb5_unparse_name_ext">krb5_unparse_name_ext (C function)</a>
@@ -2379,8 +2403,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/genindex.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/genindex.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/index.html Changed

@@ -5,14 +5,14 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <title>MIT Kerberos Documentation (1.19.2) &#8212; MIT Kerberos Documentation</title>
+    <title>MIT Kerberos Documentation (1.20.1) &#8212; MIT Kerberos Documentation</title>
     <link rel="stylesheet" href="_static/agogo.css" type="text/css" />
     <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
     <link rel="stylesheet" href="_static/kerb.css" type="text/css" />
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    './',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -45,7 +45,7 @@
             accesskey="I">index</a> |
         <a href="search.html" title="Enter search criteria"
             accesskey="S">Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__MIT Kerberos Documentation (1.19.2)">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__MIT Kerberos Documentation (1.20.1)">feedback</a>
             </div>
         </div>
     </div>
@@ -59,7 +59,7 @@
           <div class="body" role="main">
             
   <div class="section" id="mit-kerberos-documentation-release">
-<h1>MIT Kerberos Documentation (1.19.2)<a class="headerlink" href="#mit-kerberos-documentation-release" title="Permalink to this headline">¶</a></h1>
+<h1>MIT Kerberos Documentation (1.20.1)<a class="headerlink" href="#mit-kerberos-documentation-release" title="Permalink to this headline">¶</a></h1>
 <div class="toctree-wrapper compound">
 <ul>
 <li class="toctree-l1"><a class="reference internal" href="user/index.html">For users</a></li>
@@ -85,7 +85,7 @@
         <div class="sidebar">
     <h2>On this page</h2>
     <ul>
-<li><a class="reference internal" href="#">MIT Kerberos Documentation (1.19.2)</a></li>
+<li><a class="reference internal" href="#">MIT Kerberos Documentation (1.20.1)</a></li>
 </ul>
 
     <br/>
@@ -120,8 +120,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
@@ -133,7 +133,7 @@
             >index</a> |
         <a href="search.html" title="Enter search criteria"
             >Search</a> |
-    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__MIT Kerberos Documentation (1.19.2)">feedback</a>
+    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__MIT Kerberos Documentation (1.20.1)">feedback</a>
             </div>
         </div>
     </div>

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/mitK5defaults.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/mitK5defaults.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/mitK5features.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/mitK5features.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    './',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -72,8 +72,8 @@
 <dl class="docutils">
 <dt>Releases:</dt>
 <dd><ul class="first last simple">
-<li>Latest stable: <a class="reference external" href="https://web.mit.edu/kerberos/krb5-1.18/">https://web.mit.edu/kerberos/krb5-1.18/</a></li>
-<li>Supported: <a class="reference external" href="https://web.mit.edu/kerberos/krb5-1.17/">https://web.mit.edu/kerberos/krb5-1.17/</a></li>
+<li>Latest stable: <a class="reference external" href="https://web.mit.edu/kerberos/krb5-1.20/">https://web.mit.edu/kerberos/krb5-1.20/</a></li>
+<li>Supported: <a class="reference external" href="https://web.mit.edu/kerberos/krb5-1.19/">https://web.mit.edu/kerberos/krb5-1.19/</a></li>
 <li>Release cycle: approximately 12 months</li>
 </ul>
 </dd>
@@ -605,6 +605,46 @@
 (inspired by Heimdal’s kgetcred).</li>
 </ul>
 </div></blockquote>
+<p>Release 1.20</p>
+<ul class="simple">
+<li>Administrator experience:<ul>
+<li>Added a “disable_pac” realm relation to suppress adding PAC
+authdata to tickets, for realms which do not need to support S4U
+requests.</li>
+<li>Most credential cache types will use atomic replacement when a
+cache is reinitialized using kinit or refreshed from the client
+keytab.</li>
+<li>kprop can now propagate databases with a dump size larger than
+4GB, if both the client and server are upgraded.</li>
+<li>kprop can now work over NATs that change the destination IP
+address, if the client is upgraded.</li>
+</ul>
+</li>
+<li>Developer experience:<ul>
+<li>Updated the KDB interface.  The sign_authdata() method is replaced
+with the issue_pac() method, allowing KDB modules to add logon
+info and other buffers to the PAC issued by the KDC.</li>
+<li>Host-based initiator names are better supported in the GSS krb5
+mechanism.</li>
+</ul>
+</li>
+<li>Protocol evolution:<ul>
+<li>Replaced AD-SIGNEDPATH authdata with minimal PACs.</li>
+<li>To avoid spurious replay errors, password change requests will not
+be attempted over UDP until the attempt over TCP fails.</li>
+<li>PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.</li>
+</ul>
+</li>
+<li>Code quality:<ul>
+<li>Updated all code using OpenSSL to be compatible with OpenSSL 3.</li>
+<li>Reorganized the libk5crypto build system to allow the OpenSSL
+back-end to pull in material from the builtin back-end depending
+on the OpenSSL version.</li>
+<li>Simplified the PRNG logic to always use the platform PRNG.</li>
+<li>Converted the remaining Tcl tests to Python.</li>
+</ul>
+</li>
+</ul>
 <p><cite>Pre-authentication mechanisms</cite></p>
 <ul class="simple">
 <li>PW-SALT                                         <span class="target" id="index-11"></span><a class="rfc reference external" href="https://tools.ietf.org/html/rfc4120.html#section-5.2.7.3"><strong>RFC 4120#section-5.2.7.3</strong></a></li>
@@ -618,13 +658,6 @@
 <li>OTP                          (release 1.12)     <a class="reference internal" href="admin/otp.html#otp-preauth"><span class="std std-ref">OTP Preauthentication</span></a></li>
 <li>SPAKE                        (release 1.17)     <a class="reference internal" href="admin/spake.html#spake"><span class="std std-ref">SPAKE Preauthentication</span></a></li>
 </ul>
-<p><cite>PRNG</cite></p>
-<ul class="simple">
-<li>modularity       (release 1.9)</li>
-<li>Yarrow PRNG      (release &lt; 1.10)</li>
-<li>Fortuna PRNG     (release 1.9)       <a class="reference external" href="https://www.schneier.com/book-practical.html">https://www.schneier.com/book-practical.html</a></li>
-<li>OS PRNG          (release 1.10)      OS’s native PRNG</li>
-</ul>
 </div>
 </div>
 
@@ -676,8 +709,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/mitK5license.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/mitK5license.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    './',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -65,7 +65,7 @@
 <span id="mitk5license"></span><h1>MIT Kerberos License information<a class="headerlink" href="#mit-kerberos-license-information" title="Permalink to this headline">¶</a></h1>
 <div class="toctree-wrapper compound">
 </div>
-<p>Copyright © 1985-2021 by the Massachusetts Institute of Technology.</p>
+<p>Copyright © 1985-2022 by the Massachusetts Institute of Technology.</p>
 <p>All rights reserved.</p>
 <p>Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -735,35 +735,6 @@
 SOFTWARE.</p>
 </div></blockquote>
 <hr class="docutils" />
-<p>Portions of the implementation of the Fortuna-like PRNG are subject to
-the following notice:</p>
-<blockquote>
-<div><div class="line-block">
-<div class="line">Copyright © 2005 Marko Kreen</div>
-<div class="line">All rights reserved.</div>
-</div>
-<p>Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:</p>
-<ol class="arabic simple">
-<li>Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.</li>
-<li>Redistributions in binary form must reproduce the above copyright
-notice, this list of conditions and the following disclaimer in the
-documentation and/or other materials provided with the distribution.</li>
-</ol>
-<p>THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS “AS IS” AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.</p>
-</div></blockquote>
 <blockquote>
 <div><p>Copyright © 1994 by the University of Southern California</p>
 <blockquote>
@@ -956,14 +927,6 @@
 this kind of disclaimer?)</p>
 </div></blockquote>
 <hr class="docutils" />
-<p>The following notice applies to SWIG-generated code in
-<code class="docutils literal"><span class="pre">src/util/profile/profile_tcl.c</span></code>:</p>
-<blockquote>
-<div><p>Copyright © 1999-2000, The University of Chicago</p>
-<p>This file may be freely redistributed without license or fee provided
-this copyright message remains intact.</p>
-</div></blockquote>
-<hr class="docutils" />
 <p>The following notice applies to portiions of <code class="docutils literal"><span class="pre">src/lib/rpc</span></code> and
 <code class="docutils literal"><span class="pre">src/include/gssrpc</span></code>:</p>
 <blockquote>
@@ -1292,8 +1255,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/objects.inv -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/objects.inv Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/ccselect.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/ccselect.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/certauth.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/certauth.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -72,13 +72,18 @@
 whether a client’s certificate is authorized to authenticate a client
 principal.  <strong>authorize</strong> receives the DER-encoded certificate, the
 requested client principal, and a pointer to the client’s
-krb5_db_entry (for modules that link against libkdb5).  It returns the
+krb5_db_entry (for modules that link against libkdb5).  The method
+must decode the certificate and inspect its attributes to determine if
+it should authorize PKINIT authentication.  It returns the
 authorization status and optionally outputs a list of authentication
-indicator strings to be added to the ticket.  Beginning in release
-1.19, the authorize method can request that the hardware
-authentication bit be set in the ticket by returning
-<strong>KRB5_CERTAUTH_HWAUTH</strong>.  A module must use its own internal or
-library-provided ASN.1 certificate decoder.</p>
+indicator strings to be added to the ticket.</p>
+<p>Beginning in release 1.19, the authorize method can request that the
+hardware authentication bit be set in the ticket by returning
+<strong>KRB5_CERTAUTH_HWAUTH</strong>.  Beginning in release 1.20, the authorize
+method can return <strong>KRB5_CERTAUTH_HWAUTH_PASS</strong> to request that the
+hardware authentication bit be set in the ticket but otherwise defer
+authorization to another certauth module.  A module must use its own
+internal or library-provided ASN.1 certificate decoder.</p>
 <p>A module can optionally create and destroy module data with the
 <strong>init</strong> and <strong>fini</strong> methods.  Module data objects last for the
 lifetime of the KDC process.</p>
@@ -147,8 +152,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/clpreauth.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/clpreauth.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/general.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/general.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/gssapi.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/gssapi.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -122,11 +122,15 @@
 using the mechglue’s gss_create_empty_oid_set and
 gss_add_oid_set_member functions.</p>
 <p>An interposer module must use the prefix <code class="docutils literal"><span class="pre">gssi_</span></code> for the GSSAPI
-functions it exports, instead of the prefix <code class="docutils literal"><span class="pre">gss_</span></code>.</p>
+functions it exports, instead of the prefix <code class="docutils literal"><span class="pre">gss_</span></code>.  In most cases,
+unexported <code class="docutils literal"><span class="pre">gssi_</span></code> functions will result in failure from their
+corresponding <code class="docutils literal"><span class="pre">gss_</span></code> calls.</p>
 <p>An interposer module can link against the GSSAPI library in order to
 make calls to the original mechanism.  To do so, it must specify a
 special mechanism OID which is the concatention of the interposer’s
 own OID byte string and the original mechanism’s OID byte string.</p>
+<p>Functions that do not accept a mechanism argument directly require no
+special handling, with the following exceptions:</p>
 <p>Since <strong>gss_accept_sec_context</strong> does not accept a mechanism argument,
 an interposer mechanism must, in order to invoke the original
 mechanism’s function, acquire a credential for the concatenated OID
@@ -151,20 +155,24 @@
 </div>
 <p>To re-enter the original mechanism when importing tokens for the above
 functions, the interposer module must wrap the mechanism token in the
-mechglue’s format, using the concatenated OID.  The mechglue token
-formats are:</p>
+mechglue’s format, using the concatenated OID (except in
+<strong>gss_import_name</strong>).  The mechglue token formats are:</p>
 <ul class="simple">
 <li>For <strong>gss_import_sec_context</strong>, a four-byte OID length in big-endian
-order, followed by the mechanism OID, followed by the mechanism
+order, followed by the concatenated OID, followed by the mechanism
 token.</li>
 <li>For <strong>gss_import_name</strong>, the bytes 04 01, followed by a two-byte OID
 length in big-endian order, followed by the mechanism OID, followed
-by the bytes 06, followed by the OID length as a single byte,
-followed by the mechanism OID, followed by the mechanism token.</li>
+by a four-byte token length in big-endian order, followed by the
+mechanism token.  Unlike most uses of OIDs in the API, the mechanism
+OID encoding must include the DER tag and length for an object
+identifier (06 followed by the DER length of the OID byte string),
+and this prefix must be included in the two-byte OID length.
+input_name_type must also be set to GSS_C_NT_EXPORT_NAME.</li>
 <li>For <strong>gss_import_cred</strong>, a four-byte OID length in big-endian order,
-followed by the mechanism OID, followed by a four-byte token length
-in big-endian order, followed by the mechanism token.  This sequence
-may be repeated multiple times.</li>
+followed by the concatenated OID, followed by a four-byte token
+length in big-endian order, followed by the mechanism token.  This
+sequence may be repeated multiple times.</li>
 </ul>
 </div>
 </div>
@@ -233,8 +241,8 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/hostrealm.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/hostrealm.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/internal.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/internal.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/kadm5_auth.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/kadm5_auth.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/kadm5_hook.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/kadm5_hook.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/kdcpolicy.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/kdcpolicy.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/kdcpreauth.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/kdcpreauth.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/localauth.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/localauth.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/locate.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/locate.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/profile.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/profile.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/plugindev/pwqual.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/plugindev/pwqual.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/resources.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/resources.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/search.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/search.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/searchindex.js -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/searchindex.js Changed

@@ -1 +1 @@
-Search.setIndex({docnames:"about","admin/admin_commands/index","admin/admin_commands/k5srvutil","admin/admin_commands/kadmin_local","admin/admin_commands/kadmind","admin/admin_commands/kdb5_ldap_util","admin/admin_commands/kdb5_util","admin/admin_commands/kprop","admin/admin_commands/kpropd","admin/admin_commands/kproplog","admin/admin_commands/krb5kdc","admin/admin_commands/ktutil","admin/admin_commands/sserver","admin/advanced/index","admin/advanced/retiring-des","admin/appl_servers","admin/auth_indicator","admin/backup_host","admin/conf_files/index","admin/conf_files/kadm5_acl","admin/conf_files/kdc_conf","admin/conf_files/krb5_conf","admin/conf_ldap","admin/database","admin/dbtypes","admin/dictionary","admin/enctypes","admin/env_variables","admin/host_config","admin/https","admin/index","admin/install","admin/install_appl_srv","admin/install_clients","admin/install_kdc","admin/lockout","admin/otp","admin/pkinit","admin/princ_dns","admin/realm_config","admin/spake","admin/troubleshoot","admin/various_envs","appdev/gssapi","appdev/h5l_mit_apidiff","appdev/index","appdev/init_creds","appdev/princ_handle","appdev/refs/api/index","appdev/refs/api/krb5_425_conv_principal","appdev/refs/api/krb5_524_conv_principal","appdev/refs/api/krb5_524_convert_creds","appdev/refs/api/krb5_address_compare","appdev/refs/api/krb5_address_order","appdev/refs/api/krb5_address_search","appdev/refs/api/krb5_allow_weak_crypto","appdev/refs/api/krb5_aname_to_localname","appdev/refs/api/krb5_anonymous_principal","appdev/refs/api/krb5_anonymous_realm","appdev/refs/api/krb5_appdefault_boolean","appdev/refs/api/krb5_appdefault_string","appdev/refs/api/krb5_auth_con_free","appdev/refs/api/krb5_auth_con_genaddrs","appdev/refs/api/krb5_auth_con_get_checksum_func","appdev/refs/api/krb5_auth_con_getaddrs","appdev/refs/api/krb5_auth_con_getauthenticator","appdev/refs/api/krb5_auth_con_getflags","appdev/refs/api/krb5_auth_con_getkey","appdev/refs/api/krb5_auth_con_getkey_k","appdev/refs/api/krb5_auth_con_getlocalseqnumber","appdev/refs/api/krb5_auth_con_getlocalsubkey","appdev/refs/api/krb5_auth_con_getrcache","appdev/refs/api/krb5_auth_con_getrecvsubkey","appdev/refs/api/krb5_auth_con_getrecvsubkey_k","appdev/refs/api/krb5_auth_con_getremoteseqnumber","appdev/refs/api/krb5_auth_con_getremotesubkey","appdev/refs/api/krb5_auth_con_getsendsubkey","appdev/refs/api/krb5_auth_con_getsendsubkey_k","appdev/refs/api/krb5_auth_con_init","appdev/refs/api/krb5_auth_con_initivector","appdev/refs/api/krb5_auth_con_set_checksum_func","appdev/refs/api/krb5_auth_con_set_req_cksumtype","appdev/refs/api/krb5_auth_con_setaddrs","appdev/refs/api/krb5_auth_con_setflags","appdev/refs/api/krb5_auth_con_setports","appdev/refs/api/krb5_auth_con_setrcache","appdev/refs/api/krb5_auth_con_setrecvsubkey","appdev/refs/api/krb5_auth_con_setrecvsubkey_k","appdev/refs/api/krb5_auth_con_setsendsubkey","appdev/refs/api/krb5_auth_con_setsendsubkey_k","appdev/refs/api/krb5_auth_con_setuseruserkey","appdev/refs/api/krb5_build_principal","appdev/refs/api/krb5_build_principal_alloc_va","appdev/refs/api/krb5_build_principal_ext","appdev/refs/api/krb5_build_principal_va","appdev/refs/api/krb5_c_block_size","appdev/refs/api/krb5_c_checksum_length","appdev/refs/api/krb5_c_crypto_length","appdev/refs/api/krb5_c_crypto_length_iov","appdev/refs/api/krb5_c_decrypt","appdev/refs/api/krb5_c_decrypt_iov","appdev/refs/api/krb5_c_derive_prfplus","appdev/refs/api/krb5_c_encrypt","appdev/refs/api/krb5_c_encrypt_iov","appdev/refs/api/krb5_c_encrypt_length","appdev/refs/api/krb5_c_enctype_compare","appdev/refs/api/krb5_c_free_state","appdev/refs/api/krb5_c_fx_cf2_simple","appdev/refs/api/krb5_c_init_state","appdev/refs/api/krb5_c_is_coll_proof_cksum","appdev/refs/api/krb5_c_is_keyed_cksum","appdev/refs/api/krb5_c_keyed_checksum_types","appdev/refs/api/krb5_c_keylengths","appdev/refs/api/krb5_c_make_checksum","appdev/refs/api/krb5_c_make_checksum_iov","appdev/refs/api/krb5_c_make_random_key","appdev/refs/api/krb5_c_padding_length","appdev/refs/api/krb5_c_prf","appdev/refs/api/krb5_c_prf_length","appdev/refs/api/krb5_c_prfplus","appdev/refs/api/krb5_c_random_add_entropy","appdev/refs/api/krb5_c_random_make_octets","appdev/refs/api/krb5_c_random_os_entropy","appdev/refs/api/krb5_c_random_seed","appdev/refs/api/krb5_c_random_to_key","appdev/refs/api/krb5_c_string_to_key","appdev/refs/api/krb5_c_string_to_key_with_params","appdev/refs/api/krb5_c_valid_cksumtype","appdev/refs/api/krb5_c_valid_enctype","appdev/refs/api/krb5_c_verify_checksum","appdev/refs/api/krb5_c_verify_checksum_iov","appdev/refs/api/krb5_calculate_checksum","appdev/refs/api/krb5_cc_cache_match","appdev/refs/api/krb5_cc_close","appdev/refs/api/krb5_cc_copy_creds","appdev/refs/api/krb5_cc_default","appdev/refs/api/krb5_cc_default_name","appdev/refs/api/krb5_cc_destroy","appdev/refs/api/krb5_cc_dup","appdev/refs/api/krb5_cc_end_seq_get","appdev/refs/api/krb5_cc_gen_new","appdev/refs/api/krb5_cc_get_config","appdev/refs/api/krb5_cc_get_flags","appdev/refs/api/krb5_cc_get_full_name","appdev/refs/api/krb5_cc_get_name","appdev/refs/api/krb5_cc_get_principal","appdev/refs/api/krb5_cc_get_type","appdev/refs/api/krb5_cc_initialize","appdev/refs/api/krb5_cc_move","appdev/refs/api/krb5_cc_new_unique","appdev/refs/api/krb5_cc_next_cred","appdev/refs/api/krb5_cc_remove_cred","appdev/refs/api/krb5_cc_resolve","appdev/refs/api/krb5_cc_retrieve_cred","appdev/refs/api/krb5_cc_select","appdev/refs/api/krb5_cc_set_config","appdev/refs/api/krb5_cc_set_default_name","appdev/refs/api/krb5_cc_set_flags","appdev/refs/api/krb5_cc_start_seq_get","appdev/refs/api/krb5_cc_store_cred","appdev/refs/api/krb5_cc_support_switch","appdev/refs/api/krb5_cc_switch","appdev/refs/api/krb5_cccol_cursor_free","appdev/refs/api/krb5_cccol_cursor_new","appdev/refs/api/krb5_cccol_cursor_next","appdev/refs/api/krb5_cccol_have_content","appdev/refs/api/krb5_change_password","appdev/refs/api/krb5_check_clockskew","appdev/refs/api/krb5_checksum_size","appdev/refs/api/krb5_chpw_message","appdev/refs/api/krb5_cksumtype_to_string","appdev/refs/api/krb5_clear_error_message","appdev/refs/api/krb5_copy_addresses","appdev/refs/api/krb5_copy_authdata","appdev/refs/api/krb5_copy_authenticator","appdev/refs/api/krb5_copy_checksum","appdev/refs/api/krb5_copy_context","appdev/refs/api/krb5_copy_creds","appdev/refs/api/krb5_copy_data","appdev/refs/api/krb5_copy_error_message","appdev/refs/api/krb5_copy_keyblock","appdev/refs/api/krb5_copy_keyblock_contents","appdev/refs/api/krb5_copy_principal","appdev/refs/api/krb5_copy_ticket","appdev/refs/api/krb5_decode_authdata_container","appdev/refs/api/krb5_decode_ticket","appdev/refs/api/krb5_decrypt","appdev/refs/api/krb5_deltat_to_string","appdev/refs/api/krb5_eblock_enctype","appdev/refs/api/krb5_encode_authdata_container","appdev/refs/api/krb5_encrypt","appdev/refs/api/krb5_encrypt_size","appdev/refs/api/krb5_enctype_to_name","appdev/refs/api/krb5_enctype_to_string","appdev/refs/api/krb5_expand_hostname","appdev/refs/api/krb5_find_authdata","appdev/refs/api/krb5_finish_key","appdev/refs/api/krb5_finish_random_key","appdev/refs/api/krb5_free_addresses","appdev/refs/api/krb5_free_ap_rep_enc_part","appdev/refs/api/krb5_free_authdata","appdev/refs/api/krb5_free_authenticator","appdev/refs/api/krb5_free_checksum","appdev/refs/api/krb5_free_checksum_contents","appdev/refs/api/krb5_free_cksumtypes","appdev/refs/api/krb5_free_context","appdev/refs/api/krb5_free_cred_contents","appdev/refs/api/krb5_free_creds","appdev/refs/api/krb5_free_data","appdev/refs/api/krb5_free_data_contents","appdev/refs/api/krb5_free_default_realm","appdev/refs/api/krb5_free_enctypes","appdev/refs/api/krb5_free_error","appdev/refs/api/krb5_free_error_message","appdev/refs/api/krb5_free_host_realm","appdev/refs/api/krb5_free_keyblock","appdev/refs/api/krb5_free_keyblock_contents","appdev/refs/api/krb5_free_keytab_entry_contents","appdev/refs/api/krb5_free_principal","appdev/refs/api/krb5_free_string","appdev/refs/api/krb5_free_tgt_creds","appdev/refs/api/krb5_free_ticket","appdev/refs/api/krb5_free_unparsed_name","appdev/refs/api/krb5_fwd_tgt_creds","appdev/refs/api/krb5_get_credentials","appdev/refs/api/krb5_get_credentials_renew","appdev/refs/api/krb5_get_credentials_validate","appdev/refs/api/krb5_get_default_realm","appdev/refs/api/krb5_get_error_message","appdev/refs/api/krb5_get_etype_info","appdev/refs/api/krb5_get_fallback_host_realm","appdev/refs/api/krb5_get_host_realm","appdev/refs/api/krb5_get_in_tkt_with_keytab","appdev/refs/api/krb5_get_in_tkt_with_password","appdev/refs/api/krb5_get_in_tkt_with_skey","appdev/refs/api/krb5_get_init_creds_keytab","appdev/refs/api/krb5_get_init_creds_opt_alloc","appdev/refs/api/krb5_get_init_creds_opt_free","appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags","appdev/refs/api/krb5_get_init_creds_opt_init","appdev/refs/api/krb5_get_init_creds_opt_set_address_list","appdev/refs/api/krb5_get_init_creds_opt_set_anonymous","appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize","appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt","appdev/refs/api/krb5_get_init_creds_opt_set_etype_list","appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name","appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags","appdev/refs/api/krb5_get_init_creds_opt_set_forwardable","appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache","appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache","appdev/refs/api/krb5_get_init_creds_opt_set_pa","appdev/refs/api/krb5_get_init_creds_opt_set_pac_request","appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list","appdev/refs/api/krb5_get_init_creds_opt_set_proxiable","appdev/refs/api/krb5_get_init_creds_opt_set_renew_life","appdev/refs/api/krb5_get_init_creds_opt_set_responder","appdev/refs/api/krb5_get_init_creds_opt_set_salt","appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life","appdev/refs/api/krb5_get_init_creds_password","appdev/refs/api/krb5_get_permitted_enctypes","appdev/refs/api/krb5_get_profile","appdev/refs/api/krb5_get_prompt_types","appdev/refs/api/krb5_get_renewed_creds","appdev/refs/api/krb5_get_server_rcache","appdev/refs/api/krb5_get_time_offsets","appdev/refs/api/krb5_get_validated_creds","appdev/refs/api/krb5_init_context","appdev/refs/api/krb5_init_context_profile","appdev/refs/api/krb5_init_creds_free","appdev/refs/api/krb5_init_creds_get","appdev/refs/api/krb5_init_creds_get_creds","appdev/refs/api/krb5_init_creds_get_error","appdev/refs/api/krb5_init_creds_get_times","appdev/refs/api/krb5_init_creds_init","appdev/refs/api/krb5_init_creds_set_keytab","appdev/refs/api/krb5_init_creds_set_password","appdev/refs/api/krb5_init_creds_set_service","appdev/refs/api/krb5_init_creds_step","appdev/refs/api/krb5_init_keyblock","appdev/refs/api/krb5_init_random_key","appdev/refs/api/krb5_init_secure_context","appdev/refs/api/krb5_is_config_principal","appdev/refs/api/krb5_is_referral_realm","appdev/refs/api/krb5_is_thread_safe","appdev/refs/api/krb5_k_create_key","appdev/refs/api/krb5_k_decrypt","appdev/refs/api/krb5_k_decrypt_iov","appdev/refs/api/krb5_k_encrypt","appdev/refs/api/krb5_k_encrypt_iov","appdev/refs/api/krb5_k_free_key","appdev/refs/api/krb5_k_key_enctype","appdev/refs/api/krb5_k_key_keyblock","appdev/refs/api/krb5_k_make_checksum","appdev/refs/api/krb5_k_make_checksum_iov","appdev/refs/api/krb5_k_prf","appdev/refs/api/krb5_k_reference_key","appdev/refs/api/krb5_k_verify_checksum","appdev/refs/api/krb5_k_verify_checksum_iov","appdev/refs/api/krb5_kt_add_entry","appdev/refs/api/krb5_kt_client_default","appdev/refs/api/krb5_kt_close","appdev/refs/api/krb5_kt_default","appdev/refs/api/krb5_kt_default_name","appdev/refs/api/krb5_kt_dup","appdev/refs/api/krb5_kt_end_seq_get","appdev/refs/api/krb5_kt_free_entry","appdev/refs/api/krb5_kt_get_entry","appdev/refs/api/krb5_kt_get_name","appdev/refs/api/krb5_kt_get_type","appdev/refs/api/krb5_kt_have_content","appdev/refs/api/krb5_kt_next_entry","appdev/refs/api/krb5_kt_read_service_key","appdev/refs/api/krb5_kt_remove_entry","appdev/refs/api/krb5_kt_resolve","appdev/refs/api/krb5_kt_start_seq_get","appdev/refs/api/krb5_kuserok","appdev/refs/api/krb5_make_authdata_kdc_issued","appdev/refs/api/krb5_merge_authdata","appdev/refs/api/krb5_mk_1cred","appdev/refs/api/krb5_mk_error","appdev/refs/api/krb5_mk_ncred","appdev/refs/api/krb5_mk_priv","appdev/refs/api/krb5_mk_rep","appdev/refs/api/krb5_mk_rep_dce","appdev/refs/api/krb5_mk_req","appdev/refs/api/krb5_mk_req_extended","appdev/refs/api/krb5_mk_safe","appdev/refs/api/krb5_os_localaddr","appdev/refs/api/krb5_pac_add_buffer","appdev/refs/api/krb5_pac_free","appdev/refs/api/krb5_pac_get_buffer","appdev/refs/api/krb5_pac_get_client_info","appdev/refs/api/krb5_pac_get_types","appdev/refs/api/krb5_pac_init","appdev/refs/api/krb5_pac_parse","appdev/refs/api/krb5_pac_sign","appdev/refs/api/krb5_pac_sign_ext","appdev/refs/api/krb5_pac_verify","appdev/refs/api/krb5_pac_verify_ext","appdev/refs/api/krb5_parse_name","appdev/refs/api/krb5_parse_name_flags","appdev/refs/api/krb5_prepend_error_message","appdev/refs/api/krb5_principal2salt","appdev/refs/api/krb5_principal_compare","appdev/refs/api/krb5_principal_compare_any_realm","appdev/refs/api/krb5_principal_compare_flags","appdev/refs/api/krb5_process_key","appdev/refs/api/krb5_prompter_posix","appdev/refs/api/krb5_random_key","appdev/refs/api/krb5_rd_cred","appdev/refs/api/krb5_rd_error","appdev/refs/api/krb5_rd_priv","appdev/refs/api/krb5_rd_rep","appdev/refs/api/krb5_rd_rep_dce","appdev/refs/api/krb5_rd_req","appdev/refs/api/krb5_rd_safe","appdev/refs/api/krb5_read_password","appdev/refs/api/krb5_realm_compare","appdev/refs/api/krb5_recvauth","appdev/refs/api/krb5_recvauth_version","appdev/refs/api/krb5_responder_get_challenge","appdev/refs/api/krb5_responder_list_questions","appdev/refs/api/krb5_responder_otp_challenge_free","appdev/refs/api/krb5_responder_otp_get_challenge","appdev/refs/api/krb5_responder_otp_set_answer","appdev/refs/api/krb5_responder_pkinit_challenge_free","appdev/refs/api/krb5_responder_pkinit_get_challenge","appdev/refs/api/krb5_responder_pkinit_set_answer","appdev/refs/api/krb5_responder_set_answer","appdev/refs/api/krb5_salttype_to_string","appdev/refs/api/krb5_sendauth","appdev/refs/api/krb5_server_decrypt_ticket_keytab","appdev/refs/api/krb5_set_default_realm","appdev/refs/api/krb5_set_default_tgs_enctypes","appdev/refs/api/krb5_set_error_message","appdev/refs/api/krb5_set_kdc_recv_hook","appdev/refs/api/krb5_set_kdc_send_hook","appdev/refs/api/krb5_set_password","appdev/refs/api/krb5_set_password_using_ccache","appdev/refs/api/krb5_set_principal_realm","appdev/refs/api/krb5_set_real_time","appdev/refs/api/krb5_set_trace_callback","appdev/refs/api/krb5_set_trace_filename","appdev/refs/api/krb5_sname_match","appdev/refs/api/krb5_sname_to_principal","appdev/refs/api/krb5_string_to_cksumtype","appdev/refs/api/krb5_string_to_deltat","appdev/refs/api/krb5_string_to_enctype","appdev/refs/api/krb5_string_to_key","appdev/refs/api/krb5_string_to_salttype","appdev/refs/api/krb5_string_to_timestamp","appdev/refs/api/krb5_timeofday","appdev/refs/api/krb5_timestamp_to_sfstring","appdev/refs/api/krb5_timestamp_to_string","appdev/refs/api/krb5_tkt_creds_free","appdev/refs/api/krb5_tkt_creds_get","appdev/refs/api/krb5_tkt_creds_get_creds","appdev/refs/api/krb5_tkt_creds_get_times","appdev/refs/api/krb5_tkt_creds_init","appdev/refs/api/krb5_tkt_creds_step","appdev/refs/api/krb5_unparse_name","appdev/refs/api/krb5_unparse_name_ext","appdev/refs/api/krb5_unparse_name_flags","appdev/refs/api/krb5_unparse_name_flags_ext","appdev/refs/api/krb5_us_timeofday","appdev/refs/api/krb5_use_enctype","appdev/refs/api/krb5_verify_authdata_kdc_issued","appdev/refs/api/krb5_verify_checksum","appdev/refs/api/krb5_verify_init_creds","appdev/refs/api/krb5_verify_init_creds_opt_init","appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail","appdev/refs/api/krb5_vprepend_error_message","appdev/refs/api/krb5_vset_error_message","appdev/refs/api/krb5_vwrap_error_message","appdev/refs/api/krb5_wrap_error_message","appdev/refs/index","appdev/refs/macros/ADDRTYPE_ADDRPORT","appdev/refs/macros/ADDRTYPE_CHAOS","appdev/refs/macros/ADDRTYPE_DDP","appdev/refs/macros/ADDRTYPE_INET","appdev/refs/macros/ADDRTYPE_INET6","appdev/refs/macros/ADDRTYPE_IPPORT","appdev/refs/macros/ADDRTYPE_ISO","appdev/refs/macros/ADDRTYPE_IS_LOCAL","appdev/refs/macros/ADDRTYPE_NETBIOS","appdev/refs/macros/ADDRTYPE_XNS","appdev/refs/macros/AD_TYPE_EXTERNAL","appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK","appdev/refs/macros/AD_TYPE_REGISTERED","appdev/refs/macros/AD_TYPE_RESERVED","appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION","appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED","appdev/refs/macros/AP_OPTS_RESERVED","appdev/refs/macros/AP_OPTS_USE_SESSION_KEY","appdev/refs/macros/AP_OPTS_USE_SUBKEY","appdev/refs/macros/AP_OPTS_WIRE_MASK","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256","appdev/refs/macros/CKSUMTYPE_CRC32","appdev/refs/macros/CKSUMTYPE_DESCBC","appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3","appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128","appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256","appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR","appdev/refs/macros/CKSUMTYPE_NIST_SHA","appdev/refs/macros/CKSUMTYPE_RSA_MD4","appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES","appdev/refs/macros/CKSUMTYPE_RSA_MD5","appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP","appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC","appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC","appdev/refs/macros/ENCTYPE_DES3_CBC_ENV","appdev/refs/macros/ENCTYPE_DES3_CBC_RAW","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1","appdev/refs/macros/ENCTYPE_DES_CBC_CRC","appdev/refs/macros/ENCTYPE_DES_CBC_MD4","appdev/refs/macros/ENCTYPE_DES_CBC_MD5","appdev/refs/macros/ENCTYPE_DES_CBC_RAW","appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1","appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS","appdev/refs/macros/ENCTYPE_MD5_RSA_CMS","appdev/refs/macros/ENCTYPE_NULL","appdev/refs/macros/ENCTYPE_RC2_CBC_ENV","appdev/refs/macros/ENCTYPE_RSA_ENV","appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV","appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS","appdev/refs/macros/ENCTYPE_UNKNOWN","appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE","appdev/refs/macros/KDC_OPT_CANONICALIZE","appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT","appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK","appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY","appdev/refs/macros/KDC_OPT_FORWARDABLE","appdev/refs/macros/KDC_OPT_FORWARDED","appdev/refs/macros/KDC_OPT_POSTDATED","appdev/refs/macros/KDC_OPT_PROXIABLE","appdev/refs/macros/KDC_OPT_PROXY","appdev/refs/macros/KDC_OPT_RENEW","appdev/refs/macros/KDC_OPT_RENEWABLE","appdev/refs/macros/KDC_OPT_RENEWABLE_OK","appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS","appdev/refs/macros/KDC_OPT_VALIDATE","appdev/refs/macros/KDC_TKT_COMMON_MASK","appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE","appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR","appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR","appdev/refs/macros/KRB5_AP_REP","appdev/refs/macros/KRB5_AP_REQ","appdev/refs/macros/KRB5_AS_REP","appdev/refs/macros/KRB5_AS_REQ","appdev/refs/macros/KRB5_AUTHDATA_AND_OR","appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS","appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR","appdev/refs/macros/KRB5_AUTHDATA_CAMMAC","appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION","appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR","appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT","appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS","appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED","appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC","appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE","appdev/refs/macros/KRB5_AUTHDATA_SESAME","appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET","appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME","appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY","appdev/refs/macros/KRB5_CRED","appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM","appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA","appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY","appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER","appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING","appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY","appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM","appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER","appdev/refs/macros/KRB5_CYBERSAFE_SECUREID","appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS","appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP","appdev/refs/macros/KRB5_ERROR","appdev/refs/macros/KRB5_FAST_REQUIRED","appdev/refs/macros/KRB5_GC_CACHED","appdev/refs/macros/KRB5_GC_CANONICALIZE","appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION","appdev/refs/macros/KRB5_GC_FORWARDABLE","appdev/refs/macros/KRB5_GC_NO_STORE","appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK","appdev/refs/macros/KRB5_GC_USER_USER","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE","appdev/refs/macros/KRB5_INIT_CONTEXT_KDC","appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE","appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE","appdev/refs/macros/KRB5_INT16_MAX","appdev/refs/macros/KRB5_INT16_MIN","appdev/refs/macros/KRB5_INT32_MAX","appdev/refs/macros/KRB5_INT32_MIN","appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE","appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE","appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT","appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS","appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC","appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC","appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV","appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED","appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET","appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS","appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE","appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST","appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE","appdev/refs/macros/KRB5_KEYUSAGE_SPAKE","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM","appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED","appdev/refs/macros/KRB5_KPASSWD_AUTHERROR","appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION","appdev/refs/macros/KRB5_KPASSWD_HARDERROR","appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED","appdev/refs/macros/KRB5_KPASSWD_MALFORMED","appdev/refs/macros/KRB5_KPASSWD_SOFTERROR","appdev/refs/macros/KRB5_KPASSWD_SUCCESS","appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME","appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL","appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL","appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED","appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME","appdev/refs/macros/KRB5_LRQ_NONE","appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME","appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL","appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL","appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED","appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME","appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL","appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID","appdev/refs/macros/KRB5_NT_PRINCIPAL","appdev/refs/macros/KRB5_NT_SMTP_NAME","appdev/refs/macros/KRB5_NT_SRV_HST","appdev/refs/macros/KRB5_NT_SRV_INST","appdev/refs/macros/KRB5_NT_SRV_XHST","appdev/refs/macros/KRB5_NT_UID","appdev/refs/macros/KRB5_NT_UNKNOWN","appdev/refs/macros/KRB5_NT_WELLKNOWN","appdev/refs/macros/KRB5_NT_X500_PRINCIPAL","appdev/refs/macros/KRB5_PAC_CLIENT_INFO","appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO","appdev/refs/macros/KRB5_PAC_DELEGATION_INFO","appdev/refs/macros/KRB5_PAC_LOGON_INFO","appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM","appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM","appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO","appdev/refs/macros/KRB5_PADATA_AFS3_SALT","appdev/refs/macros/KRB5_PADATA_AP_REQ","appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM","appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS","appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE","appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID","appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP","appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2","appdev/refs/macros/KRB5_PADATA_FOR_USER","appdev/refs/macros/KRB5_PADATA_FX_COOKIE","appdev/refs/macros/KRB5_PADATA_FX_ERROR","appdev/refs/macros/KRB5_PADATA_FX_FAST","appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA","appdev/refs/macros/KRB5_PADATA_NONE","appdev/refs/macros/KRB5_PADATA_OSF_DCE","appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE","appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE","appdev/refs/macros/KRB5_PADATA_OTP_REQUEST","appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS","appdev/refs/macros/KRB5_PADATA_PAC_REQUEST","appdev/refs/macros/KRB5_PADATA_PKINIT_KX","appdev/refs/macros/KRB5_PADATA_PK_AS_REP","appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD","appdev/refs/macros/KRB5_PADATA_PW_SALT","appdev/refs/macros/KRB5_PADATA_REFERRAL","appdev/refs/macros/KRB5_PADATA_S4U_X509_USER","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2","appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2","appdev/refs/macros/KRB5_PADATA_SESAME","appdev/refs/macros/KRB5_PADATA_SPAKE","appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO","appdev/refs/macros/KRB5_PADATA_TGS_REQ","appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT","appdev/refs/macros/KRB5_PRIV","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN","appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD","appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH","appdev/refs/macros/KRB5_PVNO","appdev/refs/macros/KRB5_REALM_BRANCH_CHAR","appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS","appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION","appdev/refs/macros/KRB5_REFERRAL_REALM","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED","appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT","appdev/refs/macros/KRB5_SAFE","appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD","appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD","appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY","appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT","appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA","appdev/refs/macros/KRB5_TC_MATCH_FLAGS","appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT","appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY","appdev/refs/macros/KRB5_TC_MATCH_KTYPE","appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY","appdev/refs/macros/KRB5_TC_MATCH_TIMES","appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT","appdev/refs/macros/KRB5_TC_NOTICKET","appdev/refs/macros/KRB5_TC_OPENCLOSE","appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES","appdev/refs/macros/KRB5_TGS_NAME","appdev/refs/macros/KRB5_TGS_NAME_SIZE","appdev/refs/macros/KRB5_TGS_REP","appdev/refs/macros/KRB5_TGS_REQ","appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE","appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL","appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR","appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK","appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY","appdev/refs/macros/MAX_KEYTAB_NAME_LEN","appdev/refs/macros/MSEC_DIRBIT","appdev/refs/macros/MSEC_VAL_MASK","appdev/refs/macros/SALT_TYPE_AFS_LENGTH","appdev/refs/macros/SALT_TYPE_NO_LENGTH","appdev/refs/macros/THREEPARAMOPEN","appdev/refs/macros/TKT_FLG_ANONYMOUS","appdev/refs/macros/TKT_FLG_ENC_PA_REP","appdev/refs/macros/TKT_FLG_FORWARDABLE","appdev/refs/macros/TKT_FLG_FORWARDED","appdev/refs/macros/TKT_FLG_HW_AUTH","appdev/refs/macros/TKT_FLG_INITIAL","appdev/refs/macros/TKT_FLG_INVALID","appdev/refs/macros/TKT_FLG_MAY_POSTDATE","appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE","appdev/refs/macros/TKT_FLG_POSTDATED","appdev/refs/macros/TKT_FLG_PRE_AUTH","appdev/refs/macros/TKT_FLG_PROXIABLE","appdev/refs/macros/TKT_FLG_PROXY","appdev/refs/macros/TKT_FLG_RENEWABLE","appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED","appdev/refs/macros/VALID_INT_BITS","appdev/refs/macros/VALID_UINT_BITS","appdev/refs/macros/index","appdev/refs/macros/krb524_convert_creds_kdc","appdev/refs/macros/krb524_init_ets","appdev/refs/macros/krb5_const","appdev/refs/macros/krb5_princ_component","appdev/refs/macros/krb5_princ_name","appdev/refs/macros/krb5_princ_realm","appdev/refs/macros/krb5_princ_set_realm","appdev/refs/macros/krb5_princ_set_realm_data","appdev/refs/macros/krb5_princ_set_realm_length","appdev/refs/macros/krb5_princ_size","appdev/refs/macros/krb5_princ_type","appdev/refs/macros/krb5_roundup","appdev/refs/macros/krb5_x","appdev/refs/macros/krb5_xc","appdev/refs/types/index","appdev/refs/types/krb5_address","appdev/refs/types/krb5_addrtype","appdev/refs/types/krb5_ap_rep","appdev/refs/types/krb5_ap_rep_enc_part","appdev/refs/types/krb5_ap_req","appdev/refs/types/krb5_auth_context","appdev/refs/types/krb5_authdata","appdev/refs/types/krb5_authdatatype","appdev/refs/types/krb5_authenticator","appdev/refs/types/krb5_boolean","appdev/refs/types/krb5_cc_cursor","appdev/refs/types/krb5_ccache","appdev/refs/types/krb5_cccol_cursor","appdev/refs/types/krb5_checksum","appdev/refs/types/krb5_cksumtype","appdev/refs/types/krb5_const_pointer","appdev/refs/types/krb5_const_principal","appdev/refs/types/krb5_context","appdev/refs/types/krb5_cred","appdev/refs/types/krb5_cred_enc_part","appdev/refs/types/krb5_cred_info","appdev/refs/types/krb5_creds","appdev/refs/types/krb5_crypto_iov","appdev/refs/types/krb5_cryptotype","appdev/refs/types/krb5_data","appdev/refs/types/krb5_deltat","appdev/refs/types/krb5_enc_data","appdev/refs/types/krb5_enc_kdc_rep_part","appdev/refs/types/krb5_enc_tkt_part","appdev/refs/types/krb5_encrypt_block","appdev/refs/types/krb5_enctype","appdev/refs/types/krb5_error","appdev/refs/types/krb5_error_code","appdev/refs/types/krb5_expire_callback_func","appdev/refs/types/krb5_flags","appdev/refs/types/krb5_get_init_creds_opt","appdev/refs/types/krb5_gic_opt_pa_data","appdev/refs/types/krb5_init_creds_context","appdev/refs/types/krb5_int16","appdev/refs/types/krb5_int32","appdev/refs/types/krb5_kdc_rep","appdev/refs/types/krb5_kdc_req","appdev/refs/types/krb5_key","appdev/refs/types/krb5_keyblock","appdev/refs/types/krb5_keytab","appdev/refs/types/krb5_keytab_entry","appdev/refs/types/krb5_keyusage","appdev/refs/types/krb5_kt_cursor","appdev/refs/types/krb5_kvno","appdev/refs/types/krb5_last_req_entry","appdev/refs/types/krb5_magic","appdev/refs/types/krb5_mk_req_checksum_func","appdev/refs/types/krb5_msgtype","appdev/refs/types/krb5_octet","appdev/refs/types/krb5_pa_data","appdev/refs/types/krb5_pa_pac_req","appdev/refs/types/krb5_pa_server_referral_data","appdev/refs/types/krb5_pa_svr_referral_data","appdev/refs/types/krb5_pac","appdev/refs/types/krb5_pointer","appdev/refs/types/krb5_post_recv_fn","appdev/refs/types/krb5_pre_send_fn","appdev/refs/types/krb5_preauthtype","appdev/refs/types/krb5_principal","appdev/refs/types/krb5_principal_data","appdev/refs/types/krb5_prompt","appdev/refs/types/krb5_prompt_type","appdev/refs/types/krb5_prompter_fct","appdev/refs/types/krb5_pwd_data","appdev/refs/types/krb5_rcache","appdev/refs/types/krb5_replay_data","appdev/refs/types/krb5_responder_context","appdev/refs/types/krb5_responder_fn","appdev/refs/types/krb5_responder_otp_challenge","appdev/refs/types/krb5_responder_otp_tokeninfo","appdev/refs/types/krb5_responder_pkinit_challenge","appdev/refs/types/krb5_responder_pkinit_identity","appdev/refs/types/krb5_response","appdev/refs/types/krb5_ticket","appdev/refs/types/krb5_ticket_times","appdev/refs/types/krb5_timestamp","appdev/refs/types/krb5_tkt_authent","appdev/refs/types/krb5_tkt_creds_context","appdev/refs/types/krb5_trace_callback","appdev/refs/types/krb5_trace_info","appdev/refs/types/krb5_transited","appdev/refs/types/krb5_typed_data","appdev/refs/types/krb5_ui_2","appdev/refs/types/krb5_ui_4","appdev/refs/types/krb5_verify_init_creds_opt","appdev/refs/types/passwd_phrase_element","appdev/y2038","basic/ccache_def","basic/date_format","basic/index","basic/keytab_def","basic/rcache_def","basic/stash_file_def","build/directory_org","build/doing_build","build/index","build/options2configure","build/osconf","build_this","copyright","formats/ccache_file_format","formats/cookie","formats/freshness_token","formats/index","formats/keytab_file_format","formats/rcache_file_format","index","mitK5defaults","mitK5features","mitK5license","plugindev/ccselect","plugindev/certauth","plugindev/clpreauth","plugindev/general","plugindev/gssapi","plugindev/hostrealm","plugindev/index","plugindev/internal","plugindev/kadm5_auth","plugindev/kadm5_hook","plugindev/kdcpolicy","plugindev/kdcpreauth","plugindev/localauth","plugindev/locate","plugindev/profile","plugindev/pwqual","resources","user/index","user/pwd_mgmt","user/tkt_mgmt","user/user_commands/index","user/user_commands/kdestroy","user/user_commands/kinit","user/user_commands/klist","user/user_commands/kpasswd","user/user_commands/krb5-config","user/user_commands/ksu","user/user_commands/kswitch","user/user_commands/kvno","user/user_commands/sclient","user/user_config/index","user/user_config/k5identity","user/user_config/k5login","user/user_config/kerberos",envversion:52,filenames:"about.rst","admin/admin_commands/index.rst","admin/admin_commands/k5srvutil.rst","admin/admin_commands/kadmin_local.rst","admin/admin_commands/kadmind.rst","admin/admin_commands/kdb5_ldap_util.rst","admin/admin_commands/kdb5_util.rst","admin/admin_commands/kprop.rst","admin/admin_commands/kpropd.rst","admin/admin_commands/kproplog.rst","admin/admin_commands/krb5kdc.rst","admin/admin_commands/ktutil.rst","admin/admin_commands/sserver.rst","admin/advanced/index.rst","admin/advanced/retiring-des.rst","admin/appl_servers.rst","admin/auth_indicator.rst","admin/backup_host.rst","admin/conf_files/index.rst","admin/conf_files/kadm5_acl.rst","admin/conf_files/kdc_conf.rst","admin/conf_files/krb5_conf.rst","admin/conf_ldap.rst","admin/database.rst","admin/dbtypes.rst","admin/dictionary.rst","admin/enctypes.rst","admin/env_variables.rst","admin/host_config.rst","admin/https.rst","admin/index.rst","admin/install.rst","admin/install_appl_srv.rst","admin/install_clients.rst","admin/install_kdc.rst","admin/lockout.rst","admin/otp.rst","admin/pkinit.rst","admin/princ_dns.rst","admin/realm_config.rst","admin/spake.rst","admin/troubleshoot.rst","admin/various_envs.rst","appdev/gssapi.rst","appdev/h5l_mit_apidiff.rst","appdev/index.rst","appdev/init_creds.rst","appdev/princ_handle.rst","appdev/refs/api/index.rst","appdev/refs/api/krb5_425_conv_principal.rst","appdev/refs/api/krb5_524_conv_principal.rst","appdev/refs/api/krb5_524_convert_creds.rst","appdev/refs/api/krb5_address_compare.rst","appdev/refs/api/krb5_address_order.rst","appdev/refs/api/krb5_address_search.rst","appdev/refs/api/krb5_allow_weak_crypto.rst","appdev/refs/api/krb5_aname_to_localname.rst","appdev/refs/api/krb5_anonymous_principal.rst","appdev/refs/api/krb5_anonymous_realm.rst","appdev/refs/api/krb5_appdefault_boolean.rst","appdev/refs/api/krb5_appdefault_string.rst","appdev/refs/api/krb5_auth_con_free.rst","appdev/refs/api/krb5_auth_con_genaddrs.rst","appdev/refs/api/krb5_auth_con_get_checksum_func.rst","appdev/refs/api/krb5_auth_con_getaddrs.rst","appdev/refs/api/krb5_auth_con_getauthenticator.rst","appdev/refs/api/krb5_auth_con_getflags.rst","appdev/refs/api/krb5_auth_con_getkey.rst","appdev/refs/api/krb5_auth_con_getkey_k.rst","appdev/refs/api/krb5_auth_con_getlocalseqnumber.rst","appdev/refs/api/krb5_auth_con_getlocalsubkey.rst","appdev/refs/api/krb5_auth_con_getrcache.rst","appdev/refs/api/krb5_auth_con_getrecvsubkey.rst","appdev/refs/api/krb5_auth_con_getrecvsubkey_k.rst","appdev/refs/api/krb5_auth_con_getremoteseqnumber.rst","appdev/refs/api/krb5_auth_con_getremotesubkey.rst","appdev/refs/api/krb5_auth_con_getsendsubkey.rst","appdev/refs/api/krb5_auth_con_getsendsubkey_k.rst","appdev/refs/api/krb5_auth_con_init.rst","appdev/refs/api/krb5_auth_con_initivector.rst","appdev/refs/api/krb5_auth_con_set_checksum_func.rst","appdev/refs/api/krb5_auth_con_set_req_cksumtype.rst","appdev/refs/api/krb5_auth_con_setaddrs.rst","appdev/refs/api/krb5_auth_con_setflags.rst","appdev/refs/api/krb5_auth_con_setports.rst","appdev/refs/api/krb5_auth_con_setrcache.rst","appdev/refs/api/krb5_auth_con_setrecvsubkey.rst","appdev/refs/api/krb5_auth_con_setrecvsubkey_k.rst","appdev/refs/api/krb5_auth_con_setsendsubkey.rst","appdev/refs/api/krb5_auth_con_setsendsubkey_k.rst","appdev/refs/api/krb5_auth_con_setuseruserkey.rst","appdev/refs/api/krb5_build_principal.rst","appdev/refs/api/krb5_build_principal_alloc_va.rst","appdev/refs/api/krb5_build_principal_ext.rst","appdev/refs/api/krb5_build_principal_va.rst","appdev/refs/api/krb5_c_block_size.rst","appdev/refs/api/krb5_c_checksum_length.rst","appdev/refs/api/krb5_c_crypto_length.rst","appdev/refs/api/krb5_c_crypto_length_iov.rst","appdev/refs/api/krb5_c_decrypt.rst","appdev/refs/api/krb5_c_decrypt_iov.rst","appdev/refs/api/krb5_c_derive_prfplus.rst","appdev/refs/api/krb5_c_encrypt.rst","appdev/refs/api/krb5_c_encrypt_iov.rst","appdev/refs/api/krb5_c_encrypt_length.rst","appdev/refs/api/krb5_c_enctype_compare.rst","appdev/refs/api/krb5_c_free_state.rst","appdev/refs/api/krb5_c_fx_cf2_simple.rst","appdev/refs/api/krb5_c_init_state.rst","appdev/refs/api/krb5_c_is_coll_proof_cksum.rst","appdev/refs/api/krb5_c_is_keyed_cksum.rst","appdev/refs/api/krb5_c_keyed_checksum_types.rst","appdev/refs/api/krb5_c_keylengths.rst","appdev/refs/api/krb5_c_make_checksum.rst","appdev/refs/api/krb5_c_make_checksum_iov.rst","appdev/refs/api/krb5_c_make_random_key.rst","appdev/refs/api/krb5_c_padding_length.rst","appdev/refs/api/krb5_c_prf.rst","appdev/refs/api/krb5_c_prf_length.rst","appdev/refs/api/krb5_c_prfplus.rst","appdev/refs/api/krb5_c_random_add_entropy.rst","appdev/refs/api/krb5_c_random_make_octets.rst","appdev/refs/api/krb5_c_random_os_entropy.rst","appdev/refs/api/krb5_c_random_seed.rst","appdev/refs/api/krb5_c_random_to_key.rst","appdev/refs/api/krb5_c_string_to_key.rst","appdev/refs/api/krb5_c_string_to_key_with_params.rst","appdev/refs/api/krb5_c_valid_cksumtype.rst","appdev/refs/api/krb5_c_valid_enctype.rst","appdev/refs/api/krb5_c_verify_checksum.rst","appdev/refs/api/krb5_c_verify_checksum_iov.rst","appdev/refs/api/krb5_calculate_checksum.rst","appdev/refs/api/krb5_cc_cache_match.rst","appdev/refs/api/krb5_cc_close.rst","appdev/refs/api/krb5_cc_copy_creds.rst","appdev/refs/api/krb5_cc_default.rst","appdev/refs/api/krb5_cc_default_name.rst","appdev/refs/api/krb5_cc_destroy.rst","appdev/refs/api/krb5_cc_dup.rst","appdev/refs/api/krb5_cc_end_seq_get.rst","appdev/refs/api/krb5_cc_gen_new.rst","appdev/refs/api/krb5_cc_get_config.rst","appdev/refs/api/krb5_cc_get_flags.rst","appdev/refs/api/krb5_cc_get_full_name.rst","appdev/refs/api/krb5_cc_get_name.rst","appdev/refs/api/krb5_cc_get_principal.rst","appdev/refs/api/krb5_cc_get_type.rst","appdev/refs/api/krb5_cc_initialize.rst","appdev/refs/api/krb5_cc_move.rst","appdev/refs/api/krb5_cc_new_unique.rst","appdev/refs/api/krb5_cc_next_cred.rst","appdev/refs/api/krb5_cc_remove_cred.rst","appdev/refs/api/krb5_cc_resolve.rst","appdev/refs/api/krb5_cc_retrieve_cred.rst","appdev/refs/api/krb5_cc_select.rst","appdev/refs/api/krb5_cc_set_config.rst","appdev/refs/api/krb5_cc_set_default_name.rst","appdev/refs/api/krb5_cc_set_flags.rst","appdev/refs/api/krb5_cc_start_seq_get.rst","appdev/refs/api/krb5_cc_store_cred.rst","appdev/refs/api/krb5_cc_support_switch.rst","appdev/refs/api/krb5_cc_switch.rst","appdev/refs/api/krb5_cccol_cursor_free.rst","appdev/refs/api/krb5_cccol_cursor_new.rst","appdev/refs/api/krb5_cccol_cursor_next.rst","appdev/refs/api/krb5_cccol_have_content.rst","appdev/refs/api/krb5_change_password.rst","appdev/refs/api/krb5_check_clockskew.rst","appdev/refs/api/krb5_checksum_size.rst","appdev/refs/api/krb5_chpw_message.rst","appdev/refs/api/krb5_cksumtype_to_string.rst","appdev/refs/api/krb5_clear_error_message.rst","appdev/refs/api/krb5_copy_addresses.rst","appdev/refs/api/krb5_copy_authdata.rst","appdev/refs/api/krb5_copy_authenticator.rst","appdev/refs/api/krb5_copy_checksum.rst","appdev/refs/api/krb5_copy_context.rst","appdev/refs/api/krb5_copy_creds.rst","appdev/refs/api/krb5_copy_data.rst","appdev/refs/api/krb5_copy_error_message.rst","appdev/refs/api/krb5_copy_keyblock.rst","appdev/refs/api/krb5_copy_keyblock_contents.rst","appdev/refs/api/krb5_copy_principal.rst","appdev/refs/api/krb5_copy_ticket.rst","appdev/refs/api/krb5_decode_authdata_container.rst","appdev/refs/api/krb5_decode_ticket.rst","appdev/refs/api/krb5_decrypt.rst","appdev/refs/api/krb5_deltat_to_string.rst","appdev/refs/api/krb5_eblock_enctype.rst","appdev/refs/api/krb5_encode_authdata_container.rst","appdev/refs/api/krb5_encrypt.rst","appdev/refs/api/krb5_encrypt_size.rst","appdev/refs/api/krb5_enctype_to_name.rst","appdev/refs/api/krb5_enctype_to_string.rst","appdev/refs/api/krb5_expand_hostname.rst","appdev/refs/api/krb5_find_authdata.rst","appdev/refs/api/krb5_finish_key.rst","appdev/refs/api/krb5_finish_random_key.rst","appdev/refs/api/krb5_free_addresses.rst","appdev/refs/api/krb5_free_ap_rep_enc_part.rst","appdev/refs/api/krb5_free_authdata.rst","appdev/refs/api/krb5_free_authenticator.rst","appdev/refs/api/krb5_free_checksum.rst","appdev/refs/api/krb5_free_checksum_contents.rst","appdev/refs/api/krb5_free_cksumtypes.rst","appdev/refs/api/krb5_free_context.rst","appdev/refs/api/krb5_free_cred_contents.rst","appdev/refs/api/krb5_free_creds.rst","appdev/refs/api/krb5_free_data.rst","appdev/refs/api/krb5_free_data_contents.rst","appdev/refs/api/krb5_free_default_realm.rst","appdev/refs/api/krb5_free_enctypes.rst","appdev/refs/api/krb5_free_error.rst","appdev/refs/api/krb5_free_error_message.rst","appdev/refs/api/krb5_free_host_realm.rst","appdev/refs/api/krb5_free_keyblock.rst","appdev/refs/api/krb5_free_keyblock_contents.rst","appdev/refs/api/krb5_free_keytab_entry_contents.rst","appdev/refs/api/krb5_free_principal.rst","appdev/refs/api/krb5_free_string.rst","appdev/refs/api/krb5_free_tgt_creds.rst","appdev/refs/api/krb5_free_ticket.rst","appdev/refs/api/krb5_free_unparsed_name.rst","appdev/refs/api/krb5_fwd_tgt_creds.rst","appdev/refs/api/krb5_get_credentials.rst","appdev/refs/api/krb5_get_credentials_renew.rst","appdev/refs/api/krb5_get_credentials_validate.rst","appdev/refs/api/krb5_get_default_realm.rst","appdev/refs/api/krb5_get_error_message.rst","appdev/refs/api/krb5_get_etype_info.rst","appdev/refs/api/krb5_get_fallback_host_realm.rst","appdev/refs/api/krb5_get_host_realm.rst","appdev/refs/api/krb5_get_in_tkt_with_keytab.rst","appdev/refs/api/krb5_get_in_tkt_with_password.rst","appdev/refs/api/krb5_get_in_tkt_with_skey.rst","appdev/refs/api/krb5_get_init_creds_keytab.rst","appdev/refs/api/krb5_get_init_creds_opt_alloc.rst","appdev/refs/api/krb5_get_init_creds_opt_free.rst","appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags.rst","appdev/refs/api/krb5_get_init_creds_opt_init.rst","appdev/refs/api/krb5_get_init_creds_opt_set_address_list.rst","appdev/refs/api/krb5_get_init_creds_opt_set_anonymous.rst","appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize.rst","appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt.rst","appdev/refs/api/krb5_get_init_creds_opt_set_etype_list.rst","appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback.rst","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache.rst","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name.rst","appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags.rst","appdev/refs/api/krb5_get_init_creds_opt_set_forwardable.rst","appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache.rst","appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache.rst","appdev/refs/api/krb5_get_init_creds_opt_set_pa.rst","appdev/refs/api/krb5_get_init_creds_opt_set_pac_request.rst","appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list.rst","appdev/refs/api/krb5_get_init_creds_opt_set_proxiable.rst","appdev/refs/api/krb5_get_init_creds_opt_set_renew_life.rst","appdev/refs/api/krb5_get_init_creds_opt_set_responder.rst","appdev/refs/api/krb5_get_init_creds_opt_set_salt.rst","appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life.rst","appdev/refs/api/krb5_get_init_creds_password.rst","appdev/refs/api/krb5_get_permitted_enctypes.rst","appdev/refs/api/krb5_get_profile.rst","appdev/refs/api/krb5_get_prompt_types.rst","appdev/refs/api/krb5_get_renewed_creds.rst","appdev/refs/api/krb5_get_server_rcache.rst","appdev/refs/api/krb5_get_time_offsets.rst","appdev/refs/api/krb5_get_validated_creds.rst","appdev/refs/api/krb5_init_context.rst","appdev/refs/api/krb5_init_context_profile.rst","appdev/refs/api/krb5_init_creds_free.rst","appdev/refs/api/krb5_init_creds_get.rst","appdev/refs/api/krb5_init_creds_get_creds.rst","appdev/refs/api/krb5_init_creds_get_error.rst","appdev/refs/api/krb5_init_creds_get_times.rst","appdev/refs/api/krb5_init_creds_init.rst","appdev/refs/api/krb5_init_creds_set_keytab.rst","appdev/refs/api/krb5_init_creds_set_password.rst","appdev/refs/api/krb5_init_creds_set_service.rst","appdev/refs/api/krb5_init_creds_step.rst","appdev/refs/api/krb5_init_keyblock.rst","appdev/refs/api/krb5_init_random_key.rst","appdev/refs/api/krb5_init_secure_context.rst","appdev/refs/api/krb5_is_config_principal.rst","appdev/refs/api/krb5_is_referral_realm.rst","appdev/refs/api/krb5_is_thread_safe.rst","appdev/refs/api/krb5_k_create_key.rst","appdev/refs/api/krb5_k_decrypt.rst","appdev/refs/api/krb5_k_decrypt_iov.rst","appdev/refs/api/krb5_k_encrypt.rst","appdev/refs/api/krb5_k_encrypt_iov.rst","appdev/refs/api/krb5_k_free_key.rst","appdev/refs/api/krb5_k_key_enctype.rst","appdev/refs/api/krb5_k_key_keyblock.rst","appdev/refs/api/krb5_k_make_checksum.rst","appdev/refs/api/krb5_k_make_checksum_iov.rst","appdev/refs/api/krb5_k_prf.rst","appdev/refs/api/krb5_k_reference_key.rst","appdev/refs/api/krb5_k_verify_checksum.rst","appdev/refs/api/krb5_k_verify_checksum_iov.rst","appdev/refs/api/krb5_kt_add_entry.rst","appdev/refs/api/krb5_kt_client_default.rst","appdev/refs/api/krb5_kt_close.rst","appdev/refs/api/krb5_kt_default.rst","appdev/refs/api/krb5_kt_default_name.rst","appdev/refs/api/krb5_kt_dup.rst","appdev/refs/api/krb5_kt_end_seq_get.rst","appdev/refs/api/krb5_kt_free_entry.rst","appdev/refs/api/krb5_kt_get_entry.rst","appdev/refs/api/krb5_kt_get_name.rst","appdev/refs/api/krb5_kt_get_type.rst","appdev/refs/api/krb5_kt_have_content.rst","appdev/refs/api/krb5_kt_next_entry.rst","appdev/refs/api/krb5_kt_read_service_key.rst","appdev/refs/api/krb5_kt_remove_entry.rst","appdev/refs/api/krb5_kt_resolve.rst","appdev/refs/api/krb5_kt_start_seq_get.rst","appdev/refs/api/krb5_kuserok.rst","appdev/refs/api/krb5_make_authdata_kdc_issued.rst","appdev/refs/api/krb5_merge_authdata.rst","appdev/refs/api/krb5_mk_1cred.rst","appdev/refs/api/krb5_mk_error.rst","appdev/refs/api/krb5_mk_ncred.rst","appdev/refs/api/krb5_mk_priv.rst","appdev/refs/api/krb5_mk_rep.rst","appdev/refs/api/krb5_mk_rep_dce.rst","appdev/refs/api/krb5_mk_req.rst","appdev/refs/api/krb5_mk_req_extended.rst","appdev/refs/api/krb5_mk_safe.rst","appdev/refs/api/krb5_os_localaddr.rst","appdev/refs/api/krb5_pac_add_buffer.rst","appdev/refs/api/krb5_pac_free.rst","appdev/refs/api/krb5_pac_get_buffer.rst","appdev/refs/api/krb5_pac_get_client_info.rst","appdev/refs/api/krb5_pac_get_types.rst","appdev/refs/api/krb5_pac_init.rst","appdev/refs/api/krb5_pac_parse.rst","appdev/refs/api/krb5_pac_sign.rst","appdev/refs/api/krb5_pac_sign_ext.rst","appdev/refs/api/krb5_pac_verify.rst","appdev/refs/api/krb5_pac_verify_ext.rst","appdev/refs/api/krb5_parse_name.rst","appdev/refs/api/krb5_parse_name_flags.rst","appdev/refs/api/krb5_prepend_error_message.rst","appdev/refs/api/krb5_principal2salt.rst","appdev/refs/api/krb5_principal_compare.rst","appdev/refs/api/krb5_principal_compare_any_realm.rst","appdev/refs/api/krb5_principal_compare_flags.rst","appdev/refs/api/krb5_process_key.rst","appdev/refs/api/krb5_prompter_posix.rst","appdev/refs/api/krb5_random_key.rst","appdev/refs/api/krb5_rd_cred.rst","appdev/refs/api/krb5_rd_error.rst","appdev/refs/api/krb5_rd_priv.rst","appdev/refs/api/krb5_rd_rep.rst","appdev/refs/api/krb5_rd_rep_dce.rst","appdev/refs/api/krb5_rd_req.rst","appdev/refs/api/krb5_rd_safe.rst","appdev/refs/api/krb5_read_password.rst","appdev/refs/api/krb5_realm_compare.rst","appdev/refs/api/krb5_recvauth.rst","appdev/refs/api/krb5_recvauth_version.rst","appdev/refs/api/krb5_responder_get_challenge.rst","appdev/refs/api/krb5_responder_list_questions.rst","appdev/refs/api/krb5_responder_otp_challenge_free.rst","appdev/refs/api/krb5_responder_otp_get_challenge.rst","appdev/refs/api/krb5_responder_otp_set_answer.rst","appdev/refs/api/krb5_responder_pkinit_challenge_free.rst","appdev/refs/api/krb5_responder_pkinit_get_challenge.rst","appdev/refs/api/krb5_responder_pkinit_set_answer.rst","appdev/refs/api/krb5_responder_set_answer.rst","appdev/refs/api/krb5_salttype_to_string.rst","appdev/refs/api/krb5_sendauth.rst","appdev/refs/api/krb5_server_decrypt_ticket_keytab.rst","appdev/refs/api/krb5_set_default_realm.rst","appdev/refs/api/krb5_set_default_tgs_enctypes.rst","appdev/refs/api/krb5_set_error_message.rst","appdev/refs/api/krb5_set_kdc_recv_hook.rst","appdev/refs/api/krb5_set_kdc_send_hook.rst","appdev/refs/api/krb5_set_password.rst","appdev/refs/api/krb5_set_password_using_ccache.rst","appdev/refs/api/krb5_set_principal_realm.rst","appdev/refs/api/krb5_set_real_time.rst","appdev/refs/api/krb5_set_trace_callback.rst","appdev/refs/api/krb5_set_trace_filename.rst","appdev/refs/api/krb5_sname_match.rst","appdev/refs/api/krb5_sname_to_principal.rst","appdev/refs/api/krb5_string_to_cksumtype.rst","appdev/refs/api/krb5_string_to_deltat.rst","appdev/refs/api/krb5_string_to_enctype.rst","appdev/refs/api/krb5_string_to_key.rst","appdev/refs/api/krb5_string_to_salttype.rst","appdev/refs/api/krb5_string_to_timestamp.rst","appdev/refs/api/krb5_timeofday.rst","appdev/refs/api/krb5_timestamp_to_sfstring.rst","appdev/refs/api/krb5_timestamp_to_string.rst","appdev/refs/api/krb5_tkt_creds_free.rst","appdev/refs/api/krb5_tkt_creds_get.rst","appdev/refs/api/krb5_tkt_creds_get_creds.rst","appdev/refs/api/krb5_tkt_creds_get_times.rst","appdev/refs/api/krb5_tkt_creds_init.rst","appdev/refs/api/krb5_tkt_creds_step.rst","appdev/refs/api/krb5_unparse_name.rst","appdev/refs/api/krb5_unparse_name_ext.rst","appdev/refs/api/krb5_unparse_name_flags.rst","appdev/refs/api/krb5_unparse_name_flags_ext.rst","appdev/refs/api/krb5_us_timeofday.rst","appdev/refs/api/krb5_use_enctype.rst","appdev/refs/api/krb5_verify_authdata_kdc_issued.rst","appdev/refs/api/krb5_verify_checksum.rst","appdev/refs/api/krb5_verify_init_creds.rst","appdev/refs/api/krb5_verify_init_creds_opt_init.rst","appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail.rst","appdev/refs/api/krb5_vprepend_error_message.rst","appdev/refs/api/krb5_vset_error_message.rst","appdev/refs/api/krb5_vwrap_error_message.rst","appdev/refs/api/krb5_wrap_error_message.rst","appdev/refs/index.rst","appdev/refs/macros/ADDRTYPE_ADDRPORT.rst","appdev/refs/macros/ADDRTYPE_CHAOS.rst","appdev/refs/macros/ADDRTYPE_DDP.rst","appdev/refs/macros/ADDRTYPE_INET.rst","appdev/refs/macros/ADDRTYPE_INET6.rst","appdev/refs/macros/ADDRTYPE_IPPORT.rst","appdev/refs/macros/ADDRTYPE_ISO.rst","appdev/refs/macros/ADDRTYPE_IS_LOCAL.rst","appdev/refs/macros/ADDRTYPE_NETBIOS.rst","appdev/refs/macros/ADDRTYPE_XNS.rst","appdev/refs/macros/AD_TYPE_EXTERNAL.rst","appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK.rst","appdev/refs/macros/AD_TYPE_REGISTERED.rst","appdev/refs/macros/AD_TYPE_RESERVED.rst","appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION.rst","appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED.rst","appdev/refs/macros/AP_OPTS_RESERVED.rst","appdev/refs/macros/AP_OPTS_USE_SESSION_KEY.rst","appdev/refs/macros/AP_OPTS_USE_SUBKEY.rst","appdev/refs/macros/AP_OPTS_WIRE_MASK.rst","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128.rst","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256.rst","appdev/refs/macros/CKSUMTYPE_CRC32.rst","appdev/refs/macros/CKSUMTYPE_DESCBC.rst","appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256.rst","appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR.rst","appdev/refs/macros/CKSUMTYPE_NIST_SHA.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD4.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD5.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES.rst","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96.rst","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128.rst","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96.rst","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192.rst","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC.rst","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP.rst","appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC.rst","appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_ENV.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_RAW.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1.rst","appdev/refs/macros/ENCTYPE_DES_CBC_CRC.rst","appdev/refs/macros/ENCTYPE_DES_CBC_MD4.rst","appdev/refs/macros/ENCTYPE_DES_CBC_MD5.rst","appdev/refs/macros/ENCTYPE_DES_CBC_RAW.rst","appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1.rst","appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS.rst","appdev/refs/macros/ENCTYPE_MD5_RSA_CMS.rst","appdev/refs/macros/ENCTYPE_NULL.rst","appdev/refs/macros/ENCTYPE_RC2_CBC_ENV.rst","appdev/refs/macros/ENCTYPE_RSA_ENV.rst","appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV.rst","appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS.rst","appdev/refs/macros/ENCTYPE_UNKNOWN.rst","appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE.rst","appdev/refs/macros/KDC_OPT_CANONICALIZE.rst","appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT.rst","appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK.rst","appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY.rst","appdev/refs/macros/KDC_OPT_FORWARDABLE.rst","appdev/refs/macros/KDC_OPT_FORWARDED.rst","appdev/refs/macros/KDC_OPT_POSTDATED.rst","appdev/refs/macros/KDC_OPT_PROXIABLE.rst","appdev/refs/macros/KDC_OPT_PROXY.rst","appdev/refs/macros/KDC_OPT_RENEW.rst","appdev/refs/macros/KDC_OPT_RENEWABLE.rst","appdev/refs/macros/KDC_OPT_RENEWABLE_OK.rst","appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS.rst","appdev/refs/macros/KDC_OPT_VALIDATE.rst","appdev/refs/macros/KDC_TKT_COMMON_MASK.rst","appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE.rst","appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR.rst","appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR.rst","appdev/refs/macros/KRB5_AP_REP.rst","appdev/refs/macros/KRB5_AP_REQ.rst","appdev/refs/macros/KRB5_AS_REP.rst","appdev/refs/macros/KRB5_AS_REQ.rst","appdev/refs/macros/KRB5_AUTHDATA_AND_OR.rst","appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS.rst","appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR.rst","appdev/refs/macros/KRB5_AUTHDATA_CAMMAC.rst","appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION.rst","appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR.rst","appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT.rst","appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS.rst","appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED.rst","appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC.rst","appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE.rst","appdev/refs/macros/KRB5_AUTHDATA_SESAME.rst","appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET.rst","appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY.rst","appdev/refs/macros/KRB5_CRED.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER.rst","appdev/refs/macros/KRB5_CYBERSAFE_SECUREID.rst","appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS.rst","appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP.rst","appdev/refs/macros/KRB5_ERROR.rst","appdev/refs/macros/KRB5_FAST_REQUIRED.rst","appdev/refs/macros/KRB5_GC_CACHED.rst","appdev/refs/macros/KRB5_GC_CANONICALIZE.rst","appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION.rst","appdev/refs/macros/KRB5_GC_FORWARDABLE.rst","appdev/refs/macros/KRB5_GC_NO_STORE.rst","appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK.rst","appdev/refs/macros/KRB5_GC_USER_USER.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE.rst","appdev/refs/macros/KRB5_INIT_CONTEXT_KDC.rst","appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE.rst","appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE.rst","appdev/refs/macros/KRB5_INT16_MAX.rst","appdev/refs/macros/KRB5_INT16_MIN.rst","appdev/refs/macros/KRB5_INT32_MAX.rst","appdev/refs/macros/KRB5_INT32_MIN.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH.rst","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT.rst","appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH.rst","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ.rst","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS.rst","appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC.rst","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT.rst","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC.rst","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG.rst","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV.rst","appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED.rst","appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE.rst","appdev/refs/macros/KRB5_KEYUSAGE_SPAKE.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM.rst","appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED.rst","appdev/refs/macros/KRB5_KPASSWD_AUTHERROR.rst","appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION.rst","appdev/refs/macros/KRB5_KPASSWD_HARDERROR.rst","appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED.rst","appdev/refs/macros/KRB5_KPASSWD_MALFORMED.rst","appdev/refs/macros/KRB5_KPASSWD_SOFTERROR.rst","appdev/refs/macros/KRB5_KPASSWD_SUCCESS.rst","appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED.rst","appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME.rst","appdev/refs/macros/KRB5_LRQ_NONE.rst","appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED.rst","appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME.rst","appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL.rst","appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID.rst","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL.rst","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID.rst","appdev/refs/macros/KRB5_NT_PRINCIPAL.rst","appdev/refs/macros/KRB5_NT_SMTP_NAME.rst","appdev/refs/macros/KRB5_NT_SRV_HST.rst","appdev/refs/macros/KRB5_NT_SRV_INST.rst","appdev/refs/macros/KRB5_NT_SRV_XHST.rst","appdev/refs/macros/KRB5_NT_UID.rst","appdev/refs/macros/KRB5_NT_UNKNOWN.rst","appdev/refs/macros/KRB5_NT_WELLKNOWN.rst","appdev/refs/macros/KRB5_NT_X500_PRINCIPAL.rst","appdev/refs/macros/KRB5_PAC_CLIENT_INFO.rst","appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO.rst","appdev/refs/macros/KRB5_PAC_DELEGATION_INFO.rst","appdev/refs/macros/KRB5_PAC_LOGON_INFO.rst","appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM.rst","appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM.rst","appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO.rst","appdev/refs/macros/KRB5_PADATA_AFS3_SALT.rst","appdev/refs/macros/KRB5_PADATA_AP_REQ.rst","appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM.rst","appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS.rst","appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE.rst","appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID.rst","appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP.rst","appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME.rst","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO.rst","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2.rst","appdev/refs/macros/KRB5_PADATA_FOR_USER.rst","appdev/refs/macros/KRB5_PADATA_FX_COOKIE.rst","appdev/refs/macros/KRB5_PADATA_FX_ERROR.rst","appdev/refs/macros/KRB5_PADATA_FX_FAST.rst","appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA.rst","appdev/refs/macros/KRB5_PADATA_NONE.rst","appdev/refs/macros/KRB5_PADATA_OSF_DCE.rst","appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE.rst","appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE.rst","appdev/refs/macros/KRB5_PADATA_OTP_REQUEST.rst","appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS.rst","appdev/refs/macros/KRB5_PADATA_PAC_REQUEST.rst","appdev/refs/macros/KRB5_PADATA_PKINIT_KX.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REP.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD.rst","appdev/refs/macros/KRB5_PADATA_PW_SALT.rst","appdev/refs/macros/KRB5_PADATA_REFERRAL.rst","appdev/refs/macros/KRB5_PADATA_S4U_X509_USER.rst","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE.rst","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2.rst","appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT.rst","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE.rst","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2.rst","appdev/refs/macros/KRB5_PADATA_SESAME.rst","appdev/refs/macros/KRB5_PADATA_SPAKE.rst","appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO.rst","appdev/refs/macros/KRB5_PADATA_TGS_REQ.rst","appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY.rst","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT.rst","appdev/refs/macros/KRB5_PRIV.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH.rst","appdev/refs/macros/KRB5_PVNO.rst","appdev/refs/macros/KRB5_REALM_BRANCH_CHAR.rst","appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS.rst","appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION.rst","appdev/refs/macros/KRB5_REFERRAL_REALM.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL.rst","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW.rst","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY.rst","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED.rst","appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP.rst","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD.rst","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT.rst","appdev/refs/macros/KRB5_SAFE.rst","appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD.rst","appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD.rst","appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY.rst","appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT.rst","appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA.rst","appdev/refs/macros/KRB5_TC_MATCH_FLAGS.rst","appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT.rst","appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY.rst","appdev/refs/macros/KRB5_TC_MATCH_KTYPE.rst","appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY.rst","appdev/refs/macros/KRB5_TC_MATCH_TIMES.rst","appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT.rst","appdev/refs/macros/KRB5_TC_NOTICKET.rst","appdev/refs/macros/KRB5_TC_OPENCLOSE.rst","appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES.rst","appdev/refs/macros/KRB5_TGS_NAME.rst","appdev/refs/macros/KRB5_TGS_NAME_SIZE.rst","appdev/refs/macros/KRB5_TGS_REP.rst","appdev/refs/macros/KRB5_TGS_REQ.rst","appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE.rst","appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL.rst","appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR.rst","appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK.rst","appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY.rst","appdev/refs/macros/MAX_KEYTAB_NAME_LEN.rst","appdev/refs/macros/MSEC_DIRBIT.rst","appdev/refs/macros/MSEC_VAL_MASK.rst","appdev/refs/macros/SALT_TYPE_AFS_LENGTH.rst","appdev/refs/macros/SALT_TYPE_NO_LENGTH.rst","appdev/refs/macros/THREEPARAMOPEN.rst","appdev/refs/macros/TKT_FLG_ANONYMOUS.rst","appdev/refs/macros/TKT_FLG_ENC_PA_REP.rst","appdev/refs/macros/TKT_FLG_FORWARDABLE.rst","appdev/refs/macros/TKT_FLG_FORWARDED.rst","appdev/refs/macros/TKT_FLG_HW_AUTH.rst","appdev/refs/macros/TKT_FLG_INITIAL.rst","appdev/refs/macros/TKT_FLG_INVALID.rst","appdev/refs/macros/TKT_FLG_MAY_POSTDATE.rst","appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE.rst","appdev/refs/macros/TKT_FLG_POSTDATED.rst","appdev/refs/macros/TKT_FLG_PRE_AUTH.rst","appdev/refs/macros/TKT_FLG_PROXIABLE.rst","appdev/refs/macros/TKT_FLG_PROXY.rst","appdev/refs/macros/TKT_FLG_RENEWABLE.rst","appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED.rst","appdev/refs/macros/VALID_INT_BITS.rst","appdev/refs/macros/VALID_UINT_BITS.rst","appdev/refs/macros/index.rst","appdev/refs/macros/krb524_convert_creds_kdc.rst","appdev/refs/macros/krb524_init_ets.rst","appdev/refs/macros/krb5_const.rst","appdev/refs/macros/krb5_princ_component.rst","appdev/refs/macros/krb5_princ_name.rst","appdev/refs/macros/krb5_princ_realm.rst","appdev/refs/macros/krb5_princ_set_realm.rst","appdev/refs/macros/krb5_princ_set_realm_data.rst","appdev/refs/macros/krb5_princ_set_realm_length.rst","appdev/refs/macros/krb5_princ_size.rst","appdev/refs/macros/krb5_princ_type.rst","appdev/refs/macros/krb5_roundup.rst","appdev/refs/macros/krb5_x.rst","appdev/refs/macros/krb5_xc.rst","appdev/refs/types/index.rst","appdev/refs/types/krb5_address.rst","appdev/refs/types/krb5_addrtype.rst","appdev/refs/types/krb5_ap_rep.rst","appdev/refs/types/krb5_ap_rep_enc_part.rst","appdev/refs/types/krb5_ap_req.rst","appdev/refs/types/krb5_auth_context.rst","appdev/refs/types/krb5_authdata.rst","appdev/refs/types/krb5_authdatatype.rst","appdev/refs/types/krb5_authenticator.rst","appdev/refs/types/krb5_boolean.rst","appdev/refs/types/krb5_cc_cursor.rst","appdev/refs/types/krb5_ccache.rst","appdev/refs/types/krb5_cccol_cursor.rst","appdev/refs/types/krb5_checksum.rst","appdev/refs/types/krb5_cksumtype.rst","appdev/refs/types/krb5_const_pointer.rst","appdev/refs/types/krb5_const_principal.rst","appdev/refs/types/krb5_context.rst","appdev/refs/types/krb5_cred.rst","appdev/refs/types/krb5_cred_enc_part.rst","appdev/refs/types/krb5_cred_info.rst","appdev/refs/types/krb5_creds.rst","appdev/refs/types/krb5_crypto_iov.rst","appdev/refs/types/krb5_cryptotype.rst","appdev/refs/types/krb5_data.rst","appdev/refs/types/krb5_deltat.rst","appdev/refs/types/krb5_enc_data.rst","appdev/refs/types/krb5_enc_kdc_rep_part.rst","appdev/refs/types/krb5_enc_tkt_part.rst","appdev/refs/types/krb5_encrypt_block.rst","appdev/refs/types/krb5_enctype.rst","appdev/refs/types/krb5_error.rst","appdev/refs/types/krb5_error_code.rst","appdev/refs/types/krb5_expire_callback_func.rst","appdev/refs/types/krb5_flags.rst","appdev/refs/types/krb5_get_init_creds_opt.rst","appdev/refs/types/krb5_gic_opt_pa_data.rst","appdev/refs/types/krb5_init_creds_context.rst","appdev/refs/types/krb5_int16.rst","appdev/refs/types/krb5_int32.rst","appdev/refs/types/krb5_kdc_rep.rst","appdev/refs/types/krb5_kdc_req.rst","appdev/refs/types/krb5_key.rst","appdev/refs/types/krb5_keyblock.rst","appdev/refs/types/krb5_keytab.rst","appdev/refs/types/krb5_keytab_entry.rst","appdev/refs/types/krb5_keyusage.rst","appdev/refs/types/krb5_kt_cursor.rst","appdev/refs/types/krb5_kvno.rst","appdev/refs/types/krb5_last_req_entry.rst","appdev/refs/types/krb5_magic.rst","appdev/refs/types/krb5_mk_req_checksum_func.rst","appdev/refs/types/krb5_msgtype.rst","appdev/refs/types/krb5_octet.rst","appdev/refs/types/krb5_pa_data.rst","appdev/refs/types/krb5_pa_pac_req.rst","appdev/refs/types/krb5_pa_server_referral_data.rst","appdev/refs/types/krb5_pa_svr_referral_data.rst","appdev/refs/types/krb5_pac.rst","appdev/refs/types/krb5_pointer.rst","appdev/refs/types/krb5_post_recv_fn.rst","appdev/refs/types/krb5_pre_send_fn.rst","appdev/refs/types/krb5_preauthtype.rst","appdev/refs/types/krb5_principal.rst","appdev/refs/types/krb5_principal_data.rst","appdev/refs/types/krb5_prompt.rst","appdev/refs/types/krb5_prompt_type.rst","appdev/refs/types/krb5_prompter_fct.rst","appdev/refs/types/krb5_pwd_data.rst","appdev/refs/types/krb5_rcache.rst","appdev/refs/types/krb5_replay_data.rst","appdev/refs/types/krb5_responder_context.rst","appdev/refs/types/krb5_responder_fn.rst","appdev/refs/types/krb5_responder_otp_challenge.rst","appdev/refs/types/krb5_responder_otp_tokeninfo.rst","appdev/refs/types/krb5_responder_pkinit_challenge.rst","appdev/refs/types/krb5_responder_pkinit_identity.rst","appdev/refs/types/krb5_response.rst","appdev/refs/types/krb5_ticket.rst","appdev/refs/types/krb5_ticket_times.rst","appdev/refs/types/krb5_timestamp.rst","appdev/refs/types/krb5_tkt_authent.rst","appdev/refs/types/krb5_tkt_creds_context.rst","appdev/refs/types/krb5_trace_callback.rst","appdev/refs/types/krb5_trace_info.rst","appdev/refs/types/krb5_transited.rst","appdev/refs/types/krb5_typed_data.rst","appdev/refs/types/krb5_ui_2.rst","appdev/refs/types/krb5_ui_4.rst","appdev/refs/types/krb5_verify_init_creds_opt.rst","appdev/refs/types/passwd_phrase_element.rst","appdev/y2038.rst","basic/ccache_def.rst","basic/date_format.rst","basic/index.rst","basic/keytab_def.rst","basic/rcache_def.rst","basic/stash_file_def.rst","build/directory_org.rst","build/doing_build.rst","build/index.rst","build/options2configure.rst","build/osconf.rst","build_this.rst","copyright.rst","formats/ccache_file_format.rst","formats/cookie.rst","formats/freshness_token.rst","formats/index.rst","formats/keytab_file_format.rst","formats/rcache_file_format.rst","index.rst","mitK5defaults.rst","mitK5features.rst","mitK5license.rst","plugindev/ccselect.rst","plugindev/certauth.rst","plugindev/clpreauth.rst","plugindev/general.rst","plugindev/gssapi.rst","plugindev/hostrealm.rst","plugindev/index.rst","plugindev/internal.rst","plugindev/kadm5_auth.rst","plugindev/kadm5_hook.rst","plugindev/kdcpolicy.rst","plugindev/kdcpreauth.rst","plugindev/localauth.rst","plugindev/locate.rst","plugindev/profile.rst","plugindev/pwqual.rst","resources.rst","user/index.rst","user/pwd_mgmt.rst","user/tkt_mgmt.rst","user/user_commands/index.rst","user/user_commands/kdestroy.rst","user/user_commands/kinit.rst","user/user_commands/klist.rst","user/user_commands/kpasswd.rst","user/user_commands/krb5-config.rst","user/user_commands/ksu.rst","user/user_commands/kswitch.rst","user/user_commands/kvno.rst","user/user_commands/sclient.rst","user/user_config/index.rst","user/user_config/k5identity.rst","user/user_config/k5login.rst","user/user_config/kerberos.rst",objects:{"":{ADDRTYPE_ADDRPORT:418,3,1,"",ADDRTYPE_CHAOS:419,3,1,"",ADDRTYPE_DDP:420,3,1,"",ADDRTYPE_INET6:422,3,1,"",ADDRTYPE_INET:421,3,1,"",ADDRTYPE_IPPORT:423,3,1,"",ADDRTYPE_ISO:424,3,1,"",ADDRTYPE_IS_LOCAL:425,3,1,"",ADDRTYPE_NETBIOS:426,3,1,"",ADDRTYPE_XNS:427,3,1,"",AD_TYPE_EXTERNAL:428,3,1,"",AD_TYPE_FIELD_TYPE_MASK:429,3,1,"",AD_TYPE_REGISTERED:430,3,1,"",AD_TYPE_RESERVED:431,3,1,"",AP_OPTS_ETYPE_NEGOTIATION:432,3,1,"",AP_OPTS_MUTUAL_REQUIRED:433,3,1,"",AP_OPTS_RESERVED:434,3,1,"",AP_OPTS_USE_SESSION_KEY:435,3,1,"",AP_OPTS_USE_SUBKEY:436,3,1,"",AP_OPTS_WIRE_MASK:437,3,1,"",CKSUMTYPE_CMAC_CAMELLIA128:438,3,1,"",CKSUMTYPE_CMAC_CAMELLIA256:439,3,1,"",CKSUMTYPE_CRC32:440,3,1,"",CKSUMTYPE_DESCBC:441,3,1,"",CKSUMTYPE_HMAC_MD5_ARCFOUR:442,3,1,"",CKSUMTYPE_HMAC_SHA1_96_AES128:443,3,1,"",CKSUMTYPE_HMAC_SHA1_96_AES256:444,3,1,"",CKSUMTYPE_HMAC_SHA1_DES3:445,3,1,"",CKSUMTYPE_HMAC_SHA256_128_AES128:446,3,1,"",CKSUMTYPE_HMAC_SHA384_192_AES256:447,3,1,"",CKSUMTYPE_MD5_HMAC_ARCFOUR:448,3,1,"",CKSUMTYPE_NIST_SHA:449,3,1,"",CKSUMTYPE_RSA_MD4:450,3,1,"",CKSUMTYPE_RSA_MD4_DES:451,3,1,"",CKSUMTYPE_RSA_MD5:452,3,1,"",CKSUMTYPE_RSA_MD5_DES:453,3,1,"",ENCTYPE_AES128_CTS_HMAC_SHA1_96:454,3,1,"",ENCTYPE_AES128_CTS_HMAC_SHA256_128:455,3,1,"",ENCTYPE_AES256_CTS_HMAC_SHA1_96:456,3,1,"",ENCTYPE_AES256_CTS_HMAC_SHA384_192:457,3,1,"",ENCTYPE_ARCFOUR_HMAC:458,3,1,"",ENCTYPE_ARCFOUR_HMAC_EXP:459,3,1,"",ENCTYPE_CAMELLIA128_CTS_CMAC:460,3,1,"",ENCTYPE_CAMELLIA256_CTS_CMAC:461,3,1,"",ENCTYPE_DES3_CBC_ENV:462,3,1,"",ENCTYPE_DES3_CBC_RAW:463,3,1,"",ENCTYPE_DES3_CBC_SHA1:465,3,1,"",ENCTYPE_DES3_CBC_SHA:464,3,1,"",ENCTYPE_DES_CBC_CRC:466,3,1,"",ENCTYPE_DES_CBC_MD4:467,3,1,"",ENCTYPE_DES_CBC_MD5:468,3,1,"",ENCTYPE_DES_CBC_RAW:469,3,1,"",ENCTYPE_DES_HMAC_SHA1:470,3,1,"",ENCTYPE_DSA_SHA1_CMS:471,3,1,"",ENCTYPE_MD5_RSA_CMS:472,3,1,"",ENCTYPE_NULL:473,3,1,"",ENCTYPE_RC2_CBC_ENV:474,3,1,"",ENCTYPE_RSA_ENV:475,3,1,"",ENCTYPE_RSA_ES_OAEP_ENV:476,3,1,"",ENCTYPE_SHA1_RSA_CMS:477,3,1,"",ENCTYPE_UNKNOWN:478,3,1,"",KDC_OPT_ALLOW_POSTDATE:479,3,1,"",KDC_OPT_CANONICALIZE:480,3,1,"",KDC_OPT_CNAME_IN_ADDL_TKT:481,3,1,"",KDC_OPT_DISABLE_TRANSITED_CHECK:482,3,1,"",KDC_OPT_ENC_TKT_IN_SKEY:483,3,1,"",KDC_OPT_FORWARDABLE:484,3,1,"",KDC_OPT_FORWARDED:485,3,1,"",KDC_OPT_POSTDATED:486,3,1,"",KDC_OPT_PROXIABLE:487,3,1,"",KDC_OPT_PROXY:488,3,1,"",KDC_OPT_RENEW:489,3,1,"",KDC_OPT_RENEWABLE:490,3,1,"",KDC_OPT_RENEWABLE_OK:491,3,1,"",KDC_OPT_REQUEST_ANONYMOUS:492,3,1,"",KDC_OPT_VALIDATE:493,3,1,"",KDC_TKT_COMMON_MASK:494,3,1,"",KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE:495,3,1,"",KRB5_ANONYMOUS_PRINCSTR:496,3,1,"",KRB5_ANONYMOUS_REALMSTR:497,3,1,"",KRB5_AP_REP:498,3,1,"",KRB5_AP_REQ:499,3,1,"",KRB5_AS_REP:500,3,1,"",KRB5_AS_REQ:501,3,1,"",KRB5_AUTHDATA_AND_OR:502,3,1,"",KRB5_AUTHDATA_AP_OPTIONS:503,3,1,"",KRB5_AUTHDATA_AUTH_INDICATOR:504,3,1,"",KRB5_AUTHDATA_CAMMAC:505,3,1,"",KRB5_AUTHDATA_ETYPE_NEGOTIATION:506,3,1,"",KRB5_AUTHDATA_FX_ARMOR:507,3,1,"",KRB5_AUTHDATA_IF_RELEVANT:508,3,1,"",KRB5_AUTHDATA_INITIAL_VERIFIED_CAS:509,3,1,"",KRB5_AUTHDATA_KDC_ISSUED:510,3,1,"",KRB5_AUTHDATA_MANDATORY_FOR_KDC:511,3,1,"",KRB5_AUTHDATA_OSF_DCE:512,3,1,"",KRB5_AUTHDATA_SESAME:513,3,1,"",KRB5_AUTHDATA_SIGNTICKET:514,3,1,"",KRB5_AUTHDATA_WIN2K_PAC:515,3,1,"",KRB5_AUTH_CONTEXT_DO_SEQUENCE:516,3,1,"",KRB5_AUTH_CONTEXT_DO_TIME:517,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR:518,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR:519,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR:520,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR:521,3,1,"",KRB5_AUTH_CONTEXT_PERMIT_ALL:522,3,1,"",KRB5_AUTH_CONTEXT_RET_SEQUENCE:523,3,1,"",KRB5_AUTH_CONTEXT_RET_TIME:524,3,1,"",KRB5_AUTH_CONTEXT_USE_SUBKEY:525,3,1,"",KRB5_CRED:526,3,1,"",KRB5_CRYPTO_TYPE_CHECKSUM:527,3,1,"",KRB5_CRYPTO_TYPE_DATA:528,3,1,"",KRB5_CRYPTO_TYPE_EMPTY:529,3,1,"",KRB5_CRYPTO_TYPE_HEADER:530,3,1,"",KRB5_CRYPTO_TYPE_PADDING:531,3,1,"",KRB5_CRYPTO_TYPE_SIGN_ONLY:532,3,1,"",KRB5_CRYPTO_TYPE_STREAM:533,3,1,"",KRB5_CRYPTO_TYPE_TRAILER:534,3,1,"",KRB5_CYBERSAFE_SECUREID:535,3,1,"",KRB5_DOMAIN_X500_COMPRESS:536,3,1,"",KRB5_ENCPADATA_REQ_ENC_PA_REP:537,3,1,"",KRB5_ERROR:538,3,1,"",KRB5_FAST_REQUIRED:539,3,1,"",KRB5_GC_CACHED:540,3,1,"",KRB5_GC_CANONICALIZE:541,3,1,"",KRB5_GC_CONSTRAINED_DELEGATION:542,3,1,"",KRB5_GC_FORWARDABLE:543,3,1,"",KRB5_GC_NO_STORE:544,3,1,"",KRB5_GC_NO_TRANSIT_CHECK:545,3,1,"",KRB5_GC_USER_USER:546,3,1,"",KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST:547,3,1,"",KRB5_GET_INIT_CREDS_OPT_ANONYMOUS:548,3,1,"",KRB5_GET_INIT_CREDS_OPT_CANONICALIZE:549,3,1,"",KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT:550,3,1,"",KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST:551,3,1,"",KRB5_GET_INIT_CREDS_OPT_FORWARDABLE:552,3,1,"",KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST:553,3,1,"",KRB5_GET_INIT_CREDS_OPT_PROXIABLE:554,3,1,"",KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE:555,3,1,"",KRB5_GET_INIT_CREDS_OPT_SALT:556,3,1,"",KRB5_GET_INIT_CREDS_OPT_TKT_LIFE:557,3,1,"",KRB5_INIT_CONTEXT_KDC:558,3,1,"",KRB5_INIT_CONTEXT_SECURE:559,3,1,"",KRB5_INIT_CREDS_STEP_FLAG_CONTINUE:560,3,1,"",KRB5_INT16_MAX:561,3,1,"",KRB5_INT16_MIN:562,3,1,"",KRB5_INT32_MAX:563,3,1,"",KRB5_INT32_MIN:564,3,1,"",KRB5_KEYUSAGE_AD_ITE:565,3,1,"",KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM:566,3,1,"",KRB5_KEYUSAGE_AD_MTE:567,3,1,"",KRB5_KEYUSAGE_AD_SIGNEDPATH:568,3,1,"",KRB5_KEYUSAGE_APP_DATA_CKSUM:569,3,1,"",KRB5_KEYUSAGE_APP_DATA_ENCRYPT:570,3,1,"",KRB5_KEYUSAGE_AP_REP_ENCPART:571,3,1,"",KRB5_KEYUSAGE_AP_REQ_AUTH:572,3,1,"",KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM:573,3,1,"",KRB5_KEYUSAGE_AS_REP_ENCPART:574,3,1,"",KRB5_KEYUSAGE_AS_REQ:575,3,1,"",KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS:576,3,1,"",KRB5_KEYUSAGE_CAMMAC:577,3,1,"",KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT:578,3,1,"",KRB5_KEYUSAGE_ENC_CHALLENGE_KDC:579,3,1,"",KRB5_KEYUSAGE_FAST_ENC:580,3,1,"",KRB5_KEYUSAGE_FAST_FINISHED:581,3,1,"",KRB5_KEYUSAGE_FAST_REP:582,3,1,"",KRB5_KEYUSAGE_FAST_REQ_CHKSUM:583,3,1,"",KRB5_KEYUSAGE_GSS_TOK_MIC:584,3,1,"",KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG:585,3,1,"",KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV:586,3,1,"",KRB5_KEYUSAGE_IAKERB_FINISHED:587,3,1,"",KRB5_KEYUSAGE_KDC_REP_TICKET:588,3,1,"",KRB5_KEYUSAGE_KRB_CRED_ENCPART:589,3,1,"",KRB5_KEYUSAGE_KRB_ERROR_CKSUM:590,3,1,"",KRB5_KEYUSAGE_KRB_PRIV_ENCPART:591,3,1,"",KRB5_KEYUSAGE_KRB_SAFE_CKSUM:592,3,1,"",KRB5_KEYUSAGE_PA_AS_FRESHNESS:593,3,1,"",KRB5_KEYUSAGE_PA_FX_COOKIE:594,3,1,"",KRB5_KEYUSAGE_PA_OTP_REQUEST:595,3,1,"",KRB5_KEYUSAGE_PA_PKINIT_KX:596,3,1,"",KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY:597,3,1,"",KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST:598,3,1,"",KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM:599,3,1,"",KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID:600,3,1,"",KRB5_KEYUSAGE_PA_SAM_RESPONSE:601,3,1,"",KRB5_KEYUSAGE_SPAKE:602,3,1,"",KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY:603,3,1,"",KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY:604,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY:605,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY:606,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AUTH:607,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM:608,3,1,"",KRB5_KPASSWD_ACCESSDENIED:609,3,1,"",KRB5_KPASSWD_AUTHERROR:610,3,1,"",KRB5_KPASSWD_BAD_VERSION:611,3,1,"",KRB5_KPASSWD_HARDERROR:612,3,1,"",KRB5_KPASSWD_INITIAL_FLAG_NEEDED:613,3,1,"",KRB5_KPASSWD_MALFORMED:614,3,1,"",KRB5_KPASSWD_SOFTERROR:615,3,1,"",KRB5_KPASSWD_SUCCESS:616,3,1,"",KRB5_LRQ_ALL_ACCT_EXPTIME:617,3,1,"",KRB5_LRQ_ALL_LAST_INITIAL:618,3,1,"",KRB5_LRQ_ALL_LAST_RENEWAL:619,3,1,"",KRB5_LRQ_ALL_LAST_REQ:620,3,1,"",KRB5_LRQ_ALL_LAST_TGT:621,3,1,"",KRB5_LRQ_ALL_LAST_TGT_ISSUED:622,3,1,"",KRB5_LRQ_ALL_PW_EXPTIME:623,3,1,"",KRB5_LRQ_NONE:624,3,1,"",KRB5_LRQ_ONE_ACCT_EXPTIME:625,3,1,"",KRB5_LRQ_ONE_LAST_INITIAL:626,3,1,"",KRB5_LRQ_ONE_LAST_RENEWAL:627,3,1,"",KRB5_LRQ_ONE_LAST_REQ:628,3,1,"",KRB5_LRQ_ONE_LAST_TGT:629,3,1,"",KRB5_LRQ_ONE_LAST_TGT_ISSUED:630,3,1,"",KRB5_LRQ_ONE_PW_EXPTIME:631,3,1,"",KRB5_NT_ENTERPRISE_PRINCIPAL:632,3,1,"",KRB5_NT_ENT_PRINCIPAL_AND_ID:633,3,1,"",KRB5_NT_MS_PRINCIPAL:634,3,1,"",KRB5_NT_MS_PRINCIPAL_AND_ID:635,3,1,"",KRB5_NT_PRINCIPAL:636,3,1,"",KRB5_NT_SMTP_NAME:637,3,1,"",KRB5_NT_SRV_HST:638,3,1,"",KRB5_NT_SRV_INST:639,3,1,"",KRB5_NT_SRV_XHST:640,3,1,"",KRB5_NT_UID:641,3,1,"",KRB5_NT_UNKNOWN:642,3,1,"",KRB5_NT_WELLKNOWN:643,3,1,"",KRB5_NT_X500_PRINCIPAL:644,3,1,"",KRB5_PAC_CLIENT_INFO:645,3,1,"",KRB5_PAC_CREDENTIALS_INFO:646,3,1,"",KRB5_PAC_DELEGATION_INFO:647,3,1,"",KRB5_PAC_LOGON_INFO:648,3,1,"",KRB5_PAC_PRIVSVR_CHECKSUM:649,3,1,"",KRB5_PAC_SERVER_CHECKSUM:650,3,1,"",KRB5_PAC_UPN_DNS_INFO:651,3,1,"",KRB5_PADATA_AFS3_SALT:652,3,1,"",KRB5_PADATA_AP_REQ:653,3,1,"",KRB5_PADATA_AS_CHECKSUM:654,3,1,"",KRB5_PADATA_AS_FRESHNESS:655,3,1,"",KRB5_PADATA_ENCRYPTED_CHALLENGE:656,3,1,"",KRB5_PADATA_ENC_SANDIA_SECURID:657,3,1,"",KRB5_PADATA_ENC_TIMESTAMP:658,3,1,"",KRB5_PADATA_ENC_UNIX_TIME:659,3,1,"",KRB5_PADATA_ETYPE_INFO2:661,3,1,"",KRB5_PADATA_ETYPE_INFO:660,3,1,"",KRB5_PADATA_FOR_USER:662,3,1,"",KRB5_PADATA_FX_COOKIE:663,3,1,"",KRB5_PADATA_FX_ERROR:664,3,1,"",KRB5_PADATA_FX_FAST:665,3,1,"",KRB5_PADATA_GET_FROM_TYPED_DATA:666,3,1,"",KRB5_PADATA_NONE:667,3,1,"",KRB5_PADATA_OSF_DCE:668,3,1,"",KRB5_PADATA_OTP_CHALLENGE:669,3,1,"",KRB5_PADATA_OTP_PIN_CHANGE:670,3,1,"",KRB5_PADATA_OTP_REQUEST:671,3,1,"",KRB5_PADATA_PAC_OPTIONS:672,3,1,"",KRB5_PADATA_PAC_REQUEST:673,3,1,"",KRB5_PADATA_PKINIT_KX:674,3,1,"",KRB5_PADATA_PK_AS_REP:675,3,1,"",KRB5_PADATA_PK_AS_REP_OLD:676,3,1,"",KRB5_PADATA_PK_AS_REQ:677,3,1,"",KRB5_PADATA_PK_AS_REQ_OLD:678,3,1,"",KRB5_PADATA_PW_SALT:679,3,1,"",KRB5_PADATA_REFERRAL:680,3,1,"",KRB5_PADATA_S4U_X509_USER:681,3,1,"",KRB5_PADATA_SAM_CHALLENGE:682,3,1,"",KRB5_PADATA_SAM_CHALLENGE_2:683,3,1,"",KRB5_PADATA_SAM_REDIRECT:684,3,1,"",KRB5_PADATA_SAM_RESPONSE:685,3,1,"",KRB5_PADATA_SAM_RESPONSE_2:686,3,1,"",KRB5_PADATA_SESAME:687,3,1,"",KRB5_PADATA_SPAKE:688,3,1,"",KRB5_PADATA_SVR_REFERRAL_INFO:689,3,1,"",KRB5_PADATA_TGS_REQ:690,3,1,"",KRB5_PADATA_USE_SPECIFIED_KVNO:691,3,1,"",KRB5_PRINCIPAL_COMPARE_CASEFOLD:692,3,1,"",KRB5_PRINCIPAL_COMPARE_ENTERPRISE:693,3,1,"",KRB5_PRINCIPAL_COMPARE_IGNORE_REALM:694,3,1,"",KRB5_PRINCIPAL_COMPARE_UTF8:695,3,1,"",KRB5_PRINCIPAL_PARSE_ENTERPRISE:696,3,1,"",KRB5_PRINCIPAL_PARSE_IGNORE_REALM:697,3,1,"",KRB5_PRINCIPAL_PARSE_NO_DEF_REALM:698,3,1,"",KRB5_PRINCIPAL_PARSE_NO_REALM:699,3,1,"",KRB5_PRINCIPAL_PARSE_REQUIRE_REALM:700,3,1,"",KRB5_PRINCIPAL_UNPARSE_DISPLAY:701,3,1,"",KRB5_PRINCIPAL_UNPARSE_NO_REALM:702,3,1,"",KRB5_PRINCIPAL_UNPARSE_SHORT:703,3,1,"",KRB5_PRIV:704,3,1,"",KRB5_PROMPT_TYPE_NEW_PASSWORD:705,3,1,"",KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN:706,3,1,"",KRB5_PROMPT_TYPE_PASSWORD:707,3,1,"",KRB5_PROMPT_TYPE_PREAUTH:708,3,1,"",KRB5_PVNO:709,3,1,"",KRB5_REALM_BRANCH_CHAR:710,3,1,"",KRB5_RECVAUTH_BADAUTHVERS:711,3,1,"",KRB5_RECVAUTH_SKIP_VERSION:712,3,1,"",KRB5_REFERRAL_REALM:713,3,1,"",KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN:714,3,1,"",KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN:715,3,1,"",KRB5_RESPONDER_OTP_FLAGS_NEXTOTP:716,3,1,"",KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN:717,3,1,"",KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC:718,3,1,"",KRB5_RESPONDER_OTP_FORMAT_DECIMAL:719,3,1,"",KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL:720,3,1,"",KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW:721,3,1,"",KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY:722,3,1,"",KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED:723,3,1,"",KRB5_RESPONDER_QUESTION_OTP:724,3,1,"",KRB5_RESPONDER_QUESTION_PASSWORD:725,3,1,"",KRB5_RESPONDER_QUESTION_PKINIT:726,3,1,"",KRB5_SAFE:727,3,1,"",KRB5_SAM_MUST_PK_ENCRYPT_SAD:728,3,1,"",KRB5_SAM_SEND_ENCRYPTED_SAD:729,3,1,"",KRB5_SAM_USE_SAD_AS_KEY:730,3,1,"",KRB5_TC_MATCH_2ND_TKT:731,3,1,"",KRB5_TC_MATCH_AUTHDATA:732,3,1,"",KRB5_TC_MATCH_FLAGS:733,3,1,"",KRB5_TC_MATCH_FLAGS_EXACT:734,3,1,"",KRB5_TC_MATCH_IS_SKEY:735,3,1,"",KRB5_TC_MATCH_KTYPE:736,3,1,"",KRB5_TC_MATCH_SRV_NAMEONLY:737,3,1,"",KRB5_TC_MATCH_TIMES:738,3,1,"",KRB5_TC_MATCH_TIMES_EXACT:739,3,1,"",KRB5_TC_NOTICKET:740,3,1,"",KRB5_TC_OPENCLOSE:741,3,1,"",KRB5_TC_SUPPORTED_KTYPES:742,3,1,"",KRB5_TGS_NAME:743,3,1,"",KRB5_TGS_NAME_SIZE:744,3,1,"",KRB5_TGS_REP:745,3,1,"",KRB5_TGS_REQ:746,3,1,"",KRB5_TKT_CREDS_STEP_FLAG_CONTINUE:747,3,1,"",KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL:748,3,1,"",KRB5_WELLKNOWN_NAMESTR:749,3,1,"",LR_TYPE_INTERPRETATION_MASK:750,3,1,"",LR_TYPE_THIS_SERVER_ONLY:751,3,1,"",MAX_KEYTAB_NAME_LEN:752,3,1,"",MSEC_DIRBIT:753,3,1,"",MSEC_VAL_MASK:754,3,1,"",SALT_TYPE_AFS_LENGTH:755,3,1,"",SALT_TYPE_NO_LENGTH:756,3,1,"",THREEPARAMOPEN:757,3,1,"",TKT_FLG_ANONYMOUS:758,3,1,"",TKT_FLG_ENC_PA_REP:759,3,1,"",TKT_FLG_FORWARDABLE:760,3,1,"",TKT_FLG_FORWARDED:761,3,1,"",TKT_FLG_HW_AUTH:762,3,1,"",TKT_FLG_INITIAL:763,3,1,"",TKT_FLG_INVALID:764,3,1,"",TKT_FLG_MAY_POSTDATE:765,3,1,"",TKT_FLG_OK_AS_DELEGATE:766,3,1,"",TKT_FLG_POSTDATED:767,3,1,"",TKT_FLG_PRE_AUTH:768,3,1,"",TKT_FLG_PROXIABLE:769,3,1,"",TKT_FLG_PROXY:770,3,1,"",TKT_FLG_RENEWABLE:771,3,1,"",TKT_FLG_TRANSIT_POLICY_CHECKED:772,3,1,"",VALID_INT_BITS:773,3,1,"",VALID_UINT_BITS:774,3,1,"",krb524_convert_creds_kdc:776,3,1,"",krb524_init_ets:777,3,1,"",krb5_425_conv_principal:49,0,1,"c.krb5_425_conv_principal",krb5_524_conv_principal:50,0,1,"c.krb5_524_conv_principal",krb5_524_convert_creds:51,0,1,"c.krb5_524_convert_creds",krb5_address:791,1,1,"c.krb5_address",krb5_address_compare:52,0,1,"c.krb5_address_compare",krb5_address_order:53,0,1,"c.krb5_address_order",krb5_address_search:54,0,1,"c.krb5_address_search",krb5_addrtype:792,1,1,"c.krb5_addrtype",krb5_allow_weak_crypto:55,0,1,"c.krb5_allow_weak_crypto",krb5_aname_to_localname:56,0,1,"c.krb5_aname_to_localname",krb5_anonymous_principal:57,0,1,"c.krb5_anonymous_principal",krb5_anonymous_realm:58,0,1,"c.krb5_anonymous_realm",krb5_ap_rep:793,1,1,"c.krb5_ap_rep",krb5_ap_rep_enc_part:794,1,1,"c.krb5_ap_rep_enc_part",krb5_ap_req:795,1,1,"c.krb5_ap_req",krb5_appdefault_boolean:59,0,1,"c.krb5_appdefault_boolean",krb5_appdefault_string:60,0,1,"c.krb5_appdefault_string",krb5_auth_con_free:61,0,1,"c.krb5_auth_con_free",krb5_auth_con_genaddrs:62,0,1,"c.krb5_auth_con_genaddrs",krb5_auth_con_get_checksum_func:63,0,1,"c.krb5_auth_con_get_checksum_func",krb5_auth_con_getaddrs:64,0,1,"c.krb5_auth_con_getaddrs",krb5_auth_con_getauthenticator:65,0,1,"c.krb5_auth_con_getauthenticator",krb5_auth_con_getflags:66,0,1,"c.krb5_auth_con_getflags",krb5_auth_con_getkey:67,0,1,"c.krb5_auth_con_getkey",krb5_auth_con_getkey_k:68,0,1,"c.krb5_auth_con_getkey_k",krb5_auth_con_getlocalseqnumber:69,0,1,"c.krb5_auth_con_getlocalseqnumber",krb5_auth_con_getlocalsubkey:70,0,1,"c.krb5_auth_con_getlocalsubkey",krb5_auth_con_getrcache:71,0,1,"c.krb5_auth_con_getrcache",krb5_auth_con_getrecvsubkey:72,0,1,"c.krb5_auth_con_getrecvsubkey",krb5_auth_con_getrecvsubkey_k:73,0,1,"c.krb5_auth_con_getrecvsubkey_k",krb5_auth_con_getremoteseqnumber:74,0,1,"c.krb5_auth_con_getremoteseqnumber",krb5_auth_con_getremotesubkey:75,0,1,"c.krb5_auth_con_getremotesubkey",krb5_auth_con_getsendsubkey:76,0,1,"c.krb5_auth_con_getsendsubkey",krb5_auth_con_getsendsubkey_k:77,0,1,"c.krb5_auth_con_getsendsubkey_k",krb5_auth_con_init:78,0,1,"c.krb5_auth_con_init",krb5_auth_con_initivector:79,0,1,"c.krb5_auth_con_initivector",krb5_auth_con_set_checksum_func:80,0,1,"c.krb5_auth_con_set_checksum_func",krb5_auth_con_set_req_cksumtype:81,0,1,"c.krb5_auth_con_set_req_cksumtype",krb5_auth_con_setaddrs:82,0,1,"c.krb5_auth_con_setaddrs",krb5_auth_con_setflags:83,0,1,"c.krb5_auth_con_setflags",krb5_auth_con_setports:84,0,1,"c.krb5_auth_con_setports",krb5_auth_con_setrcache:85,0,1,"c.krb5_auth_con_setrcache",krb5_auth_con_setrecvsubkey:86,0,1,"c.krb5_auth_con_setrecvsubkey",krb5_auth_con_setrecvsubkey_k:87,0,1,"c.krb5_auth_con_setrecvsubkey_k",krb5_auth_con_setsendsubkey:88,0,1,"c.krb5_auth_con_setsendsubkey",krb5_auth_con_setsendsubkey_k:89,0,1,"c.krb5_auth_con_setsendsubkey_k",krb5_auth_con_setuseruserkey:90,0,1,"c.krb5_auth_con_setuseruserkey",krb5_auth_context:796,1,1,"c.krb5_auth_context",krb5_authdata:797,1,1,"c.krb5_authdata",krb5_authdatatype:798,1,1,"c.krb5_authdatatype",krb5_authenticator:799,1,1,"c.krb5_authenticator",krb5_boolean:800,1,1,"c.krb5_boolean",krb5_build_principal:91,0,1,"c.krb5_build_principal",krb5_build_principal_alloc_va:92,0,1,"c.krb5_build_principal_alloc_va",krb5_build_principal_ext:93,0,1,"c.krb5_build_principal_ext",krb5_build_principal_va:94,0,1,"c.krb5_build_principal_va",krb5_c_block_size:95,0,1,"c.krb5_c_block_size",krb5_c_checksum_length:96,0,1,"c.krb5_c_checksum_length",krb5_c_crypto_length:97,0,1,"c.krb5_c_crypto_length",krb5_c_crypto_length_iov:98,0,1,"c.krb5_c_crypto_length_iov",krb5_c_decrypt:99,0,1,"c.krb5_c_decrypt",krb5_c_decrypt_iov:100,0,1,"c.krb5_c_decrypt_iov",krb5_c_derive_prfplus:101,0,1,"c.krb5_c_derive_prfplus",krb5_c_encrypt:102,0,1,"c.krb5_c_encrypt",krb5_c_encrypt_iov:103,0,1,"c.krb5_c_encrypt_iov",krb5_c_encrypt_length:104,0,1,"c.krb5_c_encrypt_length",krb5_c_enctype_compare:105,0,1,"c.krb5_c_enctype_compare",krb5_c_free_state:106,0,1,"c.krb5_c_free_state",krb5_c_fx_cf2_simple:107,0,1,"c.krb5_c_fx_cf2_simple",krb5_c_init_state:108,0,1,"c.krb5_c_init_state",krb5_c_is_coll_proof_cksum:109,0,1,"c.krb5_c_is_coll_proof_cksum",krb5_c_is_keyed_cksum:110,0,1,"c.krb5_c_is_keyed_cksum",krb5_c_keyed_checksum_types:111,0,1,"c.krb5_c_keyed_checksum_types",krb5_c_keylengths:112,0,1,"c.krb5_c_keylengths",krb5_c_make_checksum:113,0,1,"c.krb5_c_make_checksum",krb5_c_make_checksum_iov:114,0,1,"c.krb5_c_make_checksum_iov",krb5_c_make_random_key:115,0,1,"c.krb5_c_make_random_key",krb5_c_padding_length:116,0,1,"c.krb5_c_padding_length",krb5_c_prf:117,0,1,"c.krb5_c_prf",krb5_c_prf_length:118,0,1,"c.krb5_c_prf_length",krb5_c_prfplus:119,0,1,"c.krb5_c_prfplus",krb5_c_random_add_entropy:120,0,1,"c.krb5_c_random_add_entropy",krb5_c_random_make_octets:121,0,1,"c.krb5_c_random_make_octets",krb5_c_random_os_entropy:122,0,1,"c.krb5_c_random_os_entropy",krb5_c_random_seed:123,0,1,"c.krb5_c_random_seed",krb5_c_random_to_key:124,0,1,"c.krb5_c_random_to_key",krb5_c_string_to_key:125,0,1,"c.krb5_c_string_to_key",krb5_c_string_to_key_with_params:126,0,1,"c.krb5_c_string_to_key_with_params",krb5_c_valid_cksumtype:127,0,1,"c.krb5_c_valid_cksumtype",krb5_c_valid_enctype:128,0,1,"c.krb5_c_valid_enctype",krb5_c_verify_checksum:129,0,1,"c.krb5_c_verify_checksum",krb5_c_verify_checksum_iov:130,0,1,"c.krb5_c_verify_checksum_iov",krb5_calculate_checksum:131,0,1,"c.krb5_calculate_checksum",krb5_cc_cache_match:132,0,1,"c.krb5_cc_cache_match",krb5_cc_close:133,0,1,"c.krb5_cc_close",krb5_cc_copy_creds:134,0,1,"c.krb5_cc_copy_creds",krb5_cc_cursor:801,1,1,"c.krb5_cc_cursor",krb5_cc_default:135,0,1,"c.krb5_cc_default",krb5_cc_default_name:136,0,1,"c.krb5_cc_default_name",krb5_cc_destroy:137,0,1,"c.krb5_cc_destroy",krb5_cc_dup:138,0,1,"c.krb5_cc_dup",krb5_cc_end_seq_get:139,0,1,"c.krb5_cc_end_seq_get",krb5_cc_gen_new:140,0,1,"c.krb5_cc_gen_new",krb5_cc_get_config:141,0,1,"c.krb5_cc_get_config",krb5_cc_get_flags:142,0,1,"c.krb5_cc_get_flags",krb5_cc_get_full_name:143,0,1,"c.krb5_cc_get_full_name",krb5_cc_get_name:144,0,1,"c.krb5_cc_get_name",krb5_cc_get_principal:145,0,1,"c.krb5_cc_get_principal",krb5_cc_get_type:146,0,1,"c.krb5_cc_get_type",krb5_cc_initialize:147,0,1,"c.krb5_cc_initialize",krb5_cc_move:148,0,1,"c.krb5_cc_move",krb5_cc_new_unique:149,0,1,"c.krb5_cc_new_unique",krb5_cc_next_cred:150,0,1,"c.krb5_cc_next_cred",krb5_cc_remove_cred:151,0,1,"c.krb5_cc_remove_cred",krb5_cc_resolve:152,0,1,"c.krb5_cc_resolve",krb5_cc_retrieve_cred:153,0,1,"c.krb5_cc_retrieve_cred",krb5_cc_select:154,0,1,"c.krb5_cc_select",krb5_cc_set_config:155,0,1,"c.krb5_cc_set_config",krb5_cc_set_default_name:156,0,1,"c.krb5_cc_set_default_name",krb5_cc_set_flags:157,0,1,"c.krb5_cc_set_flags",krb5_cc_start_seq_get:158,0,1,"c.krb5_cc_start_seq_get",krb5_cc_store_cred:159,0,1,"c.krb5_cc_store_cred",krb5_cc_support_switch:160,0,1,"c.krb5_cc_support_switch",krb5_cc_switch:161,0,1,"c.krb5_cc_switch",krb5_ccache:802,1,1,"c.krb5_ccache",krb5_cccol_cursor:803,1,1,"c.krb5_cccol_cursor",krb5_cccol_cursor_free:162,0,1,"c.krb5_cccol_cursor_free",krb5_cccol_cursor_new:163,0,1,"c.krb5_cccol_cursor_new",krb5_cccol_cursor_next:164,0,1,"c.krb5_cccol_cursor_next",krb5_cccol_have_content:165,0,1,"c.krb5_cccol_have_content",krb5_change_password:166,0,1,"c.krb5_change_password",krb5_check_clockskew:167,0,1,"c.krb5_check_clockskew",krb5_checksum:804,1,1,"c.krb5_checksum",krb5_checksum_size:168,0,1,"c.krb5_checksum_size",krb5_chpw_message:169,0,1,"c.krb5_chpw_message",krb5_cksumtype:805,1,1,"c.krb5_cksumtype",krb5_cksumtype_to_string:170,0,1,"c.krb5_cksumtype_to_string",krb5_clear_error_message:171,0,1,"c.krb5_clear_error_message",krb5_const:778,3,1,"",krb5_const_pointer:806,1,1,"c.krb5_const_pointer",krb5_const_principal:807,1,1,"c.krb5_const_principal",krb5_context:808,1,1,"c.krb5_context",krb5_copy_addresses:172,0,1,"c.krb5_copy_addresses",krb5_copy_authdata:173,0,1,"c.krb5_copy_authdata",krb5_copy_authenticator:174,0,1,"c.krb5_copy_authenticator",krb5_copy_checksum:175,0,1,"c.krb5_copy_checksum",krb5_copy_context:176,0,1,"c.krb5_copy_context",krb5_copy_creds:177,0,1,"c.krb5_copy_creds",krb5_copy_data:178,0,1,"c.krb5_copy_data",krb5_copy_error_message:179,0,1,"c.krb5_copy_error_message",krb5_copy_keyblock:180,0,1,"c.krb5_copy_keyblock",krb5_copy_keyblock_contents:181,0,1,"c.krb5_copy_keyblock_contents",krb5_copy_principal:182,0,1,"c.krb5_copy_principal",krb5_copy_ticket:183,0,1,"c.krb5_copy_ticket",krb5_cred:809,1,1,"c.krb5_cred",krb5_cred_enc_part:810,1,1,"c.krb5_cred_enc_part",krb5_cred_info:811,1,1,"c.krb5_cred_info",krb5_creds:812,1,1,"c.krb5_creds",krb5_crypto_iov:813,1,1,"c.krb5_crypto_iov",krb5_cryptotype:814,1,1,"c.krb5_cryptotype",krb5_data:815,1,1,"c.krb5_data",krb5_decode_authdata_container:184,0,1,"c.krb5_decode_authdata_container",krb5_decode_ticket:185,0,1,"c.krb5_decode_ticket",krb5_decrypt:186,0,1,"c.krb5_decrypt",krb5_deltat:816,1,1,"c.krb5_deltat",krb5_deltat_to_string:187,0,1,"c.krb5_deltat_to_string",krb5_eblock_enctype:188,0,1,"c.krb5_eblock_enctype",krb5_enc_data:817,1,1,"c.krb5_enc_data",krb5_enc_kdc_rep_part:818,1,1,"c.krb5_enc_kdc_rep_part",krb5_enc_tkt_part:819,1,1,"c.krb5_enc_tkt_part",krb5_encode_authdata_container:189,0,1,"c.krb5_encode_authdata_container",krb5_encrypt:190,0,1,"c.krb5_encrypt",krb5_encrypt_block:820,1,1,"c.krb5_encrypt_block",krb5_encrypt_size:191,0,1,"c.krb5_encrypt_size",krb5_enctype:821,1,1,"c.krb5_enctype",krb5_enctype_to_name:192,0,1,"c.krb5_enctype_to_name",krb5_enctype_to_string:193,0,1,"c.krb5_enctype_to_string",krb5_error:822,1,1,"c.krb5_error",krb5_error_code:823,1,1,"c.krb5_error_code",krb5_expand_hostname:194,0,1,"c.krb5_expand_hostname",krb5_expire_callback_func:824,1,1,"c.krb5_expire_callback_func",krb5_find_authdata:195,0,1,"c.krb5_find_authdata",krb5_finish_key:196,0,1,"c.krb5_finish_key",krb5_finish_random_key:197,0,1,"c.krb5_finish_random_key",krb5_flags:825,1,1,"c.krb5_flags",krb5_free_addresses:198,0,1,"c.krb5_free_addresses",krb5_free_ap_rep_enc_part:199,0,1,"c.krb5_free_ap_rep_enc_part",krb5_free_authdata:200,0,1,"c.krb5_free_authdata",krb5_free_authenticator:201,0,1,"c.krb5_free_authenticator",krb5_free_checksum:202,0,1,"c.krb5_free_checksum",krb5_free_checksum_contents:203,0,1,"c.krb5_free_checksum_contents",krb5_free_cksumtypes:204,0,1,"c.krb5_free_cksumtypes",krb5_free_context:205,0,1,"c.krb5_free_context",krb5_free_cred_contents:206,0,1,"c.krb5_free_cred_contents",krb5_free_creds:207,0,1,"c.krb5_free_creds",krb5_free_data:208,0,1,"c.krb5_free_data",krb5_free_data_contents:209,0,1,"c.krb5_free_data_contents",krb5_free_default_realm:210,0,1,"c.krb5_free_default_realm",krb5_free_enctypes:211,0,1,"c.krb5_free_enctypes",krb5_free_error:212,0,1,"c.krb5_free_error",krb5_free_error_message:213,0,1,"c.krb5_free_error_message",krb5_free_host_realm:214,0,1,"c.krb5_free_host_realm",krb5_free_keyblock:215,0,1,"c.krb5_free_keyblock",krb5_free_keyblock_contents:216,0,1,"c.krb5_free_keyblock_contents",krb5_free_keytab_entry_contents:217,0,1,"c.krb5_free_keytab_entry_contents",krb5_free_principal:218,0,1,"c.krb5_free_principal",krb5_free_string:219,0,1,"c.krb5_free_string",krb5_free_tgt_creds:220,0,1,"c.krb5_free_tgt_creds",krb5_free_ticket:221,0,1,"c.krb5_free_ticket",krb5_free_unparsed_name:222,0,1,"c.krb5_free_unparsed_name",krb5_fwd_tgt_creds:223,0,1,"c.krb5_fwd_tgt_creds",krb5_get_credentials:224,0,1,"c.krb5_get_credentials",krb5_get_credentials_renew:225,0,1,"c.krb5_get_credentials_renew",krb5_get_credentials_validate:226,0,1,"c.krb5_get_credentials_validate",krb5_get_default_realm:227,0,1,"c.krb5_get_default_realm",krb5_get_error_message:228,0,1,"c.krb5_get_error_message",krb5_get_etype_info:229,0,1,"c.krb5_get_etype_info",krb5_get_fallback_host_realm:230,0,1,"c.krb5_get_fallback_host_realm",krb5_get_host_realm:231,0,1,"c.krb5_get_host_realm",krb5_get_in_tkt_with_keytab:232,0,1,"c.krb5_get_in_tkt_with_keytab",krb5_get_in_tkt_with_password:233,0,1,"c.krb5_get_in_tkt_with_password",krb5_get_in_tkt_with_skey:234,0,1,"c.krb5_get_in_tkt_with_skey",krb5_get_init_creds_keytab:235,0,1,"c.krb5_get_init_creds_keytab",krb5_get_init_creds_opt:826,1,1,"c.krb5_get_init_creds_opt",krb5_get_init_creds_opt_alloc:236,0,1,"c.krb5_get_init_creds_opt_alloc",krb5_get_init_creds_opt_free:237,0,1,"c.krb5_get_init_creds_opt_free",krb5_get_init_creds_opt_get_fast_flags:238,0,1,"c.krb5_get_init_creds_opt_get_fast_flags",krb5_get_init_creds_opt_init:239,0,1,"c.krb5_get_init_creds_opt_init",krb5_get_init_creds_opt_set_address_list:240,0,1,"c.krb5_get_init_creds_opt_set_address_list",krb5_get_init_creds_opt_set_anonymous:241,0,1,"c.krb5_get_init_creds_opt_set_anonymous",krb5_get_init_creds_opt_set_canonicalize:242,0,1,"c.krb5_get_init_creds_opt_set_canonicalize",krb5_get_init_creds_opt_set_change_password_prompt:243,0,1,"c.krb5_get_init_creds_opt_set_change_password_prompt",krb5_get_init_creds_opt_set_etype_list:244,0,1,"c.krb5_get_init_creds_opt_set_etype_list",krb5_get_init_creds_opt_set_expire_callback:245,0,1,"c.krb5_get_init_creds_opt_set_expire_callback",krb5_get_init_creds_opt_set_fast_ccache:246,0,1,"c.krb5_get_init_creds_opt_set_fast_ccache",krb5_get_init_creds_opt_set_fast_ccache_name:247,0,1,"c.krb5_get_init_creds_opt_set_fast_ccache_name",krb5_get_init_creds_opt_set_fast_flags:248,0,1,"c.krb5_get_init_creds_opt_set_fast_flags",krb5_get_init_creds_opt_set_forwardable:249,0,1,"c.krb5_get_init_creds_opt_set_forwardable",krb5_get_init_creds_opt_set_in_ccache:250,0,1,"c.krb5_get_init_creds_opt_set_in_ccache",krb5_get_init_creds_opt_set_out_ccache:251,0,1,"c.krb5_get_init_creds_opt_set_out_ccache",krb5_get_init_creds_opt_set_pa:252,0,1,"c.krb5_get_init_creds_opt_set_pa",krb5_get_init_creds_opt_set_pac_request:253,0,1,"c.krb5_get_init_creds_opt_set_pac_request",krb5_get_init_creds_opt_set_preauth_list:254,0,1,"c.krb5_get_init_creds_opt_set_preauth_list",krb5_get_init_creds_opt_set_proxiable:255,0,1,"c.krb5_get_init_creds_opt_set_proxiable",krb5_get_init_creds_opt_set_renew_life:256,0,1,"c.krb5_get_init_creds_opt_set_renew_life",krb5_get_init_creds_opt_set_responder:257,0,1,"c.krb5_get_init_creds_opt_set_responder",krb5_get_init_creds_opt_set_salt:258,0,1,"c.krb5_get_init_creds_opt_set_salt",krb5_get_init_creds_opt_set_tkt_life:259,0,1,"c.krb5_get_init_creds_opt_set_tkt_life",krb5_get_init_creds_password:260,0,1,"c.krb5_get_init_creds_password",krb5_get_permitted_enctypes:261,0,1,"c.krb5_get_permitted_enctypes",krb5_get_profile:262,0,1,"c.krb5_get_profile",krb5_get_prompt_types:263,0,1,"c.krb5_get_prompt_types",krb5_get_renewed_creds:264,0,1,"c.krb5_get_renewed_creds",krb5_get_server_rcache:265,0,1,"c.krb5_get_server_rcache",krb5_get_time_offsets:266,0,1,"c.krb5_get_time_offsets",krb5_get_validated_creds:267,0,1,"c.krb5_get_validated_creds",krb5_gic_opt_pa_data:827,1,1,"c.krb5_gic_opt_pa_data",krb5_init_context:268,0,1,"c.krb5_init_context",krb5_init_context_profile:269,0,1,"c.krb5_init_context_profile",krb5_init_creds_context:828,1,1,"c.krb5_init_creds_context",krb5_init_creds_free:270,0,1,"c.krb5_init_creds_free",krb5_init_creds_get:271,0,1,"c.krb5_init_creds_get",krb5_init_creds_get_creds:272,0,1,"c.krb5_init_creds_get_creds",krb5_init_creds_get_error:273,0,1,"c.krb5_init_creds_get_error",krb5_init_creds_get_times:274,0,1,"c.krb5_init_creds_get_times",krb5_init_creds_init:275,0,1,"c.krb5_init_creds_init",krb5_init_creds_set_keytab:276,0,1,"c.krb5_init_creds_set_keytab",krb5_init_creds_set_password:277,0,1,"c.krb5_init_creds_set_password",krb5_init_creds_set_service:278,0,1,"c.krb5_init_creds_set_service",krb5_init_creds_step:279,0,1,"c.krb5_init_creds_step",krb5_init_keyblock:280,0,1,"c.krb5_init_keyblock",krb5_init_random_key:281,0,1,"c.krb5_init_random_key",krb5_init_secure_context:282,0,1,"c.krb5_init_secure_context",krb5_int16:829,1,1,"c.krb5_int16",krb5_int32:830,1,1,"c.krb5_int32",krb5_is_config_principal:283,0,1,"c.krb5_is_config_principal",krb5_is_referral_realm:284,0,1,"c.krb5_is_referral_realm",krb5_is_thread_safe:285,0,1,"c.krb5_is_thread_safe",krb5_k_create_key:286,0,1,"c.krb5_k_create_key",krb5_k_decrypt:287,0,1,"c.krb5_k_decrypt",krb5_k_decrypt_iov:288,0,1,"c.krb5_k_decrypt_iov",krb5_k_encrypt:289,0,1,"c.krb5_k_encrypt",krb5_k_encrypt_iov:290,0,1,"c.krb5_k_encrypt_iov",krb5_k_free_key:291,0,1,"c.krb5_k_free_key",krb5_k_key_enctype:292,0,1,"c.krb5_k_key_enctype",krb5_k_key_keyblock:293,0,1,"c.krb5_k_key_keyblock",krb5_k_make_checksum:294,0,1,"c.krb5_k_make_checksum",krb5_k_make_checksum_iov:295,0,1,"c.krb5_k_make_checksum_iov",krb5_k_prf:296,0,1,"c.krb5_k_prf",krb5_k_reference_key:297,0,1,"c.krb5_k_reference_key",krb5_k_verify_checksum:298,0,1,"c.krb5_k_verify_checksum",krb5_k_verify_checksum_iov:299,0,1,"c.krb5_k_verify_checksum_iov",krb5_kdc_rep:831,1,1,"c.krb5_kdc_rep",krb5_kdc_req:832,1,1,"c.krb5_kdc_req",krb5_key:833,1,1,"c.krb5_key",krb5_keyblock:834,1,1,"c.krb5_keyblock",krb5_keytab:835,1,1,"c.krb5_keytab",krb5_keytab_entry:836,1,1,"c.krb5_keytab_entry",krb5_keyusage:837,1,1,"c.krb5_keyusage",krb5_kt_add_entry:300,0,1,"c.krb5_kt_add_entry",krb5_kt_client_default:301,0,1,"c.krb5_kt_client_default",krb5_kt_close:302,0,1,"c.krb5_kt_close",krb5_kt_cursor:838,1,1,"c.krb5_kt_cursor",krb5_kt_default:303,0,1,"c.krb5_kt_default",krb5_kt_default_name:304,0,1,"c.krb5_kt_default_name",krb5_kt_dup:305,0,1,"c.krb5_kt_dup",krb5_kt_end_seq_get:306,0,1,"c.krb5_kt_end_seq_get",krb5_kt_free_entry:307,0,1,"c.krb5_kt_free_entry",krb5_kt_get_entry:308,0,1,"c.krb5_kt_get_entry",krb5_kt_get_name:309,0,1,"c.krb5_kt_get_name",krb5_kt_get_type:310,0,1,"c.krb5_kt_get_type",krb5_kt_have_content:311,0,1,"c.krb5_kt_have_content",krb5_kt_next_entry:312,0,1,"c.krb5_kt_next_entry",krb5_kt_read_service_key:313,0,1,"c.krb5_kt_read_service_key",krb5_kt_remove_entry:314,0,1,"c.krb5_kt_remove_entry",krb5_kt_resolve:315,0,1,"c.krb5_kt_resolve",krb5_kt_start_seq_get:316,0,1,"c.krb5_kt_start_seq_get",krb5_kuserok:317,0,1,"c.krb5_kuserok",krb5_kvno:839,1,1,"c.krb5_kvno",krb5_last_req_entry:840,1,1,"c.krb5_last_req_entry",krb5_magic:841,1,1,"c.krb5_magic",krb5_make_authdata_kdc_issued:318,0,1,"c.krb5_make_authdata_kdc_issued",krb5_merge_authdata:319,0,1,"c.krb5_merge_authdata",krb5_mk_1cred:320,0,1,"c.krb5_mk_1cred",krb5_mk_error:321,0,1,"c.krb5_mk_error",krb5_mk_ncred:322,0,1,"c.krb5_mk_ncred",krb5_mk_priv:323,0,1,"c.krb5_mk_priv",krb5_mk_rep:324,0,1,"c.krb5_mk_rep",krb5_mk_rep_dce:325,0,1,"c.krb5_mk_rep_dce",krb5_mk_req:326,0,1,"c.krb5_mk_req",krb5_mk_req_checksum_func:842,1,1,"c.krb5_mk_req_checksum_func",krb5_mk_req_extended:327,0,1,"c.krb5_mk_req_extended",krb5_mk_safe:328,0,1,"c.krb5_mk_safe",krb5_msgtype:843,1,1,"c.krb5_msgtype",krb5_octet:844,1,1,"c.krb5_octet",krb5_os_localaddr:329,0,1,"c.krb5_os_localaddr",krb5_pa_data:845,1,1,"c.krb5_pa_data",krb5_pa_pac_req:846,1,1,"c.krb5_pa_pac_req",krb5_pa_server_referral_data:847,1,1,"c.krb5_pa_server_referral_data",krb5_pa_svr_referral_data:848,1,1,"c.krb5_pa_svr_referral_data",krb5_pac:849,1,1,"c.krb5_pac",krb5_pac_add_buffer:330,0,1,"c.krb5_pac_add_buffer",krb5_pac_free:331,0,1,"c.krb5_pac_free",krb5_pac_get_buffer:332,0,1,"c.krb5_pac_get_buffer",krb5_pac_get_client_info:333,0,1,"c.krb5_pac_get_client_info",krb5_pac_get_types:334,0,1,"c.krb5_pac_get_types",krb5_pac_init:335,0,1,"c.krb5_pac_init",krb5_pac_parse:336,0,1,"c.krb5_pac_parse",krb5_pac_sign:337,0,1,"c.krb5_pac_sign",krb5_pac_sign_ext:338,0,1,"c.krb5_pac_sign_ext",krb5_pac_verify:339,0,1,"c.krb5_pac_verify",krb5_pac_verify_ext:340,0,1,"c.krb5_pac_verify_ext",krb5_parse_name:341,0,1,"c.krb5_parse_name",krb5_parse_name_flags:342,0,1,"c.krb5_parse_name_flags",krb5_pointer:850,1,1,"c.krb5_pointer",krb5_post_recv_fn:851,1,1,"c.krb5_post_recv_fn",krb5_pre_send_fn:852,1,1,"c.krb5_pre_send_fn",krb5_preauthtype:853,1,1,"c.krb5_preauthtype",krb5_prepend_error_message:343,0,1,"c.krb5_prepend_error_message",krb5_princ_component:779,3,1,"",krb5_princ_name:780,3,1,"",krb5_princ_realm:781,3,1,"",krb5_princ_set_realm:782,3,1,"",krb5_princ_set_realm_data:783,3,1,"",krb5_princ_set_realm_length:784,3,1,"",krb5_princ_size:785,3,1,"",krb5_princ_type:786,3,1,"",krb5_principal2salt:344,0,1,"c.krb5_principal2salt",krb5_principal:854,1,1,"c.krb5_principal",krb5_principal_compare:345,0,1,"c.krb5_principal_compare",krb5_principal_compare_any_realm:346,0,1,"c.krb5_principal_compare_any_realm",krb5_principal_compare_flags:347,0,1,"c.krb5_principal_compare_flags",krb5_principal_data:855,1,1,"c.krb5_principal_data",krb5_process_key:348,0,1,"c.krb5_process_key",krb5_prompt:856,1,1,"c.krb5_prompt",krb5_prompt_type:857,1,1,"c.krb5_prompt_type",krb5_prompter_fct:858,1,1,"c.krb5_prompter_fct",krb5_prompter_posix:349,0,1,"c.krb5_prompter_posix",krb5_pwd_data:859,1,1,"c.krb5_pwd_data",krb5_random_key:350,0,1,"c.krb5_random_key",krb5_rcache:860,1,1,"c.krb5_rcache",krb5_rd_cred:351,0,1,"c.krb5_rd_cred",krb5_rd_error:352,0,1,"c.krb5_rd_error",krb5_rd_priv:353,0,1,"c.krb5_rd_priv",krb5_rd_rep:354,0,1,"c.krb5_rd_rep",krb5_rd_rep_dce:355,0,1,"c.krb5_rd_rep_dce",krb5_rd_req:356,0,1,"c.krb5_rd_req",krb5_rd_safe:357,0,1,"c.krb5_rd_safe",krb5_read_password:358,0,1,"c.krb5_read_password",krb5_realm_compare:359,0,1,"c.krb5_realm_compare",krb5_recvauth:360,0,1,"c.krb5_recvauth",krb5_recvauth_version:361,0,1,"c.krb5_recvauth_version",krb5_replay_data:861,1,1,"c.krb5_replay_data",krb5_responder_context:862,1,1,"c.krb5_responder_context",krb5_responder_fn:863,1,1,"c.krb5_responder_fn",krb5_responder_get_challenge:362,0,1,"c.krb5_responder_get_challenge",krb5_responder_list_questions:363,0,1,"c.krb5_responder_list_questions",krb5_responder_otp_challenge:864,1,1,"c.krb5_responder_otp_challenge",krb5_responder_otp_challenge_free:364,0,1,"c.krb5_responder_otp_challenge_free",krb5_responder_otp_get_challenge:365,0,1,"c.krb5_responder_otp_get_challenge",krb5_responder_otp_set_answer:366,0,1,"c.krb5_responder_otp_set_answer",krb5_responder_otp_tokeninfo:865,1,1,"c.krb5_responder_otp_tokeninfo",krb5_responder_pkinit_challenge:866,1,1,"c.krb5_responder_pkinit_challenge",krb5_responder_pkinit_challenge_free:367,0,1,"c.krb5_responder_pkinit_challenge_free",krb5_responder_pkinit_get_challenge:368,0,1,"c.krb5_responder_pkinit_get_challenge",krb5_responder_pkinit_identity:867,1,1,"c.krb5_responder_pkinit_identity",krb5_responder_pkinit_set_answer:369,0,1,"c.krb5_responder_pkinit_set_answer",krb5_responder_set_answer:370,0,1,"c.krb5_responder_set_answer",krb5_response:868,1,1,"c.krb5_response",krb5_roundup:787,3,1,"",krb5_salttype_to_string:371,0,1,"c.krb5_salttype_to_string",krb5_sendauth:372,0,1,"c.krb5_sendauth",krb5_server_decrypt_ticket_keytab:373,0,1,"c.krb5_server_decrypt_ticket_keytab",krb5_set_default_realm:374,0,1,"c.krb5_set_default_realm",krb5_set_default_tgs_enctypes:375,0,1,"c.krb5_set_default_tgs_enctypes",krb5_set_error_message:376,0,1,"c.krb5_set_error_message",krb5_set_kdc_recv_hook:377,0,1,"c.krb5_set_kdc_recv_hook",krb5_set_kdc_send_hook:378,0,1,"c.krb5_set_kdc_send_hook",krb5_set_password:379,0,1,"c.krb5_set_password",krb5_set_password_using_ccache:380,0,1,"c.krb5_set_password_using_ccache",krb5_set_principal_realm:381,0,1,"c.krb5_set_principal_realm",krb5_set_real_time:382,0,1,"c.krb5_set_real_time",krb5_set_trace_callback:383,0,1,"c.krb5_set_trace_callback",krb5_set_trace_filename:384,0,1,"c.krb5_set_trace_filename",krb5_sname_match:385,0,1,"c.krb5_sname_match",krb5_sname_to_principal:386,0,1,"c.krb5_sname_to_principal",krb5_string_to_cksumtype:387,0,1,"c.krb5_string_to_cksumtype",krb5_string_to_deltat:388,0,1,"c.krb5_string_to_deltat",krb5_string_to_enctype:389,0,1,"c.krb5_string_to_enctype",krb5_string_to_key:390,0,1,"c.krb5_string_to_key",krb5_string_to_salttype:391,0,1,"c.krb5_string_to_salttype",krb5_string_to_timestamp:392,0,1,"c.krb5_string_to_timestamp",krb5_ticket:869,1,1,"c.krb5_ticket",krb5_ticket_times:870,1,1,"c.krb5_ticket_times",krb5_timeofday:393,0,1,"c.krb5_timeofday",krb5_timestamp:871,1,1,"c.krb5_timestamp",krb5_timestamp_to_sfstring:394,0,1,"c.krb5_timestamp_to_sfstring",krb5_timestamp_to_string:395,0,1,"c.krb5_timestamp_to_string",krb5_tkt_authent:872,1,1,"c.krb5_tkt_authent",krb5_tkt_creds_context:873,1,1,"c.krb5_tkt_creds_context",krb5_tkt_creds_free:396,0,1,"c.krb5_tkt_creds_free",krb5_tkt_creds_get:397,0,1,"c.krb5_tkt_creds_get",krb5_tkt_creds_get_creds:398,0,1,"c.krb5_tkt_creds_get_creds",krb5_tkt_creds_get_times:399,0,1,"c.krb5_tkt_creds_get_times",krb5_tkt_creds_init:400,0,1,"c.krb5_tkt_creds_init",krb5_tkt_creds_step:401,0,1,"c.krb5_tkt_creds_step",krb5_trace_callback:874,1,1,"c.krb5_trace_callback",krb5_trace_info:875,1,1,"c.krb5_trace_info",krb5_transited:876,1,1,"c.krb5_transited",krb5_typed_data:877,1,1,"c.krb5_typed_data",krb5_ui_2:878,1,1,"c.krb5_ui_2",krb5_ui_4:879,1,1,"c.krb5_ui_4",krb5_unparse_name:402,0,1,"c.krb5_unparse_name",krb5_unparse_name_ext:403,0,1,"c.krb5_unparse_name_ext",krb5_unparse_name_flags:404,0,1,"c.krb5_unparse_name_flags",krb5_unparse_name_flags_ext:405,0,1,"c.krb5_unparse_name_flags_ext",krb5_us_timeofday:406,0,1,"c.krb5_us_timeofday",krb5_use_enctype:407,0,1,"c.krb5_use_enctype",krb5_verify_authdata_kdc_issued:408,0,1,"c.krb5_verify_authdata_kdc_issued",krb5_verify_checksum:409,0,1,"c.krb5_verify_checksum",krb5_verify_init_creds:410,0,1,"c.krb5_verify_init_creds",krb5_verify_init_creds_opt:880,1,1,"c.krb5_verify_init_creds_opt",krb5_verify_init_creds_opt_init:411,0,1,"c.krb5_verify_init_creds_opt_init",krb5_verify_init_creds_opt_set_ap_req_nofail:412,0,1,"c.krb5_verify_init_creds_opt_set_ap_req_nofail",krb5_vprepend_error_message:413,0,1,"c.krb5_vprepend_error_message",krb5_vset_error_message:414,0,1,"c.krb5_vset_error_message",krb5_vwrap_error_message:415,0,1,"c.krb5_vwrap_error_message",krb5_wrap_error_message:416,0,1,"c.krb5_wrap_error_message",krb5_x:788,3,1,"",krb5_xc:789,3,1,"",passwd_phrase_element:881,1,1,"c.passwd_phrase_element"},krb5_address:{addrtype:791,2,1,"c.krb5_address.addrtype",contents:791,2,1,"c.krb5_address.contents",length:791,2,1,"c.krb5_address.length",magic:791,2,1,"c.krb5_address.magic"},krb5_ap_rep:{enc_part:793,2,1,"c.krb5_ap_rep.enc_part",magic:793,2,1,"c.krb5_ap_rep.magic"},krb5_ap_rep_enc_part:{ctime:794,2,1,"c.krb5_ap_rep_enc_part.ctime",cusec:794,2,1,"c.krb5_ap_rep_enc_part.cusec",magic:794,2,1,"c.krb5_ap_rep_enc_part.magic",seq_number:794,2,1,"c.krb5_ap_rep_enc_part.seq_number",subkey:794,2,1,"c.krb5_ap_rep_enc_part.subkey"},krb5_ap_req:{ap_options:795,2,1,"c.krb5_ap_req.ap_options",authenticator:795,2,1,"c.krb5_ap_req.authenticator",magic:795,2,1,"c.krb5_ap_req.magic",ticket:795,2,1,"c.krb5_ap_req.ticket"},krb5_authdata:{ad_type:797,2,1,"c.krb5_authdata.ad_type",contents:797,2,1,"c.krb5_authdata.contents",length:797,2,1,"c.krb5_authdata.length",magic:797,2,1,"c.krb5_authdata.magic"},krb5_authenticator:{authorization_data:799,2,1,"c.krb5_authenticator.authorization_data",checksum:799,2,1,"c.krb5_authenticator.checksum",client:799,2,1,"c.krb5_authenticator.client",ctime:799,2,1,"c.krb5_authenticator.ctime",cusec:799,2,1,"c.krb5_authenticator.cusec",magic:799,2,1,"c.krb5_authenticator.magic",seq_number:799,2,1,"c.krb5_authenticator.seq_number",subkey:799,2,1,"c.krb5_authenticator.subkey"},krb5_checksum:{checksum_type:804,2,1,"c.krb5_checksum.checksum_type",contents:804,2,1,"c.krb5_checksum.contents",length:804,2,1,"c.krb5_checksum.length",magic:804,2,1,"c.krb5_checksum.magic"},krb5_const_principal:{data:807,2,1,"c.krb5_const_principal.data",length:807,2,1,"c.krb5_const_principal.length",magic:807,2,1,"c.krb5_const_principal.magic",realm:807,2,1,"c.krb5_const_principal.realm",type:807,2,1,"c.krb5_const_principal.type"},krb5_cred:{enc_part2:809,2,1,"c.krb5_cred.enc_part2",enc_part:809,2,1,"c.krb5_cred.enc_part",magic:809,2,1,"c.krb5_cred.magic",tickets:809,2,1,"c.krb5_cred.tickets"},krb5_cred_enc_part:{magic:810,2,1,"c.krb5_cred_enc_part.magic",nonce:810,2,1,"c.krb5_cred_enc_part.nonce",r_address:810,2,1,"c.krb5_cred_enc_part.r_address",s_address:810,2,1,"c.krb5_cred_enc_part.s_address",ticket_info:810,2,1,"c.krb5_cred_enc_part.ticket_info",timestamp:810,2,1,"c.krb5_cred_enc_part.timestamp",usec:810,2,1,"c.krb5_cred_enc_part.usec"},krb5_cred_info:{caddrs:811,2,1,"c.krb5_cred_info.caddrs",client:811,2,1,"c.krb5_cred_info.client",flags:811,2,1,"c.krb5_cred_info.flags",magic:811,2,1,"c.krb5_cred_info.magic",server:811,2,1,"c.krb5_cred_info.server",session:811,2,1,"c.krb5_cred_info.session",times:811,2,1,"c.krb5_cred_info.times"},krb5_creds:{addresses:812,2,1,"c.krb5_creds.addresses",authdata:812,2,1,"c.krb5_creds.authdata",client:812,2,1,"c.krb5_creds.client",is_skey:812,2,1,"c.krb5_creds.is_skey",keyblock:812,2,1,"c.krb5_creds.keyblock",magic:812,2,1,"c.krb5_creds.magic",second_ticket:812,2,1,"c.krb5_creds.second_ticket",server:812,2,1,"c.krb5_creds.server",ticket:812,2,1,"c.krb5_creds.ticket",ticket_flags:812,2,1,"c.krb5_creds.ticket_flags",times:812,2,1,"c.krb5_creds.times"},krb5_crypto_iov:{data:813,2,1,"c.krb5_crypto_iov.data",flags:813,2,1,"c.krb5_crypto_iov.flags"},krb5_data:{data:815,2,1,"c.krb5_data.data",length:815,2,1,"c.krb5_data.length",magic:815,2,1,"c.krb5_data.magic"},krb5_enc_data:{ciphertext:817,2,1,"c.krb5_enc_data.ciphertext",enctype:817,2,1,"c.krb5_enc_data.enctype",kvno:817,2,1,"c.krb5_enc_data.kvno",magic:817,2,1,"c.krb5_enc_data.magic"},krb5_enc_kdc_rep_part:{caddrs:818,2,1,"c.krb5_enc_kdc_rep_part.caddrs",enc_padata:818,2,1,"c.krb5_enc_kdc_rep_part.enc_padata",flags:818,2,1,"c.krb5_enc_kdc_rep_part.flags",key_exp:818,2,1,"c.krb5_enc_kdc_rep_part.key_exp",last_req:818,2,1,"c.krb5_enc_kdc_rep_part.last_req",magic:818,2,1,"c.krb5_enc_kdc_rep_part.magic",msg_type:818,2,1,"c.krb5_enc_kdc_rep_part.msg_type",nonce:818,2,1,"c.krb5_enc_kdc_rep_part.nonce",server:818,2,1,"c.krb5_enc_kdc_rep_part.server",session:818,2,1,"c.krb5_enc_kdc_rep_part.session",times:818,2,1,"c.krb5_enc_kdc_rep_part.times"},krb5_enc_tkt_part:{authorization_data:819,2,1,"c.krb5_enc_tkt_part.authorization_data",caddrs:819,2,1,"c.krb5_enc_tkt_part.caddrs",client:819,2,1,"c.krb5_enc_tkt_part.client",flags:819,2,1,"c.krb5_enc_tkt_part.flags",magic:819,2,1,"c.krb5_enc_tkt_part.magic",session:819,2,1,"c.krb5_enc_tkt_part.session",times:819,2,1,"c.krb5_enc_tkt_part.times",transited:819,2,1,"c.krb5_enc_tkt_part.transited"},krb5_encrypt_block:{crypto_entry:820,2,1,"c.krb5_encrypt_block.crypto_entry",key:820,2,1,"c.krb5_encrypt_block.key",magic:820,2,1,"c.krb5_encrypt_block.magic"},krb5_error:{client:822,2,1,"c.krb5_error.client",ctime:822,2,1,"c.krb5_error.ctime",cusec:822,2,1,"c.krb5_error.cusec",e_data:822,2,1,"c.krb5_error.e_data",error:822,2,1,"c.krb5_error.error",magic:822,2,1,"c.krb5_error.magic",server:822,2,1,"c.krb5_error.server",stime:822,2,1,"c.krb5_error.stime",susec:822,2,1,"c.krb5_error.susec",text:822,2,1,"c.krb5_error.text"},krb5_get_init_creds_opt:{address_list:826,2,1,"c.krb5_get_init_creds_opt.address_list",etype_list:826,2,1,"c.krb5_get_init_creds_opt.etype_list",etype_list_length:826,2,1,"c.krb5_get_init_creds_opt.etype_list_length",flags:826,2,1,"c.krb5_get_init_creds_opt.flags",forwardable:826,2,1,"c.krb5_get_init_creds_opt.forwardable",preauth_list:826,2,1,"c.krb5_get_init_creds_opt.preauth_list",preauth_list_length:826,2,1,"c.krb5_get_init_creds_opt.preauth_list_length",proxiable:826,2,1,"c.krb5_get_init_creds_opt.proxiable",renew_life:826,2,1,"c.krb5_get_init_creds_opt.renew_life",salt:826,2,1,"c.krb5_get_init_creds_opt.salt",tkt_life:826,2,1,"c.krb5_get_init_creds_opt.tkt_life"},krb5_gic_opt_pa_data:{attr:827,2,1,"c.krb5_gic_opt_pa_data.attr",value:827,2,1,"c.krb5_gic_opt_pa_data.value"},krb5_kdc_rep:{client:831,2,1,"c.krb5_kdc_rep.client",enc_part2:831,2,1,"c.krb5_kdc_rep.enc_part2",enc_part:831,2,1,"c.krb5_kdc_rep.enc_part",magic:831,2,1,"c.krb5_kdc_rep.magic",msg_type:831,2,1,"c.krb5_kdc_rep.msg_type",padata:831,2,1,"c.krb5_kdc_rep.padata",ticket:831,2,1,"c.krb5_kdc_rep.ticket"},krb5_kdc_req:{addresses:832,2,1,"c.krb5_kdc_req.addresses",authorization_data:832,2,1,"c.krb5_kdc_req.authorization_data",client:832,2,1,"c.krb5_kdc_req.client",from:832,2,1,"c.krb5_kdc_req.from",kdc_options:832,2,1,"c.krb5_kdc_req.kdc_options",ktype:832,2,1,"c.krb5_kdc_req.ktype",magic:832,2,1,"c.krb5_kdc_req.magic",msg_type:832,2,1,"c.krb5_kdc_req.msg_type",nktypes:832,2,1,"c.krb5_kdc_req.nktypes",nonce:832,2,1,"c.krb5_kdc_req.nonce",padata:832,2,1,"c.krb5_kdc_req.padata",rtime:832,2,1,"c.krb5_kdc_req.rtime",second_ticket:832,2,1,"c.krb5_kdc_req.second_ticket",server:832,2,1,"c.krb5_kdc_req.server",till:832,2,1,"c.krb5_kdc_req.till",unenc_authdata:832,2,1,"c.krb5_kdc_req.unenc_authdata"},krb5_keyblock:{contents:834,2,1,"c.krb5_keyblock.contents",enctype:834,2,1,"c.krb5_keyblock.enctype",length:834,2,1,"c.krb5_keyblock.length",magic:834,2,1,"c.krb5_keyblock.magic"},krb5_keytab_entry:{key:836,2,1,"c.krb5_keytab_entry.key",magic:836,2,1,"c.krb5_keytab_entry.magic",principal:836,2,1,"c.krb5_keytab_entry.principal",timestamp:836,2,1,"c.krb5_keytab_entry.timestamp",vno:836,2,1,"c.krb5_keytab_entry.vno"},krb5_last_req_entry:{lr_type:840,2,1,"c.krb5_last_req_entry.lr_type",magic:840,2,1,"c.krb5_last_req_entry.magic",value:840,2,1,"c.krb5_last_req_entry.value"},krb5_pa_data:{contents:845,2,1,"c.krb5_pa_data.contents",length:845,2,1,"c.krb5_pa_data.length",magic:845,2,1,"c.krb5_pa_data.magic",pa_type:845,2,1,"c.krb5_pa_data.pa_type"},krb5_pa_pac_req:{include_pac:846,2,1,"c.krb5_pa_pac_req.include_pac"},krb5_pa_server_referral_data:{referral_valid_until:847,2,1,"c.krb5_pa_server_referral_data.referral_valid_until",referred_realm:847,2,1,"c.krb5_pa_server_referral_data.referred_realm",rep_cksum:847,2,1,"c.krb5_pa_server_referral_data.rep_cksum",requested_principal_name:847,2,1,"c.krb5_pa_server_referral_data.requested_principal_name",true_principal_name:847,2,1,"c.krb5_pa_server_referral_data.true_principal_name"},krb5_pa_svr_referral_data:{principal:848,2,1,"c.krb5_pa_svr_referral_data.principal"},krb5_principal:{data:854,2,1,"c.krb5_principal.data",length:854,2,1,"c.krb5_principal.length",magic:854,2,1,"c.krb5_principal.magic",realm:854,2,1,"c.krb5_principal.realm",type:854,2,1,"c.krb5_principal.type"},krb5_principal_data:{data:855,2,1,"c.krb5_principal_data.data",length:855,2,1,"c.krb5_principal_data.length",magic:855,2,1,"c.krb5_principal_data.magic",realm:855,2,1,"c.krb5_principal_data.realm",type:855,2,1,"c.krb5_principal_data.type"},krb5_prompt:{hidden:856,2,1,"c.krb5_prompt.hidden",prompt:856,2,1,"c.krb5_prompt.prompt",reply:856,2,1,"c.krb5_prompt.reply"},krb5_pwd_data:{element:859,2,1,"c.krb5_pwd_data.element",magic:859,2,1,"c.krb5_pwd_data.magic",sequence_count:859,2,1,"c.krb5_pwd_data.sequence_count"},krb5_replay_data:{seq:861,2,1,"c.krb5_replay_data.seq",timestamp:861,2,1,"c.krb5_replay_data.timestamp",usec:861,2,1,"c.krb5_replay_data.usec"},krb5_responder_otp_challenge:{service:864,2,1,"c.krb5_responder_otp_challenge.service",tokeninfo:864,2,1,"c.krb5_responder_otp_challenge.tokeninfo"},krb5_responder_otp_tokeninfo:{alg_id:865,2,1,"c.krb5_responder_otp_tokeninfo.alg_id",challenge:865,2,1,"c.krb5_responder_otp_tokeninfo.challenge",flags:865,2,1,"c.krb5_responder_otp_tokeninfo.flags",format:865,2,1,"c.krb5_responder_otp_tokeninfo.format",length:865,2,1,"c.krb5_responder_otp_tokeninfo.length",token_id:865,2,1,"c.krb5_responder_otp_tokeninfo.token_id",vendor:865,2,1,"c.krb5_responder_otp_tokeninfo.vendor"},krb5_responder_pkinit_challenge:{identities:866,2,1,"c.krb5_responder_pkinit_challenge.identities"},krb5_responder_pkinit_identity:{identity:867,2,1,"c.krb5_responder_pkinit_identity.identity",token_flags:867,2,1,"c.krb5_responder_pkinit_identity.token_flags"},krb5_response:{expected_nonce:868,2,1,"c.krb5_response.expected_nonce",magic:868,2,1,"c.krb5_response.magic",message_type:868,2,1,"c.krb5_response.message_type",request_time:868,2,1,"c.krb5_response.request_time",response:868,2,1,"c.krb5_response.response"},krb5_ticket:{enc_part2:869,2,1,"c.krb5_ticket.enc_part2",enc_part:869,2,1,"c.krb5_ticket.enc_part",magic:869,2,1,"c.krb5_ticket.magic",server:869,2,1,"c.krb5_ticket.server"},krb5_ticket_times:{authtime:870,2,1,"c.krb5_ticket_times.authtime",endtime:870,2,1,"c.krb5_ticket_times.endtime",renew_till:870,2,1,"c.krb5_ticket_times.renew_till",starttime:870,2,1,"c.krb5_ticket_times.starttime"},krb5_tkt_authent:{ap_options:872,2,1,"c.krb5_tkt_authent.ap_options",authenticator:872,2,1,"c.krb5_tkt_authent.authenticator",magic:872,2,1,"c.krb5_tkt_authent.magic",ticket:872,2,1,"c.krb5_tkt_authent.ticket"},krb5_trace_info:{message:875,2,1,"c.krb5_trace_info.message"},krb5_transited:{magic:876,2,1,"c.krb5_transited.magic",tr_contents:876,2,1,"c.krb5_transited.tr_contents",tr_type:876,2,1,"c.krb5_transited.tr_type"},krb5_typed_data:{data:877,2,1,"c.krb5_typed_data.data",length:877,2,1,"c.krb5_typed_data.length",magic:877,2,1,"c.krb5_typed_data.magic",type:877,2,1,"c.krb5_typed_data.type"},krb5_verify_init_creds_opt:{ap_req_nofail:880,2,1,"c.krb5_verify_init_creds_opt.ap_req_nofail",flags:880,2,1,"c.krb5_verify_init_creds_opt.flags"},passwd_phrase_element:{magic:881,2,1,"c.passwd_phrase_element.magic",passwd:881,2,1,"c.passwd_phrase_element.passwd",phrase:881,2,1,"c.passwd_phrase_element.phrase"}},objnames:{"0":"c","function","C function","1":"c","type","C type","2":"c","member","C member","3":"py","data","Python data"},objtypes:{"0":"c:function","1":"c:type","2":"c:member","3":"py:data"},terms:{"01am":23,"05pm":884,"0x0000":473,"0x00000001":436,493,517,518,738,741,"0x00000002":432,489,520,524,735,740,"0x00000004":516,519,733,"0x00000008":483,521,523,739,"0x00000010":21,491,522,734,"0x00000020":482,525,732,"0x00000040":737,"0x00000080":731,"0x00000100":736,"0x00000200":742,"0x00008000":492,758,"0x0001":440,466,539,557,712,715,748,"0x00010000":480,759,"0x0002":421,450,467,555,711,714,"0x00020000":481,"0x0003":451,468,"0x0004":441,469,552,716,"0x00040000":766,"0x0005":419,464,"0x0006":427,463,"0x0007":424,452,"0x0008":453,470,554,717,"0x00080000":772,"0x0009":449,471,"0x000a":472,"0x000b":477,"0x000c":445,474,"0x000d":475,"0x000e":476,"0x000f":443,462,"0x0010":420,444,465,551,"0x00100000":762,"0x0011":438,454,"0x0012":439,456,"0x0013":446,455,"0x0014":426,447,457,"0x0017":458,"0x0018":422,459,"0x0019":460,"0x001a":461,"0x0020":547,"0x00200000":768,"0x0040":553,"0x00400000":763,"0x0080":556,"0x00800000":490,771,"0x0100":418,550,"0x01000000":764,"0x0101":423,"0x01ff":478,"0x0200":549,"0x02000000":486,767,"0x0400":548,"0x04000000":479,765,"0x08000000":488,770,"0x1":559,560,699,703,707,747,"0x10":698,"0x10000000":487,769,"0x1fff":429,"0x2":558,700,702,705,"0x2000":430,"0x20000000":433,485,728,761,"0x3":706,"0x4":696,701,708,"0x4000":428,"0x40000000":435,484,729,760,"0x54800000":494,"0x7fff":750,754,"0x8":697,"0x8000":425,431,751,753,"0x80000000":434,730,"0xfffffff0":437,"10d":884,"12h":20,34,"1foo":21,"30m":884,"3de":14,"3h30m":925,"5h30m":928,"76cho3000":905,"8h30":884,"abstract":906,908,914,915,917,921,"boolean":6,20,23,36,48,55,856,880,"break":32,888,892,"byte":20,43,46,48,99,104,287,309,896,897,898,900,901,910,"case":2,3,6,11,14,19,20,21,23,24,28,38,39,43,46,195,245,280,322,327,347,356,372,386,412,692,883,884,886,905,908,909,913,917,918,930,932,937,939,"char":43,46,49,50,56,59,60,91,92,93,94,107,136,141,143,144,146,149,152,155,156,160,166,169,170,187,192,193,194,210,213,214,219,222,223,227,228,230,231,233,235,247,252,260,264,267,277,278,304,309,310,315,317,326,333,341,342,343,349,358,360,362,363,366,369,370,371,372,374,376,379,380,381,384,386,387,388,389,391,392,394,395,402,403,404,405,413,414,415,416,789,815,827,856,858,864,865,867,875,920,"class":3,23,930,"const":43,49,52,53,54,58,59,60,91,92,93,94,99,100,101,102,103,106,107,108,113,114,117,119,120,125,126,129,130,136,141,144,146,149,152,155,156,160,166,169,172,173,174,175,177,178,180,181,183,184,185,188,189,194,195,197,213,214,223,228,231,232,233,234,235,247,252,260,264,265,267,277,278,281,284,286,287,288,289,290,294,298,299,310,315,317,318,319,321,323,326,328,330,333,336,337,338,339,340,341,342,343,348,349,350,352,353,354,355,356,357,358,362,363,366,369,370,373,374,375,376,379,380,381,384,386,390,408,409,413,414,415,416,778,806,807,851,852,858,874,875,920,"default":2,3,4,5,6,7,8,10,11,12,15,19,20,21,22,23,24,26,29,30,32,33,34,35,37,38,39,40,41,43,44,46,48,59,60,78,132,147,148,154,223,229,243,253,265,269,275,278,313,315,342,356,372,380,410,698,884,891,892,893,894,896,904,909,910,911,925,927,928,929,931,932,933,934,938,939,"export":20,34,904,905,909,910,919,920,"final":19,21,112,158,890,897,901,"function":3,6,14,23,25,29,34,35,43,46,48,49,50,55,57,58,59,60,61,62,67,68,69,71,72,73,74,76,77,78,81,82,84,85,86,87,88,89,92,93,99,100,101,102,103,104,105,107,113,114,116,117,119,122,124,125,126,129,130,133,136,137,139,148,150,151,153,156,157,158,159,167,169,171,172,173,174,175,177,178,180,181,182,183,192,194,195,198,199,200,201,202,203,205,206,207,208,209,212,215,216,221,228,235,236,241,245,246,252,254,258,260,261,262,264,265,266,267,271,272,275,276,277,278,279,287,288,289,290,294,295,296,298,299,306,308,318,320,321,322,323,324,326,327,328,330,331,337,338,339,340,342,349,352,353,354,355,356,357,358,365,368,370,373,375,379,380,382,384,386,393,397,398,400,401,403,404,406,408,410,412,413,415,842,851,852,856,858,863,889,890,904,905,908,909,910,913,916,917,919,920,"goto":46,"h\u00f6gskola":905,"import":5,6,14,15,17,19,21,23,34,35,904,910,924,"int":43,51,53,56,59,62,91,92,93,94,97,111,116,120,122,166,223,241,242,243,244,249,254,255,279,304,309,342,347,349,358,379,380,401,403,404,405,412,791,797,800,804,815,826,832,834,839,843,845,856,858,859,877,880,909,"long":3,14,15,23,25,26,37,38,39,41,43,99,287,362,363,725,752,883,886,904,905,908,917,920,934,"new":2,3,6,14,15,20,21,23,24,26,34,35,37,41,43,48,87,89,129,132,138,143,154,160,163,165,166,167,169,172,173,174,175,176,177,178,180,182,183,192,194,195,211,219,229,235,243,245,246,250,253,257,260,262,269,275,280,298,301,305,311,324,327,335,337,338,340,341,342,356,362,363,364,365,366,367,368,369,370,377,378,379,380,383,384,396,397,398,399,400,401,403,705,706,883,887,901,904,905,909,910,913,914,917,924,925,928,930,939,"null":19,20,21,43,44,46,48,54,64,92,99,100,102,103,107,113,129,136,141,154,155,156,164,173,195,198,200,203,209,220,223,224,228,230,231,235,240,260,264,267,269,273,275,287,288,289,290,294,298,313,319,320,322,323,326,327,328,329,337,338,339,340,341,351,353,356,357,358,360,361,362,363,366,369,372,374,377,378,379,380,383,385,386,394,403,404,405,408,410,779,904,909,918,920,939,"public":21,40,905,913,914,915,916,"return":3,9,12,20,21,22,23,38,43,46,48,50,52,54,56,57,59,60,69,74,91,92,93,100,103,109,110,119,127,128,133,135,137,141,142,144,145,146,147,148,149,151,152,153,154,155,156,159,161,169,176,189,192,214,223,224,227,228,229,231,235,260,262,263,264,267,268,271,279,282,283,284,288,290,300,301,303,304,306,308,309,312,313,314,315,316,318,320,322,327,337,341,342,349,352,358,362,363,365,368,372,374,375,377,379,380,381,383,385,386,393,395,397,401,402,403,404,405,406,408,410,412,717,851,852,892,904,906,907,908,909,910,911,914,915,917,918,919,920,921,928,932,"short":14,19,21,41,304,886,"static":46,909,920,"switch":14,28,31,48,161,883,"true":9,14,20,21,22,23,24,25,26,33,35,36,37,38,40,41,43,52,54,105,109,110,127,128,160,192,245,283,284,285,317,338,340,345,346,347,359,385,412,799,812,846,938,"try":21,25,32,35,38,39,41,43,892,904,924,932,"var":5,8,20,21,23,34,37,887,892,893,903,939,"void":43,46,57,58,59,60,63,80,171,179,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,215,216,218,219,220,221,222,237,239,240,241,242,243,244,245,249,254,255,256,257,258,259,260,270,275,285,291,297,331,336,343,349,364,367,376,377,378,383,396,411,412,413,414,415,416,806,824,842,850,851,852,858,863,874,919,920,"while":3,12,14,15,16,20,21,23,24,34,35,43,46,883,890,909,924,925,932,939,AES:14,15,20,25,892,904,905,AFS:14,AND:905,ARE:905,Added:904,934,Adding:17,32,34,896,Are:3,23,BUT:905,But:887,CCS:905,CMS:462,471,472,474,475,476,477,CTS:14,20,904,DES:13,20,26,41,462,904,DNS:21,25,30,33,34,39,44,330,651,892,904,DNs:5,22,23,Dis:19,Doing:891,FOR:905,For:3,10,14,16,17,18,19,20,21,22,23,24,26,28,32,33,34,35,36,37,38,39,43,46,99,100,103,142,287,288,290,724,882,883,887,890,891,892,896,897,901,902,903,904,906,907,908,909,910,911,913,914,915,916,917,918,919,920,921,922,924,925,928,931,932,937,939,HAS:905,His:19,ITS:42,905,Its:20,21,896,NFS:924,NOT:5,23,34,905,Not:20,21,44,51,151,609,883,ONE:5,23,ORed:151,One:3,20,23,34,36,38,43,339,883,884,924,925,938,SUCH:905,Such:14,37,39,46,TGS:3,20,21,23,25,26,35,48,224,400,745,846,896,904,916,THAT:905,THE:905,TLS:22,29,That:21,890,The:0,3,4,5,6,7,8,9,10,11,12,15,19,20,21,22,23,24,25,26,28,29,31,33,34,35,37,38,39,40,41,43,46,53,62,69,71,74,78,80,93,99,100,102,103,113,117,119,121,125,126,129,135,136,138,144,146,148,153,165,166,173,176,189,198,200,217,220,224,228,229,245,248,252,262,268,274,282,286,287,288,289,290,294,296,298,303,305,310,313,318,319,322,323,328,330,341,342,343,351,353,356,357,362,363,364,365,366,367,368,369,370,373,377,378,379,380,386,395,399,400,402,403,404,408,410,416,613,716,724,726,731,732,735,736,738,742,793,799,813,823,836,851,852,856,862,869,882,883,884,886,887,888,889,890,891,892,893,894,896,897,898,900,901,903,904,905,906,907,908,909,910,911,913,914,915,916,917,918,919,920,921,922,924,925,927,928,930,932,934,936,937,938,939,Then:3,6,17,23,24,34,928,There:20,21,23,34,35,883,890,892,893,896,900,925,These:14,16,20,21,23,26,34,35,37,39,43,719,890,896,904,905,908,910,913,937,939,UCS:904,USE:905,Use:3,15,22,23,46,49,65,66,67,68,72,73,76,77,78,83,92,111,115,132,141,143,145,150,153,154,163,164,169,172,173,174,175,177,178,180,181,182,183,194,195,224,227,229,230,231,236,239,261,265,269,272,275,280,286,307,308,313,315,316,319,321,322,323,324,325,326,327,328,329,332,335,336,337,341,342,351,352,353,354,356,357,360,372,386,398,400,402,404,435,558,559,823,833,890,892,904,913,927,932,934,Used:443,444,593,594,823,882,932,Uses:2,3,15,21,23,Using:3,6,14,23,25,40,924,WILL:905,WITH:905,With:0,3,6,15,22,23,39,938,_kerbero:39,_kpasswd:39,_krb5_address:791,_krb5_ap_rep:793,794,_krb5_ap_rep_enc_part:794,_krb5_ap_req:795,_krb5_auth_context:796,_krb5_authdata:797,_krb5_authent:799,_krb5_ccach:802,_krb5_cccol_cursor:803,_krb5_checksum:804,_krb5_context:135,156,808,_krb5_cred:809,812,_krb5_cred_enc_part:810,_krb5_cred_info:811,_krb5_crypto_iov:813,_krb5_data:815,_krb5_enc_data:817,_krb5_enc_kdc_rep_part:818,_krb5_enc_tkt_part:819,_krb5_encrypt_block:820,_krb5_error:822,_krb5_get_init_cr:826,_krb5_get_init_creds_opt:826,_krb5_gic_opt_pa_data:827,_krb5_init_creds_context:828,_krb5_kdc_rep:831,_krb5_kdc_req:832,_krb5_keyblock:834,_krb5_kt:835,_krb5_last_req_entri:840,_krb5_pa_data:845,_krb5_pa_pac_req:846,_krb5_pa_server_referral_data:847,_krb5_pa_svr_referral_data:848,_krb5_prompt:856,_krb5_pwd_data:859,_krb5_responder_otp_challeng:864,_krb5_responder_otp_tokeninfo:865,_krb5_responder_pkinit_challeng:866,_krb5_responder_pkinit_ident:867,_krb5_respons:868,_krb5_ticket:869,_krb5_ticket_tim:870,_krb5_tkt_authent:872,_krb5_tkt_creds_context:873,_krb5_trace_info:875,_krb5_transit:876,_krb5_typed_data:877,_krb5_verify_init_creds_opt:880,_passwd_phrase_el:881,_profile_t:262,269,_tcp:39,_udp:39,abbrevi:890,929,abc:892,939,abi:871,abil:14,365,368,938,abl:15,16,19,20,21,23,25,29,34,35,39,883,888,924,925,932,abort:788,789,919,about:0,14,19,20,22,26,31,39,41,43,46,251,887,890,892,894,904,905,908,917,922,925,928,939,abov:6,14,19,21,22,23,25,26,32,34,37,41,43,46,887,892,896,905,909,910,911,925,932,absenc:20,46,absent:928,absolut:20,21,882,886,890,ac02:905,acceler:905,accept:3,4,8,14,15,16,20,21,23,26,34,38,39,41,151,386,884,886,890,904,905,906,910,919,920,925,928,acceptor:8,904,929,acceptor_cred_handl:43,access:3,4,8,9,14,15,17,18,19,20,21,22,23,24,25,26,28,29,32,33,34,35,37,39,43,46,883,888,890,898,901,904,908,913,914,916,917,918,923,925,931,932,937,938,accident:904,accommod:46,887,accomplish:23,26,accord:3,19,21,23,36,38,43,154,167,896,897,903,910,932,934,accordingli:890,account:20,21,23,24,25,28,30,48,56,245,883,904,918,923,928,932,936,938,account_expir:245,824,acknowledg:905,acl:3,4,8,18,20,21,22,23,31,903,acl_fil:4,8,19,20,34,acquir:3,6,8,23,43,48,245,274,399,543,896,904,910,934,acquisit:43,400,across:17,20,21,34,43,914,915,916,924,act:10,19,21,26,887,904,action:4,6,14,887,905,915,activ:6,8,14,21,23,25,37,40,169,927,actor:19,actual:6,14,23,26,35,46,98,99,100,102,103,113,129,287,288,289,290,294,298,887,925,actual_mech:43,ad_kdcissu:318,408,ad_typ:195,797,896,ad_type_extern:775,ad_type_field_type_mask:775,ad_type_regist:775,ad_type_reserv:775,add:3,6,9,11,12,14,15,19,20,21,22,23,31,33,36,38,48,338,340,698,884,904,925,add_auth_ind:904,917,add_mkei:14,23,add_princip:5,14,25,37,add_rel:920,added:3,6,14,15,20,23,24,25,32,34,38,40,300,726,883,904,907,addent:11,904,adding:3,8,23,32,41,904,addit:3,18,19,20,21,22,23,26,29,34,37,38,39,40,43,46,48,360,361,410,822,883,887,890,892,894,895,904,905,908,917,922,928,932,939,addition:10,21,36,916,925,addpol:3,23,35,addprinc:3,23,34,37,884,914,addr1:52,53,addr2:52,53,addr:54,232,233,234,329,811,812,818,address1:896,address2:896,address:0,15,20,21,23,24,30,33,38,39,44,48,260,322,323,328,353,356,357,518,519,520,521,791,810,812,819,832,892,896,904,919,925,928,929,address_list:826,addresssanit:904,addrlist:54,addrtyp:425,791,896,addrtype_addrport:775,addrtype_chao:775,addrtype_ddp:775,addrtype_inet6:775,addrtype_inet:775,addrtype_ipport:775,addrtype_is_loc:775,addrtype_iso:775,addrtype_netbio:775,addrtype_xn:775,adjust:14,29,33,34,37,48,100,103,288,290,406,adm:20,22,39,admcil:19,admcilsp:19,admin24:22,admin:3,4,5,8,14,15,16,19,21,23,26,32,34,883,892,903,904,914,932,939,admin_serv:3,8,20,21,23,34,39,adminhost:3,23,administ:4,15,34,administr:0,2,3,4,5,6,11,14,15,16,18,19,20,21,22,24,25,26,31,32,35,36,38,883,889,902,903,904,905,915,922,924,928,938,939,adminjohndoefoo:21,adtyp:797,advanc:14,30,150,312,904,922,advantag:14,21,26,32,advertis:21,905,advic:31,advis:14,905,aead:48,aes128:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,aes256:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,aes:20,905,aesni:892,905,af_unspec:919,affect:4,19,20,21,26,28,40,120,126,133,229,904,928,939,afford:32,afs3:14,after:2,3,4,6,10,12,14,21,23,24,25,33,34,35,37,80,98,136,228,272,377,398,871,882,883,888,890,896,897,900,901,904,924,925,932,939,afterward:23,915,again:14,23,28,33,34,706,887,904,910,924,925,against:2,14,20,21,25,28,34,39,40,46,48,129,298,339,353,356,357,360,408,887,892,904,907,910,931,937,agent:20,agre:905,agreement:905,aklog:55,alexand:905,alg:892,alg_id:865,algid:724,algorithm:14,26,126,892,901,905,932,alia:3,11,15,23,43,48,144,146,310,362,363,alias:3,11,15,22,23,38,39,904,alic:11,28,937,938,all:0,2,3,6,9,14,15,17,18,19,20,21,23,24,25,28,29,32,33,34,35,37,38,43,46,48,153,163,164,282,339,356,410,733,734,739,803,813,883,884,887,890,891,895,896,901,904,905,916,918,925,927,929,930,931,932,934,937,939,alloc:43,46,48,61,78,93,98,99,100,102,103,107,115,117,119,121,124,148,280,287,288,289,290,296,352,354,403,813,856,907,909,911,914,918,allow:2,3,4,5,6,8,10,12,14,15,16,17,18,19,20,21,23,24,26,28,29,32,33,34,35,36,37,38,40,41,43,46,48,111,252,279,356,401,403,884,886,888,890,892,894,897,904,905,906,907,908,910,911,912,913,914,915,916,917,918,919,920,921,924,925,928,931,938,allow_dup_skei:3,23,allow_forward:3,5,23,allow_postd:3,5,23,allow_proxi:3,23,allow_renew:3,23,allow_svr:3,23,25,35,40,allow_tgs_req:3,23,allow_tix:3,23,allow_weak_crypto:14,21,26,41,48,allowedkeysalt:3,23,almeida:905,alon:34,909,along:0,36,813,883,892,910,alongsid:34,alphabet:884,alphanumer:21,alreadi:6,14,22,23,34,36,124,330,883,890,892,894,928,932,934,also:15,17,18,22,23,24,25,26,28,29,32,33,34,35,37,38,39,40,43,46,126,339,400,882,883,886,892,894,896,904,905,907,908,910,911,913,914,916,918,920,921,925,alter:14,37,altern:8,15,20,21,22,24,28,34,37,43,495,890,892,903,904,905,928,although:39,886,905,911,921,924,925,altogeth:20,alwai:14,15,20,21,23,24,39,44,51,55,61,63,66,68,71,80,83,139,142,155,362,702,896,900,904,america:905,among:46,amount:20,21,35,39,102,119,121,289,358,891,an2ln:21,918,an2ln_typ:918,analog:15,anam:56,932,anchor:20,21,928,andrea:905,andrew:5,23,ani:0,3,6,8,9,10,14,15,16,17,19,20,21,23,24,25,26,28,32,34,36,37,38,39,40,41,43,46,48,56,137,147,153,154,156,224,260,268,275,278,279,308,313,356,360,361,401,410,726,823,883,887,888,896,897,901,904,905,906,910,911,918,924,925,928,929,932,938,ank:3,23,anl:21,annot:16,36,904,anonym:3,20,23,25,28,43,48,496,497,904,925,928,929,anoth:15,17,21,24,32,41,48,101,171,812,883,887,892,896,908,914,918,919,925,939,ansi:891,answer:21,46,48,363,717,724,726,862,910,anticip:33,39,anyon:924,938,anyth:21,37,anywai:20,39,46,327,anywher:924,939,ap_opt:326,327,372,795,872,ap_opts_etype_negoti:775,ap_opts_mutual_requir:327,356,372,775,ap_opts_reserv:775,ap_opts_use_session_kei:327,775,ap_opts_use_subkei:327,775,ap_opts_wire_mask:775,ap_req_authdata:195,ap_req_nofail:412,880,ap_req_opt:326,327,356,372,api:0,14,41,43,45,98,100,103,123,186,188,190,191,196,197,245,250,251,262,281,288,290,348,350,407,726,813,833,883,889,892,904,906,917,appdata:21,887,appdefault:48,appear:14,20,21,24,34,37,39,41,46,896,905,909,append:3,20,23,38,384,886,892,901,appl:889,905,appl_vers:360,372,appli:3,10,14,18,19,20,21,23,24,35,41,43,171,905,914,917,925,928,932,936,applic:0,12,16,18,20,21,28,30,31,37,43,46,48,59,60,156,250,326,327,328,360,372,499,523,524,704,727,882,883,886,887,889,892,902,904,905,908,910,913,918,920,924,925,931,935,938,appnam:59,60,approach:43,appropri:6,14,21,23,24,28,29,34,37,39,43,46,154,370,395,906,916,917,928,929,932,approxim:891,904,apputil:889,aprepencpart:793,arbitrari:3,23,43,arcfour:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,architectur:890,892,archiv:42,891,area:34,46,arg:3,23,413,414,415,788,789,892,932,arg_keytab:232,235,argument:3,4,6,8,10,14,20,23,44,46,48,63,80,91,93,245,257,260,263,275,322,323,328,349,351,353,357,383,413,414,415,875,892,904,909,910,918,932,934,argv_pars:905,ari:932,aris:905,armor:20,37,48,229,908,917,928,armor_ccach:928,around:23,892,arrai:3,36,43,46,48,100,103,111,173,240,244,254,288,290,319,329,349,351,807,811,813,818,819,832,854,855,918,920,arrang:23,arriv:887,asan:892,asc:891,ascii:6,23,39,896,ask:6,37,39,46,48,724,725,726,908,924,925,928,932,asn:48,897,898,907,aspect:15,28,913,assert:20,43,896,904,910,917,assign:3,19,20,23,34,39,48,82,84,932,associ:3,4,9,19,20,21,23,35,38,43,532,883,887,896,905,939,assum:14,21,34,36,39,43,44,107,124,155,891,925,928,939,asynchron:400,917,athena:3,5,14,15,19,20,21,23,24,28,32,34,892,905,920,924,925,939,athent:260,attach:904,attack:2,14,21,23,29,30,32,35,40,46,322,323,328,887,904,928,attempt:0,3,6,20,21,23,24,29,35,39,43,122,243,250,410,896,932,attr:252,827,attribut:3,5,6,9,16,19,20,21,22,23,24,26,36,37,48,253,827,904,905,907,910,917,928,932,audit:904,aug:3,23,augment:910,august:905,auth:16,20,39,43,48,61,326,327,356,360,361,372,499,797,811,819,auth_context:61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,90,223,320,322,323,324,325,326,327,328,351,353,354,355,356,357,360,361,372,auth_gssapi:3,23,auth_to_loc:21,28,918,auth_to_local_nam:21,28,authdata1:896,authdata2:896,authdata:184,189,224,318,319,408,812,896,912,928,929,authdata_plugin:913,authdatum:408,authent:3,5,6,10,12,14,15,20,21,22,24,25,26,29,30,32,34,35,36,37,38,39,40,43,44,46,48,61,62,63,64,66,67,68,69,71,72,73,74,76,77,79,80,81,82,83,84,85,86,87,88,89,90,166,201,223,224,250,319,320,322,323,324,325,326,327,328,339,351,353,354,355,356,357,372,433,495,501,610,724,793,795,799,845,862,872,883,886,887,888,889,896,897,901,904,905,907,917,918,925,928,929,935,939,authfrom:174,author:3,19,20,21,48,153,224,253,609,732,812,849,904,905,912,927,authoriaz:799,authorit:19,21,154,906,911,914,918,919,authoritykeyidentifi:37,authorization_data:799,819,832,authtim:337,338,339,340,870,896,authtime_out:333,authto:174,authz:832,auto:904,autoconf:889,autodoc:894,autohead:890,autolock:905,autom:890,904,automak:909,automat:3,4,6,8,15,17,23,34,883,886,888,890,901,904,925,927,932,autoreconf:890,avail:3,6,11,12,14,20,21,29,34,38,43,46,56,122,165,170,187,192,193,227,252,304,308,313,358,365,368,371,395,412,558,809,831,869,883,890,901,906,912,927,929,933,939,avoid:3,14,19,24,38,46,245,892,904,925,awai:14,41,924,925,awar:896,awk:6,back:19,20,23,24,30,39,40,883,892,897,904,910,913,backend:14,892,904,905,background:4,8,10,34,backslash:341,backspac:341,backup:30,32,39,888,backward:8,20,21,24,26,34,934,bad:34,135,156,balanc:14,38,39,banner:46,349,858,bar:6,21,basch:905,base:0,3,20,21,22,23,24,25,26,34,37,38,39,43,46,49,59,60,62,98,117,296,385,883,887,894,903,904,905,908,913,917,921,925,928,937,basi:14,18,23,39,basic:920,basicconstraint:37,baz:21,bb463167:42,becaus:6,17,19,20,21,23,24,25,35,37,38,39,41,43,46,251,339,883,890,892,896,900,915,917,920,924,928,938,becom:0,6,14,17,21,23,34,39,136,235,260,275,883,904,924,928,932,beeblebrox:34,been:6,12,14,20,21,23,26,35,124,883,887,901,904,905,910,913,925,929,936,939,beep:925,927,befor:2,3,4,5,6,14,15,20,21,22,23,26,35,37,39,41,44,98,100,103,155,288,290,378,386,813,856,884,887,888,890,905,908,915,917,925,928,beforehand:43,began:14,begin:4,6,15,21,23,28,36,43,99,100,102,103,203,209,287,288,289,290,400,896,907,910,911,920,937,behalf:934,behav:3,43,403,412,882,892,behavior:3,14,20,21,28,39,43,46,228,410,412,904,909,912,913,918,927,931,936,behind:14,28,being:3,14,20,21,23,29,39,44,46,245,369,726,887,894,937,belong:33,161,below:6,20,21,23,28,36,726,889,905,932,benefit:39,berkelei:892,905,besid:15,21,best:14,25,34,38,beta:6,23,better:23,24,833,904,between:3,9,20,21,23,25,26,29,34,35,41,45,136,158,382,871,883,904,918,925,927,928,beyond:901,908,913,917,939,big:896,897,898,900,910,biggest:14,bin:34,890,892,894,903,932,binari:21,32,892,905,bind:3,5,20,21,22,23,39,904,931,bind_dn:3,binddn:3,bindir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,bindpwd:3,bison:892,bit:14,20,24,37,46,66,83,142,153,157,356,871,882,896,900,904,907,932,bitwis:151,726,bjaspan:3,23,blank:937,bleep:3,11,23,925,938,939,block:14,20,24,48,99,100,102,103,122,287,288,289,290,904,blocksiz:95,bob:932,938,bodi:832,917,book:15,904,boot:34,888,bootstrap:21,borrow:925,boston:39,both:3,12,21,22,23,24,26,28,29,36,37,39,40,43,159,245,251,890,904,905,909,932,bourn:34,box:36,brace:21,909,bracket:20,21,28,breviti:897,brian:905,bridg:904,brief:32,889,913,broken:14,892,brother:905,brute:14,23,35,bsd:904,905,btree:6,23,buffer:23,43,48,56,98,99,119,170,187,192,193,279,287,304,328,336,337,371,394,395,401,403,405,533,813,910,buflen:170,187,192,193,371,394,395,bug:0,23,42,889,890,922,build:34,39,41,48,49,136,883,889,892,902,903,904,909,913,931,built:21,24,28,46,48,375,883,890,892,904,910,920,925,931,builtin:892,904,905,bundl:21,905,bunni:39,busi:905,byacc:892,c89:891,cacert:29,37,cach:3,14,15,21,23,28,43,44,48,78,138,140,223,224,229,247,264,267,320,322,323,326,328,353,356,357,372,400,410,517,540,544,741,885,889,892,893,899,903,904,912,925,927,928,929,931,932,933,934,937,939,cache_nam:3,23,927,928,929,cache_out:132,154,cacheconf:896,cachenam:883,933,cachetyp:904,cacreateseri:37,caddr:811,818,819,cakei:37,california:905,call:14,16,20,21,23,24,28,34,43,46,91,93,100,103,113,125,126,136,156,158,176,228,245,251,261,268,275,279,282,288,290,294,306,315,320,377,378,401,813,856,863,882,883,889,890,904,908,909,910,915,917,918,924,932,callback:48,260,275,349,377,378,384,842,856,858,862,904,908,917,919,caller:43,46,71,85,99,100,102,103,117,119,121,136,144,146,245,252,269,279,287,288,289,290,296,310,312,327,358,362,363,401,410,813,882,904,911,917,920,camellia128:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,camellia256:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,camellia:20,904,can:0,2,3,4,5,6,8,9,10,11,14,15,16,17,18,19,20,21,22,23,24,25,26,28,29,32,33,34,35,36,37,38,39,40,41,43,46,50,56,136,138,154,224,254,271,305,328,339,341,363,383,386,397,400,410,412,723,851,852,862,870,882,883,884,886,887,890,891,892,894,896,897,904,906,907,908,909,910,911,913,914,915,916,917,918,919,921,924,925,928,932,936,939,cancel:23,candid:901,932,cannot:3,15,23,24,25,35,37,43,46,135,151,260,341,410,871,896,925,928,929,934,canon:4,15,22,23,38,39,192,914,918,canonhost_out:194,canonic:15,21,22,33,43,48,386,541,904,928,934,capabl:32,904,924,capac:25,capath:20,card:3,20,21,23,904,care:3,14,19,23,28,43,913,carefulli:37,carnegi:905,carri:3,25,939,cartoon:34,casio:14,cast:871,882,906,908,909,914,915,916,917,919,921,cat:6,categori:25,caus:3,4,6,14,20,21,23,24,25,26,34,35,37,38,39,40,43,48,122,245,247,385,722,883,887,892,904,905,929,933,caution:3,cb_data:383,874,cb_ret:920,cbc:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,cbdata:920,cbrown:939,cc246071:904,cc246091:904,ccach:3,23,41,43,48,132,135,164,224,225,226,232,233,234,246,250,251,264,267,326,372,380,400,410,803,892,903,906,930,934,ccache_typ:21,ccachenam:892,ccapi:889,905,ccselect:28,904,909,912,919,ccselect_plugin:906,909,ceas:0,6,23,cell:14,center:10,889,905,939,central:0,cert:16,21,37,cert_fil:934,certain:23,32,236,892,905,934,939,certauth:904,912,certauth_plugin:907,certid:21,certif:3,20,21,29,40,43,48,253,681,898,904,912,934,939,certifi:21,certlabel:21,cf2:48,cflag:892,931,cfr:905,chain:20,21,904,challeng:20,21,40,46,48,363,364,365,367,368,683,686,724,725,862,865,897,904,chang:2,3,6,9,14,15,19,20,21,22,24,25,26,28,33,34,37,39,43,46,48,78,136,158,245,260,379,380,615,705,882,890,894,896,903,904,905,913,915,921,923,930,932,938,change_password:26,change_password_for:379,380,changeov:34,changepw:3,14,15,23,26,166,245,379,channel:14,21,36,43,46,322,904,932,charact:3,19,20,21,23,34,38,39,341,394,404,701,930,charg:905,chat:922,check:12,20,21,23,26,28,34,37,43,48,59,60,153,283,353,356,357,545,890,892,894,900,909,920,921,925,929,932,check_a:916,check_tg:916,checkout:894,checksum:43,48,104,175,202,203,326,327,328,330,337,338,339,340,527,534,649,650,654,799,842,898,901,910,checksum_typ:804,cheetah:894,chicago:905,chl:46,364,365,367,chl_out:368,choic:21,38,43,46,250,928,choos:14,22,25,34,38,39,43,888,906,924,928,937,chosen:16,21,22,26,43,46,229,891,897,903,904,906,937,chpass:3,23,915,chrand:3,23,chunk:114,295,cipher:14,26,48,99,100,102,103,287,288,289,290,cipher_st:99,100,102,103,287,288,289,290,ciphertext:25,99,100,102,103,104,287,288,289,290,793,817,897,901,circular:23,circumst:20,37,citi:905,ckf_:726,ckfrom:175,cksum:113,129,294,298,409,cksumtyp:81,96,111,113,114,130,170,294,295,299,cksumtype_cmac_camellia128:775,cksumtype_cmac_camellia256:775,cksumtype_crc32:775,cksumtype_descbc:775,cksumtype_hmac_md5_arcfour:775,cksumtype_hmac_sha1_96_aes128:775,cksumtype_hmac_sha1_96_aes256:775,cksumtype_hmac_sha1_des3:775,cksumtype_hmac_sha256_128_aes128:775,cksumtype_hmac_sha384_192_aes256:775,cksumtype_md5_hmac_arcfour:775,cksumtype_nist_sha:775,cksumtype_rsa_md4:775,cksumtype_rsa_md4_d:775,cksumtype_rsa_md5:775,cksumtype_rsa_md5_d:775,cksumtypep:387,ckto:175,claim:905,clang:904,clarifi:37,clariti:932,clean:23,268,269,383,894,904,920,cleanli:904,cleanup:46,920,clear:3,6,11,15,23,36,46,48,136,156,374,clearpolici:3,19,23,cleartext:794,810,818,click:34,client1:37,client2:37,client:3,12,14,16,18,20,21,22,23,25,26,28,31,32,34,35,36,38,39,40,41,43,46,48,145,154,223,224,235,241,242,258,260,264,267,275,276,277,327,330,356,360,400,645,726,793,794,799,811,812,819,822,831,832,883,887,889,892,896,897,898,903,904,905,906,907,909,912,914,917,919,925,928,929,931,932,934,937,939,client_aware_channel_bind:21,client_aware_gss_bind:904,client_cert:37,client_kei:904,client_keytab:43,client_princ:46,clientauth:21,clientkei:37,clifford:939,clock:21,34,48,267,353,357,884,917,928,clockskew:15,21,356,901,920,928,close:21,32,48,71,85,132,137,138,148,164,167,265,305,741,901,915,921,clpreauth:28,912,clpreauth_mymech_initvt:909,clpreauth_plugin:908,cmac:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,cmd_path:932,cname:33,34,38,39,code:0,20,21,23,41,43,46,48,49,50,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,117,118,119,120,121,122,124,125,126,129,130,133,134,135,141,142,145,147,148,149,150,151,152,153,154,155,156,157,158,159,161,162,163,164,166,169,170,171,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,251,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,287,288,289,290,294,295,296,298,299,300,301,303,304,306,308,309,312,313,314,315,316,319,320,321,322,323,324,325,326,327,328,329,330,332,334,335,336,339,341,342,344,349,351,352,353,354,355,356,357,358,360,361,371,372,373,374,375,379,380,381,382,386,393,394,395,397,398,399,400,401,402,403,404,405,406,410,716,822,823,851,871,882,889,891,892,904,905,908,909,910,913,915,917,919,920,921,922,coerc:901,coexist:19,collect:21,43,48,132,154,714,715,889,904,906,927,928,929,933,937,939,collis:48,887,colon:5,20,21,23,28,39,152,341,343,416,939,column:6,com:3,6,9,11,16,20,21,22,23,28,35,37,38,39,41,42,897,898,904,905,924,925,937,938,939,com_err:823,892,904,909,combin:3,8,15,20,23,26,43,48,254,897,929,come:21,46,356,890,891,924,comma:3,6,10,20,21,23,command:4,8,9,10,14,15,20,21,22,23,24,26,29,32,34,35,37,41,884,886,889,890,891,892,904,923,924,925,927,930,932,934,939,command_opt:5,6,23,commenc:34,comment:0,15,21,commerci:21,37,905,commit:9,905,915,common:21,23,25,34,43,892,905,908,924,938,common_appdata:21,commonconfig:21,commonli:8,41,commun:0,21,23,25,29,34,37,43,851,883,889,905,906,922,compani:925,companion:36,compar:47,48,129,298,897,comparison:21,compat:8,20,21,36,43,890,892,904,914,916,934,compil:0,890,891,892,893,904,905,931,932,compile_et:892,complet:5,6,14,20,21,23,39,43,45,158,272,274,356,372,398,399,724,889,892,893,complex:904,compli:905,complic:37,892,compon:19,21,28,37,38,43,46,48,92,93,223,341,342,347,385,640,694,696,749,896,900,904,905,920,925,937,component1:896,900,component2:896,900,compos:37,compress:891,compromis:14,17,21,32,883,888,comput:14,20,21,29,43,44,46,48,91,117,129,229,296,298,898,905,908,917,924,925,concaten:717,897,910,concatent:910,concept:902,912,concern:25,35,905,925,concis:920,concret:894,concurr:20,24,condit:37,154,904,905,932,conduct:29,conf:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,22,23,24,25,26,27,28,29,30,31,32,33,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,conf_keyfil:5,23,conf_req_flag:43,conf_stat:43,confidenti:26,43,904,config:20,21,23,141,155,269,375,889,892,903,904,910,923,926,configur:3,4,5,9,14,16,17,19,20,21,23,24,25,30,31,38,41,43,46,48,50,78,154,167,194,251,261,269,385,410,412,558,559,884,887,889,890,891,893,894,904,909,912,921,925,928,929,932,936,938,939,confirm:2,3,5,6,23,130,299,904,934,conflict:15,28,356,597,598,600,601,910,conform:21,891,904,930,confound:104,confus:905,confusingli:46,confvalid:889,conjunct:934,connect:3,4,5,8,12,20,23,32,34,38,43,48,883,887,904,905,925,consequ:14,consequenti:905,consid:0,14,21,24,33,39,41,339,887,892,896,consider:39,45,consist:21,39,341,886,891,896,897,904,911,918,consol:20,consolid:0,consortium:922,939,constant:46,57,58,713,719,807,constitut:905,constrain:3,23,330,542,647,904,934,constraint:905,937,construct:0,43,46,277,279,326,401,851,852,904,909,934,consult:21,918,consum:24,882,913,contact:3,7,8,14,20,21,23,29,39,260,883,906,922,935,contain:3,4,5,6,8,9,15,19,20,21,22,23,24,28,29,33,34,37,38,39,41,43,46,48,54,67,72,76,152,154,169,172,173,183,184,195,231,245,247,276,279,318,327,339,341,352,353,354,357,360,362,372,401,410,833,862,875,883,884,886,887,889,890,891,892,893,894,896,897,900,901,905,909,910,919,920,922,924,925,927,928,932,933,934,937,938,939,container_dn:3,23,container_reference_dn:5,23,containerdn:3,23,containerref:5,23,contempl:905,content:0,6,9,11,12,14,23,27,34,37,43,44,46,48,82,84,124,133,137,147,148,174,175,177,178,180,182,183,198,199,200,201,202,207,208,212,215,221,280,330,331,791,797,804,813,834,845,876,883,896,898,900,905,910,928,929,context:21,41,43,44,46,48,49,50,51,52,53,54,55,56,59,60,61,66,70,75,83,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,172,173,174,175,176,177,178,180,181,182,183,184,186,188,189,190,194,195,196,197,198,199,200,201,202,203,204,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,245,246,247,248,250,251,252,253,257,260,261,264,265,267,276,277,278,279,280,281,283,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,364,365,366,367,368,369,372,373,375,376,377,378,379,380,381,382,383,384,385,386,390,401,402,403,404,405,406,407,408,409,410,413,414,415,416,559,779,780,781,782,783,784,785,786,824,851,852,858,862,874,904,906,908,909,911,917,918,919,context_handl:43,910,contigu:43,continu:2,6,17,34,897,904,905,932,contract:905,contrari:43,46,contribut:101,107,119,120,902,905,939,contributor:895,905,control:4,14,15,18,19,20,21,22,26,28,34,36,37,38,41,43,46,243,279,401,410,892,893,904,906,911,912,913,916,918,919,920,921,936,convei:14,23,39,43,823,849,904,905,conveni:46,320,365,368,890,convent:39,402,920,convention:939,convers:21,897,convert:14,21,38,43,48,169,258,386,937,cooki:594,899,904,917,coordin:910,copi:15,17,23,26,29,32,34,37,41,43,48,86,88,269,272,339,398,888,896,905,913,920,925,932,copyright:889,891,905,939,core:908,913,917,920,922,corpor:905,939,correct:4,10,14,21,23,33,34,41,124,721,883,892,904,905,correctli:12,43,851,852,882,904,924,correspond:6,19,21,37,39,43,44,46,56,152,245,263,339,870,894,897,904,909,915,939,corrupt:6,17,23,904,cost:23,29,892,905,could:0,14,16,17,21,25,28,33,34,35,39,887,904,909,924,925,932,couldn:12,count:3,6,23,43,48,87,89,111,286,896,900,counter:3,23,35,countermeasur:32,counterpart:19,33,countri:905,cours:17,courtesan:905,cover:33,coverag:890,cpp:892,cppflag:892,cppopt:892,cpu:40,cpw:3,14,23,crash:17,21,34,crawdad:905,crawford:905,crc:14,26,creat:3,4,7,12,14,15,19,20,21,22,24,26,28,31,32,35,43,47,48,67,72,76,93,113,114,125,126,135,138,172,173,174,175,176,177,178,180,182,183,205,236,262,265,271,294,295,305,306,321,328,342,356,360,361,372,384,397,410,696,883,884,886,890,894,897,901,904,905,906,907,908,910,911,912,914,915,916,917,918,919,920,921,922,924,925,928,create_polici:23,creation:14,21,23,37,897,creativ:905,creativecommon:905,cred:46,48,150,151,153,159,166,232,233,234,235,260,264,267,272,275,379,398,400,410,526,904,932,cred_handl:43,910,cred_stor:43,cred_usag:43,cred_usage_stor:43,creddata:351,credenti:3,8,12,16,20,21,23,28,33,35,37,45,48,138,166,177,206,207,223,224,229,326,330,351,372,399,436,544,613,646,733,809,810,811,812,863,882,885,886,887,889,892,899,904,908,910,911,912,917,925,927,928,929,931,932,933,934,937,939,credentials_cach:3,23,creds_out:351,criteria:37,883,critic:46,922,crl:20,21,cron:17,20,34,39,cross:20,21,338,339,340,356,892,896,904,crt:20,21,crypto:14,120,121,191,889,892,904,905,crypto_entri:820,crypto_test:905,cryptograph:14,43,904,905,cryptographi:14,40,cryptosystem:14,csv:6,904,ctime:794,799,822,cts:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,ctx:43,72,73,76,77,86,87,88,89,171,176,213,228,270,271,272,273,274,275,276,277,278,279,343,362,363,364,365,366,367,368,369,370,376,396,397,398,399,400,401,413,414,415,416,863,ctype:109,110,127,131,168,409,cuba:905,cultur:905,current:2,3,6,8,9,11,14,20,21,22,23,28,39,48,136,179,327,343,353,357,379,436,728,875,883,886,892,896,901,904,908,911,912,917,925,930,937,939,curri:15,curs:892,cursor:48,139,150,158,163,164,312,316,801,803,curv:21,40,cusec:794,799,822,custom:21,894,903,904,907,cut:39,cve:904,cybersaf:535,905,cycl:904,cygnu:652,905,daemon:8,19,20,21,23,31,36,37,38,883,888,904,909,939,daffodil:15,925,dai:3,5,21,23,37,48,393,884,925,939,daili:14,daisi:39,dal:913,damag:883,905,danger:17,932,danilo:905,dash:21,data:3,6,9,14,20,21,22,23,24,26,32,43,44,46,48,63,79,80,98,113,114,117,119,120,121,123,129,130,141,151,153,155,169,178,203,208,212,224,245,253,257,258,260,262,275,294,295,296,298,299,320,323,326,327,328,330,332,337,338,349,351,353,356,357,365,368,372,373,377,378,379,380,383,385,390,462,474,475,476,532,533,666,708,732,779,780,783,797,799,807,809,812,813,815,818,819,822,824,831,832,842,845,849,851,852,854,855,858,861,863,872,877,883,887,888,892,896,897,898,900,904,905,907,908,909,912,916,917,921,929,data_length:116,data_set:43,databas:2,4,5,6,7,8,9,10,12,15,18,19,20,21,22,26,28,30,31,32,35,37,43,886,888,889,892,893,903,904,905,912,915,917,928,931,932,939,database_modul:20,24,database_nam:20,23,34,datadir:892,datarootdir:892,datatyp:45,date:3,6,8,20,21,26,37,167,224,395,818,885,904,datebas:4,david:15,23,924,925,939,db2:3,6,20,23,35,889,903,904,db3:892,db_185:892,db_arg:3,4,6,8,10,23,db_header:892,db_lib:892,db_librari:20,22,24,db_module_dir:20,db_princ_arg:3,23,dbadmin:19,dbdefault:5,23,dbmatch:21,dbmodul:3,22,23,24,35,dbname:3,6,10,23,dbutil:905,dce:43,48,636,668,904,dcmd_path:932,deactiv:20,deal:883,905,dealloc:92,911,918,debian:31,904,debug:3,7,8,9,20,28,891,dec:34,35,884,dec_err:321,dec_error:352,decid:34,39,245,925,decim:6,43,896,939,decis:30,905,914,918,939,declar:43,910,decod:21,46,48,159,184,356,896,907,909,decompos:533,decreas:21,886,decrement:48,decrypt:3,23,35,43,48,79,351,361,813,869,887,932,934,dedic:34,default_ccache_nam:21,136,883,939,default_client_keytab_nam:15,21,886,default_cr:43,default_domain:21,default_kdb_fil:893,default_kdc_enctyp:893,default_keytab_nam:21,886,893,default_principal_expir:20,884,default_principal_flag:19,20,904,default_profile_path:893,default_rcache_nam:21,887,default_realm:21,28,33,34,911,920,default_tgs_enctyp:21,26,default_tkt_enctyp:21,26,default_valu:59,60,defccnam:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,defcktnam:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,defeat:40,defens:25,defer:43,911,914,918,defin:3,12,20,21,33,34,39,43,101,119,228,726,887,892,896,897,909,913,920,921,932,definit:10,16,20,889,905,914,916,defktnam:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,dejagnu:890,892,del_polici:3,23,delai:24,39,892,904,928,deleg:3,20,21,23,330,542,647,896,904,925,929,934,delegated_cred_handl:43,delent:11,delet:2,3,5,6,11,15,19,21,32,34,151,887,904,905,924,927,932,939,delimit:21,309,delold:2,14,26,delpol:3,23,delprinc:3,23,delstr:3,delta:20,48,deltat:187,deltatp:388,demand:410,demonstr:12,14,deni:3,19,23,25,28,35,914,918,932,denial:21,denot:6,19,884,897,depart:905,depend:25,33,39,43,46,126,362,370,726,862,891,892,903,909,921,924,925,deploi:36,37,38,890,deploy:14,24,37,deprec:14,20,26,70,75,94,123,131,168,186,188,190,191,196,197,225,226,232,233,234,239,281,307,348,350,390,407,409,904,der:897,907,917,der_out:320,322,323,328,deriv:6,14,20,23,25,48,99,100,102,103,113,129,287,288,289,290,294,298,897,901,904,905,930,des3:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,des:14,26,descend:883,887,describ:0,3,14,15,16,21,23,24,25,28,32,34,37,43,372,402,813,822,823,882,896,905,908,909,910,912,920,925,932,descript:23,32,39,43,822,889,903,904,906,907,908,911,913,914,915,916,917,918,919,920,921,descriptor:62,360,361,372,design:28,34,46,313,883,887,939,desir:14,15,23,28,43,119,121,250,251,326,892,904,919,932,desired_mech:43,910,desired_nam:43,desired_object:43,desktop:46,dest_ctx:179,destdir:890,destin:32,890,destroi:43,48,136,147,148,383,410,883,904,906,907,908,911,914,915,916,917,918,919,921,923,927,928,destroy_polici:23,detach:8,detail:10,14,15,22,24,26,28,33,34,36,262,724,883,889,891,904,906,907,908,911,914,915,916,917,918,919,920,921,932,detect:6,8,14,23,320,322,323,328,353,357,887,892,910,determin:3,4,5,6,8,20,21,23,24,28,34,43,48,62,102,105,117,136,154,230,231,261,289,356,382,386,412,875,883,886,887,890,892,897,900,904,907,911,914,918,919,925,939,dev:20,21,41,939,develop:0,890,902,904,905,922,939,devic:3,20,21,23,46,devicenam:20,dfl:21,887,939,dget_tgt_via_passwd:932,dict:3,21,23,dict_fil:4,20,921,dictat:23,dictionari:20,21,29,30,34,35,40,904,921,928,did:34,223,267,339,925,didn:12,28,differ:3,6,12,15,21,25,26,28,33,34,37,38,39,43,45,48,107,119,159,265,372,382,851,887,890,892,909,917,918,924,925,928,932,939,diffi:20,21,928,difficult:35,difficulti:38,digest:20,905,digit:884,939,digitalsignatur:21,37,dir:20,21,37,883,892,903,928,939,direct:21,22,23,28,41,48,905,910,920,939,directli:3,18,20,21,23,29,34,43,46,372,613,910,917,928,933,directori:5,12,20,21,22,23,28,33,34,37,169,339,883,887,891,893,894,903,904,924,932,936,937,938,939,dirnam:21,883,dirpath:883,disabl:3,14,20,21,23,24,26,28,34,37,38,39,41,377,378,383,545,887,890,892,904,912,928,936,939,disable_encrypted_timestamp:21,25,40,disable_fresh:37,928,disable_last_success:20,22,35,disable_lockout:20,22,35,disallow:19,disallow_forward:5,23,disassoci:4,10,disast:39,disclaim:905,disclosur:19,904,discoveri:25,33,34,904,discuss:34,887,905,913,922,disjoint:0,disk:4,5,6,15,17,23,24,32,34,46,883,888,891,dispatch:910,displai:2,3,5,9,11,15,23,37,42,46,245,716,886,896,904,905,928,929,935,display:169,disrupt:14,dist:891,distclean:890,distinguish:5,21,23,905,distribut:10,889,890,891,892,893,904,905,925,939,distributor:905,divid:901,dll:28,909,910,920,dns:21,892,dns_canonicalize_hostnam:21,38,904,dns_canonicalize_realm:904,dns_lookup_kdc:21,dns_lookup_realm:21,39,dns_uri_lookup:21,39,dnsname:21,doc:22,42,894,document:5,20,21,23,29,33,34,43,882,890,892,901,904,905,909,922,doe:3,6,8,10,14,15,20,21,22,23,24,25,26,34,37,38,39,40,43,46,56,119,144,152,160,309,311,342,372,386,394,410,883,886,890,892,897,904,905,909,910,911,918,920,924,925,932,doesn:2,6,23,161,883,924,doing:6,23,29,46,904,905,909,928,932,domain:12,15,20,21,33,34,36,37,38,39,904,925,domain_realm:28,33,39,937,don:12,698,701,883,890,892,924,932,939,donat:23,905,done:8,22,23,32,34,39,883,892,908,917,920,932,939,dot:38,doubl:884,down:39,download:8,905,downstream:23,904,downtim:14,doxygen:0,894,dprinc_look_ahead:932,draft:680,683,686,904,drift:15,drive:890,drop:904,dry:6,dsa:471,dst:148,due:14,19,23,41,dug:905,dugsong:905,dump:4,7,8,17,20,24,34,903,904,dump_fil:4,dumpfil:6,23,892,dumptyp:6,dup:20,duplic:48,812,887,durabl:20,24,durat:3,20,21,23,870,928,932,dure:3,4,8,17,20,21,23,26,34,35,40,43,349,377,410,705,896,897,904,908,915,925,932,dynam:21,909,912,914,920,e19253:42,e2big:119,e_data:822,917,each:2,3,6,8,10,15,19,20,21,23,24,25,26,28,33,35,37,39,43,44,46,252,263,265,349,741,883,886,888,890,896,897,901,904,905,909,913,914,915,919,924,925,928,929,932,934,937,938,ear:905,earli:14,earlier:20,26,34,224,918,earliest:6,153,901,eas:36,easi:14,17,25,35,925,easier:0,14,904,easili:14,34,890,904,eavesdrop:43,eavesdropp:887,ebaa:42,eblock:186,188,190,196,197,281,348,350,390,407,echo:349,358,edata:917,edit:2,11,12,31,892,893,924,editor:0,edt:3,23,edu:0,3,5,12,14,15,19,20,21,23,24,28,32,34,42,904,905,920,922,924,925,932,educ:33,edwards25519:21,40,905,edwards25519_t:905,effect:14,19,20,21,23,37,39,717,883,887,effici:904,effort:25,eight:33,einval:260,370,387,389,391,392,either:15,20,21,22,23,25,26,34,35,36,37,41,43,44,195,245,253,274,322,323,324,328,399,400,403,717,852,883,890,901,905,909,914,918,925,932,938,eku:20,21,elaps:3,23,element:43,46,48,189,318,408,813,859,897,elements_stor:43,elimin:14,40,ellipt:40,els:34,909,924,925,932,elsewher:17,emac:892,email:0,637,924,emailprotect:21,embed:666,empti:3,6,19,20,21,23,36,43,46,48,93,229,231,279,342,385,386,401,410,887,892,896,928,enabl:3,4,8,14,15,20,21,22,23,24,25,28,34,36,37,39,40,41,43,55,78,883,891,892,904,907,912,932,939,enable_onli:21,28,enc:3,6,15,20,23,199,812,904,enc_err:321,enc_errbuf:352,enc_padata:818,enc_part2:373,809,831,869,enc_part:793,809,831,869,encdata:897,enckdcreppart:818,enckrbcredpart:811,enclos:20,21,884,encod:21,43,46,48,189,320,322,337,338,352,536,869,876,896,897,907,917,encompass:43,encount:21,34,929,encourag:21,encrypt:2,3,6,14,15,17,21,23,25,29,30,32,34,36,40,43,46,48,79,95,98,99,100,112,113,114,116,124,125,126,129,130,153,229,280,287,288,294,295,298,299,308,313,322,323,354,356,391,475,476,534,594,659,736,794,795,809,811,812,813,818,819,831,832,869,886,887,888,889,893,897,898,904,905,908,910,917,922,929,934,939,encrypted_challeng:21,encrypted_challenge_ind:20,904,encrypted_timestamp:21,enctyp:6,11,14,20,21,23,48,95,97,98,99,101,104,107,111,112,116,118,125,126,192,193,211,224,280,287,308,313,375,407,817,819,832,834,896,900,903,904,908,934,enctype_aes128_cts_hmac_sha1_96:443,775,enctype_aes128_cts_hmac_sha256_128:775,enctype_aes256_cts_hmac_sha1_96:444,775,enctype_aes256_cts_hmac_sha384_192:775,enctype_arcfour_hmac:775,enctype_arcfour_hmac_exp:775,enctype_camellia128_cts_cmac:775,enctype_camellia256_cts_cmac:775,enctype_des3_cbc_env:775,enctype_des3_cbc_raw:775,enctype_des3_cbc_sha1:775,enctype_des3_cbc_sha:775,enctype_des_cbc_crc:775,enctype_des_cbc_md4:775,enctype_des_cbc_md5:775,enctype_des_cbc_raw:775,enctype_des_hmac_sha1:775,enctype_dsa_sha1_cm:775,enctype_md5_rsa_cm:775,enctype_nul:101,229,775,enctype_out:229,enctype_rc2_cbc_env:775,enctype_rsa_env:775,enctype_rsa_es_oaep_env:775,enctype_sha1_rsa_cm:775,enctype_unknown:775,enctypep:389,end:6,20,21,23,24,30,33,34,39,92,93,164,329,811,819,832,870,892,896,900,901,904,913,932,939,endian:896,897,898,900,910,endors:905,endpoint:62,905,endtim:224,870,896,energi:905,enforc:21,enforce_ok_as_deleg:21,904,engin:39,enomem:119,223,231,300,320,322,enough:3,23,26,99,102,167,287,289,752,ensur:14,15,17,20,23,24,25,26,34,37,46,171,851,852,911,918,925,enter:3,5,10,14,23,34,37,322,323,328,358,910,924,925,enterpris:38,43,342,696,904,928,934,entir:3,14,20,39,533,896,917,entiti:43,905,entri:3,8,9,11,12,14,15,19,20,21,22,23,24,26,32,34,35,37,38,39,40,41,43,46,48,153,173,195,198,200,220,245,307,313,318,319,322,323,328,334,349,356,410,818,836,840,883,886,888,897,898,901,904,916,917,925,929,932,entropi:48,904,enumer:14,26,env:21,37,41,939,envelop:462,474,475,476,environ:14,15,20,21,23,24,26,28,30,34,35,37,41,43,56,136,268,269,282,383,384,883,886,887,890,903,904,envvar:21,eperm:914,918,epoch:48,871,equal:15,24,900,904,932,equip:939,equival:20,36,166,379,380,904,err_fmt:21,904,erron:41,error:3,20,21,24,34,37,39,43,48,49,50,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,117,118,119,120,121,122,124,125,126,129,130,133,134,135,137,141,142,145,147,148,149,150,151,152,153,154,155,156,157,158,159,161,162,163,164,166,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,236,238,243,248,260,261,262,264,265,266,267,268,271,272,274,275,276,277,278,279,280,282,287,288,289,290,294,295,296,298,299,300,301,303,304,306,308,309,312,313,314,315,316,319,320,321,322,323,324,325,326,327,328,329,330,332,334,335,336,339,341,342,344,349,351,353,354,355,356,357,358,360,361,371,372,373,374,375,379,380,381,382,386,393,394,395,397,398,399,400,401,402,403,404,405,406,410,538,610,612,699,700,822,823,851,887,889,892,904,908,909,914,915,917,918,925,934,error_t:905,escap:701,especi:15,26,34,38,904,essenti:20,est:23,35,884,establish:37,43,887,etc:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,etyp:6,229,375,660,904,934,etype_list:244,826,etype_list_length:244,826,euid:21,887,903,evalu:21,even:14,20,21,23,25,28,34,39,43,245,385,882,884,887,904,905,928,932,event:39,48,904,905,917,eventu:26,39,everi:20,21,23,32,34,48,316,883,evid:43,evolut:904,exact:22,891,exactli:21,34,153,403,734,735,739,897,932,examin:21,37,908,917,exampl:3,5,6,9,14,16,20,21,22,24,26,28,32,34,35,37,38,39,41,43,56,100,103,288,290,883,884,887,890,891,904,905,909,920,924,925,928,932,939,exce:882,884,except:3,15,19,21,23,37,39,43,326,904,905,932,excess:890,exchang:34,40,48,224,247,279,360,372,433,863,897,917,exclud:6,17,32,904,exclus:3,901,905,928,932,exec:892,931,932,execprefix:892,execut:3,6,22,34,46,377,891,892,931,exemplari:905,exhaust:32,exist:0,2,3,5,6,14,15,20,21,22,23,26,28,32,34,35,43,46,48,137,147,155,326,327,356,360,361,372,403,410,883,888,896,904,910,928,930,932,exit:3,10,11,23,883,904,925,929,934,exp:3,15,20,21,26,37,expand:21,901,904,expans:892,904,expdat:3,23,expect:14,21,34,41,267,337,338,339,340,716,894,908,913,925,expected_nonc:868,expens:20,25,35,experi:0,14,39,904,experienc:0,919,experiment:904,expir:2,3,6,15,19,20,21,23,26,33,37,43,46,48,224,243,260,818,870,883,884,887,896,904,925,928,929,932,939,expiri:14,245,904,explain:34,explicit:14,19,21,22,24,28,39,905,explicitli:3,14,19,23,28,34,44,253,892,904,914,915,916,925,expos:3,6,14,23,46,834,928,932,express:3,21,23,884,905,extend:20,21,37,48,416,875,910,939,extendedkeyusag:37,extens:37,39,247,894,904,910,extent:905,extern:20,22,43,896,extfil:37,extra:19,39,40,752,891,extra_address:21,extract:3,15,19,23,34,229,886,904,extrem:3,eytab:3,15,facil:4,15,20,43,904,facilit:904,factor:21,897,fail:2,3,6,14,15,20,21,23,24,35,38,39,43,46,228,260,279,339,351,401,851,890,892,904,910,911,925,927,932,fail_count:6,failov:39,failur:3,6,14,23,24,35,46,119,129,130,159,260,298,299,308,403,404,405,904,905,919,921,failurecountinterv:3,23,35,failuretim:3,23,fake:21,46,fall:39,40,883,904,fallback:3,20,21,23,38,40,46,904,911,fallback_realm:911,fals:14,20,21,23,26,28,33,36,37,38,39,52,54,105,109,110,127,128,160,192,245,283,284,285,317,345,346,347,359,385,412,938,famili:20,123,186,188,190,191,196,197,250,251,281,348,350,407,919,famou:34,far:37,fashion:29,905,932,fast:20,21,25,36,37,48,229,539,594,896,904,908,917,fast_avail:896,fast_ccache_nam:247,faster:25,39,883,890,fatal:154,fdii:925,feasibl:34,featur:24,29,365,368,902,905,922,feb:9,februari:882,fee:905,feedback:0,fellow:905,fenc:909,fences_wicker_initvt:909,fermi:905,fetch:4,5,6,10,11,21,23,71,141,410,904,few:892,924,939,fiat:905,fiction:909,fictiti:925,field:3,6,20,21,23,35,36,37,39,44,46,48,153,256,308,327,328,338,340,349,353,354,356,357,408,735,739,875,896,897,900,901,904,908,909,917,921,925,937,file2:887,901,939,file:3,4,5,6,7,9,10,11,12,14,15,16,17,19,22,24,28,29,30,31,37,38,39,41,46,48,50,152,262,269,315,360,361,372,375,741,883,884,885,886,887,889,890,891,892,893,894,902,903,904,905,906,907,908,909,910,911,913,914,915,916,917,918,919,920,921,923,924,925,932,937,938,939,filenam:2,3,5,6,7,8,15,20,21,23,28,34,36,37,41,43,384,883,887,904,939,filesystem:20,23,34,37,901,903,fill:46,48,50,56,119,121,134,150,152,224,230,231,301,304,309,324,344,354,355,387,388,391,393,394,900,901,909,920,filter:20,21,find:12,21,23,38,39,43,48,50,896,901,904,906,924,925,928,932,fine:39,43,fini:906,907,908,911,914,915,916,917,918,919,finish:48,fip:904,fire:39,firewal:29,39,41,firm:905,first:3,6,9,12,16,19,20,21,22,23,26,28,34,37,38,39,43,44,52,53,93,105,136,228,258,279,319,345,346,347,358,359,383,401,749,813,886,887,890,892,894,896,897,898,900,901,904,905,907,909,910,911,916,918,925,930,932,937,939,fit:309,905,five:3,21,23,34,884,887,915,930,fix:6,901,904,flag:2,3,5,6,11,14,19,20,21,22,23,25,26,28,33,35,39,40,43,46,48,55,62,69,74,78,122,151,153,192,269,279,322,323,324,328,338,340,349,351,353,356,357,360,361,401,714,715,716,717,721,722,723,724,726,733,734,811,812,813,818,819,826,865,880,883,892,904,908,917,925,927,928,929,931,932,flag_rsa_protocol:928,flagnam:19,flat:883,flavor:3,23,flexibl:21,38,flip:14,flush:920,fmt:343,376,413,414,415,416,fnal:905,folder:21,follow:2,3,6,10,14,15,19,20,21,22,23,24,25,26,28,29,34,35,36,37,38,39,43,62,228,245,248,263,330,341,342,349,356,358,386,404,883,884,886,887,889,890,892,893,896,897,898,900,904,905,909,910,913,920,922,924,925,928,929,931,932,936,937,938,939,foo:3,6,15,21,foobar:39,892,938,fool:25,foot:909,for_us:934,forbid:3,23,forbidden:21,forc:3,5,8,9,11,14,19,20,21,23,25,26,35,39,40,136,foreground:4,8,forev:3,23,forget:5,23,34,156,fork:10,34,932,form:0,3,15,20,21,23,24,25,28,29,34,39,43,152,315,322,323,328,370,386,637,862,883,888,897,904,905,928,937,939,format:0,3,6,19,20,21,36,39,43,48,343,402,413,415,416,719,724,726,865,875,883,885,886,887,892,894,898,902,904,909,910,932,934,939,former:385,formerli:514,formul:21,forth:21,fortuna:892,904,905,forward:3,15,20,21,23,33,34,36,38,43,48,351,526,543,826,904,925,928,929,932,939,found:7,10,12,20,21,23,34,39,59,60,151,153,154,195,313,356,892,901,904,924,925,932,933,939,foundat:905,four:21,24,35,40,896,897,898,901,910,932,fqdn:29,fraction:25,frame:896,framework:43,904,905,fred:28,free:46,47,48,49,65,67,72,76,91,93,111,115,141,143,145,150,153,169,172,173,174,175,177,178,180,181,182,183,194,195,224,227,229,236,261,272,275,280,286,308,313,315,319,321,322,323,324,325,326,327,328,329,332,335,336,337,341,342,351,352,353,354,356,357,360,372,386,398,400,402,404,905,907,909,920,free_ind:907,free_list:911,free_modreq:917,free_restrict:914,free_str:918,920,free_valu:920,freed:44,57,58,61,78,85,106,136,144,146,198,199,200,201,202,204,207,208,210,211,212,215,216,217,218,219,221,222,228,262,310,331,362,363,365,368,851,852,freeli:905,frequent:14,33,38,39,871,924,fresh:0,15,17,20,43,593,899,904,928,932,fri:9,friend:925,friendli:904,friendlier:904,from:0,2,3,4,5,6,7,8,9,10,11,17,19,20,21,22,24,25,28,29,32,34,35,37,38,39,41,43,44,46,48,49,93,99,100,101,102,103,113,119,121,129,148,166,169,180,181,183,195,241,245,250,258,269,287,288,289,290,294,298,319,324,327,339,343,349,353,354,355,356,357,372,373,375,377,379,380,410,416,436,818,831,832,883,886,887,890,891,892,896,897,901,902,904,905,906,907,908,910,912,913,915,920,922,924,925,928,930,932,934,937,939,from_mast:8,903,front:20,341,fsanit:892,ftp:32,34,fubar:21,939,fulfil:932,full:4,8,9,14,20,23,39,48,328,892,904,913,924,932,fulli:3,15,19,21,23,29,32,34,35,46,928,939,fullname_out:143,fulvio:42,func:63,80,fund:905,fundsxpress:905,furnish:905,further:10,34,887,938,furthermor:14,245,905,futur:23,26,37,43,156,228,875,904,911,g10:905,g_accept_sec_context:905,g_acquire_cr:905,g_canon_nam:905,g_compare_nam:905,g_context_tim:905,g_delete_sec_context:905,g_dsp_name:905,g_dsp_statu:905,g_dup_nam:905,g_exp_sec_context:905,g_export_nam:905,g_glue:905,g_imp_nam:905,g_imp_sec_context:905,g_init_sec_context:905,g_initi:905,g_inquire_context:905,g_inquire_cr:905,g_inquire_nam:905,g_process_context:905,g_rel_buff:905,g_rel_cr:905,g_rel_nam:905,g_rel_oid_set:905,g_seal:905,g_sign:905,g_store_cr:905,g_unseal:905,g_userok:905,g_util:905,g_verifi:905,gain:14,25,34,914,916,925,gcc:892,gen_sym:932,gener:2,9,12,14,15,17,19,20,21,23,25,26,32,35,41,43,48,113,125,126,260,283,294,324,327,338,339,436,518,519,520,521,810,827,842,883,887,889,890,891,892,894,896,904,905,908,912,917,922,925,932,937,generalizedtim:897,generalstr:37,generic_trusted_ca:20,21,gennadi:932,genrsa:37,german:904,get:3,12,14,16,19,20,21,23,32,33,35,38,39,48,59,60,163,236,254,258,275,892,904,908,911,917,924,925,928,932,939,get_cooki:904,917,get_cr:46,get_tgt_via_passwd:932,get_valu:920,getaddrinfo:38,getdat:3,5,6,19,23,gethostnam:38,43,getnameinfo:38,getopt:889,getpol:3,23,getprinc:3,6,14,23,26,35,904,getpwuid:3,23,getrandom:904,getstr:3,getusershel:932,gic_opt:908,give:6,14,23,28,38,890,896,897,905,918,924,925,given:2,3,5,6,8,10,14,20,21,23,28,36,38,39,41,43,46,48,49,59,60,124,135,315,326,386,852,892,896,901,904,905,929,gladman:905,glob:3,6,15,23,global:5,19,20,21,22,23,141,155,904,glorifi:909,glossolalia:14,glue:889,gmbh:905,gmt:884,gnu:890,892,904,905,goal:46,going:20,24,925,good:12,15,23,34,122,905,924,925,939,googl:905,gotten:925,gov:21,905,govern:23,905,930,gpg:891,gpl:905,grace:928,gracefulli:910,grain:43,grammar:896,900,grant:3,14,19,20,21,23,26,28,34,35,37,39,43,46,48,224,235,260,264,267,746,883,896,904,905,914,918,923,925,928,932,938,gratitud:905,great:19,153,267,738,greg:939,groff:0,group:20,21,40,897,905,grow:887,gs2:904,gss:28,889,896,903,904,910,939,gss_:910,gss_accept_sec_context:43,904,910,gss_acquire_cr:43,904,gss_acquire_cred_from:43,904,gss_acquire_cred_impersonate_nam:43,gss_acquire_cred_with_password:904,gss_add_cr:910,gss_add_cred_from:910,gss_add_cred_impersonate_nam:910,gss_add_cred_with_password:910,gss_add_oid_set_memb:910,gss_buffer_desc:43,gss_buffer_set_t:43,gss_buffer_t:43,910,gss_c_accept:43,gss_c_both:43,gss_c_buffer_flag_alloc:43,gss_c_buffer_type_data:43,gss_c_buffer_type_head:43,gss_c_buffer_type_mic_token:43,gss_c_buffer_type_pad:43,gss_c_buffer_type_sign_onli:43,gss_c_buffer_type_stream:43,gss_c_buffer_type_trail:43,gss_c_channel_bound_flag:904,gss_c_dce_styl:43,gss_c_deleg_policy_flag:904,gss_c_inq_negoex_kei:910,gss_c_inq_negoex_verify_kei:910,gss_c_ma_negoex_and_spnego:910,gss_c_no_credenti:43,gss_c_no_nam:43,gss_c_nt_anonym:43,gss_c_nt_export_nam:43,gss_c_nt_hostbased_servic:43,gss_c_nt_machine_uid_nam:43,gss_c_nt_string_uid_nam:43,gss_c_nt_user_nam:43,gss_c_null_oid:43,gss_c_qop_default:43,gss_c_sec_context_sasl_ssf:904,gss_const_key_value_set_t:43,gss_create_empty_oid_set:910,gss_cred_id_t:43,910,gss_cred_usage_t:43,gss_ctx_id_t:43,910,gss_display_statu:910,gss_error:43,gss_export_cr:43,gss_export_nam:43,gss_get_mic_iov:43,gss_get_mic_iov_length:43,gss_get_name_attribut:43,gss_import_cr:43,910,gss_import_nam:43,910,gss_import_sec_context:910,gss_init_sec_context:43,gss_inquire_attrs_for_mech:910,gss_inquire_cr:43,gss_inquire_cred_by_oid:43,904,gss_inquire_nam:43,gss_inquire_sec_context_by_oid:904,910,gss_iov:904,gss_iov_buffer_desc:43,gss_iov_buffer_desc_struct:43,gss_iov_buffer_flag_alloc:43,gss_iov_buffer_t:43,gss_iov_buffer_type_data:43,gss_iov_buffer_type_head:43,gss_iov_buffer_type_mic_token:43,gss_iov_buffer_type_pad:43,gss_iov_buffer_type_sign_onli:43,gss_iov_buffer_type_stream:43,gss_iov_buffer_type_trail:43,gss_key_value_element_desc:43,gss_key_value_element_struct:43,gss_key_value_set_desc:43,gss_key_value_set_struct:43,gss_krb5_cred_no_ci_flags_x:904,gss_krb5_get_cred_imperson:43,904,gss_krb5_nt_enterprise_nam:43,904,gss_krb5_nt_principal_nam:43,gss_krb5_nt_x509_cert:43,904,gss_mech_config:28,903,939,gss_mech_interpos:910,gss_name_t:43,910,gss_oid:43,910,gss_oid_set:43,910,gss_qop_t:43,gss_release_iov_buff:43,gss_s_cred_unavail:43,gss_s_unavail:43,gss_store_cr:904,gss_store_cred_into:43,gss_unwrap_aead:43,gss_unwrap_iov:43,gss_verify_mic_iov:43,gss_wrap_aead:43,gss_wrap_iov:43,gss_wrap_iov_length:43,gss_wrapex:904,gssapi:15,16,20,21,45,882,883,886,887,889,904,905,906,912,931,939,gssapi_err_gener:905,gssapi_ext:43,910,gssapi_krb5:43,gssapiauthent:28,gssapip_spnego:905,gssapistrictacceptorcheck:38,gssapiv2:43,gssd_pname_to_uid:905,gssi_:910,gssi_import_cred_by_mech:910,gssi_import_name_by_mech:910,gssi_import_sec_context_by_mech:910,gssrpc:905,gssspi_exchange_meta_data:910,gssspi_query_mechanism_info:910,gssspi_query_meta_data:910,guarante:14,guard:887,guess:21,34,904,guest:3,21,23,guid:15,30,32,912,h5l:21,44,had:6,23,28,34,37,924,925,938,haddl:85,hand:14,23,34,handi:34,handl:3,6,14,19,23,36,43,48,71,132,135,137,139,141,142,143,144,145,146,147,149,150,151,152,153,154,155,157,158,159,161,164,223,224,235,246,250,251,265,276,300,301,303,306,308,309,310,311,312,314,316,332,337,338,339,340,356,400,410,905,908,913,917,handle_error:43,handle_out_of_space_error:43,happen:3,17,20,23,34,39,41,925,happi:905,hard:20,23,hardcod:883,886,920,harder:904,hardwar:3,20,23,34,46,907,917,925,929,harm:887,harvard:905,harwood:939,has:0,3,5,6,12,14,15,17,19,20,21,23,24,25,26,27,28,34,35,37,38,39,43,46,78,124,260,263,279,353,357,385,401,725,883,887,890,891,892,896,900,901,904,905,910,914,915,916,919,924,925,929,932,937,hash:6,21,23,37,887,897,901,904,hat:905,939,have:0,2,3,6,8,12,14,15,17,19,20,21,23,24,25,26,28,32,33,34,35,37,38,39,43,46,101,153,230,274,399,883,887,890,891,894,896,897,900,901,904,905,906,908,909,910,913,914,915,917,919,921,924,925,928,932,936,938,939,have_getusershel:932,haven:892,939,hdata:230,head:21,header:6,21,43,48,530,533,795,892,906,907,908,909,911,913,914,915,916,917,918,919,920,921,headernam:892,heim_org:21,heimdal:42,43,45,883,904,held:905,929,hellman:20,21,928,help:21,37,887,892,904,920,922,925,931,939,helpdesk:14,henc:12,her:39,925,938,here:0,15,19,20,21,23,28,35,41,43,46,884,892,909,924,925,hereaft:905,herebi:905,hesiod:21,892,905,heurist:21,154,230,906,932,937,hexadecim:6,904,hhmmss:884,hhost:904,hidden:46,349,856,hide:3,23,928,hierarch:4,21,904,hierarchi:23,high:14,16,24,higher:43,883,894,904,highest:3,6,14,15,21,308,313,410,highli:891,904,himself:925,hin:891,hint:3,20,23,149,his:19,23,925,932,938,hist_kvno:6,histor:28,33,882,histori:6,26,892,904,hit:48,932,hmac:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,hold:3,43,78,170,187,192,193,394,395,883,holder:905,hole:32,34,39,900,home:5,21,23,28,924,932,936,937,938,honor:41,925,hook:48,851,852,904,912,hope:905,hopefulli:35,host01:939,host:3,4,7,8,12,14,15,16,20,21,23,24,25,26,29,30,31,33,36,37,38,39,43,46,48,194,223,230,326,328,385,386,410,638,640,887,890,892,904,912,917,924,925,928,929,932,936,937,938,939,host_based_servic:20,39,host_realm:911,hostaccount:28,hostnam:3,12,15,20,21,23,26,33,34,37,38,41,43,48,326,385,386,892,904,911,934,937,939,hostrealm:28,904,912,hostrealm_plugin:911,hotp:3,hour:5,19,20,23,33,884,924,925,932,939,houston:39,how:14,20,21,23,26,28,32,34,37,39,43,224,412,891,892,902,906,912,919,920,924,928,howev:3,6,14,17,20,21,23,25,32,33,35,37,39,890,905,925,939,html:0,22,42,891,894,904,html_subst:894,htmlsrc:894,http:21,22,25,30,38,39,42,890,891,894,904,905,922,http_anchor:21,29,hudson:939,human:169,884,904,hundr:24,hwauth:20,hxx:905,iakerb:904,icr:43,idea:38,ideal:15,23,34,46,890,ident:3,15,20,22,23,43,48,358,726,866,867,883,904,908,924,925,928,930,identif:904,905,identifi:4,10,21,28,43,166,265,313,315,719,812,818,833,904,905,934,iec:891,ietf:904,ignor:3,15,19,20,21,26,28,43,48,235,260,264,267,269,278,282,339,342,347,356,385,529,694,697,851,887,890,892,896,904,909,937,939,ignore_acceptor_hostnam:21,38,43,illinoi:42,illumin:939,imap:38,892,937,immedi:6,14,21,23,39,904,917,impact:35,impend:46,imperson:904,impl:892,implement:0,14,20,21,23,24,28,29,36,40,43,44,46,51,113,119,151,294,379,380,883,890,892,896,898,900,904,905,906,907,908,909,910,911,913,914,915,917,918,919,920,921,922,925,932,939,impli:8,905,implicit:20,implicitli:21,impos:914,imposs:23,35,improv:0,14,20,21,35,904,922,in_authdat:173,in_cr:224,225,226,327,372,in_data:326,327,372,in_length:131,409,in_tkt_servic:235,260,264,267,inaccess:39,inaccur:21,inaddr:172,inadequ:41,inauthdat1:319,inauthdat2:319,inbuf:353,354,355,356,357,inc:905,925,939,incc:134,incident:905,includ:6,9,15,16,19,20,21,24,26,32,33,34,37,38,39,43,48,99,104,122,144,287,309,322,323,327,328,337,338,340,341,356,403,673,799,812,819,832,846,882,883,887,889,892,893,894,896,897,900,904,905,908,909,910,914,916,917,920,924,928,932,939,include_pac:846,includedir:21,892,inclus:905,incom:20,38,910,incompat:890,892,913,incomplet:21,inconsist:24,incorpor:0,20,24,904,incorrect:35,39,721,722,924,925,incorrectli:925,incr:177,increas:20,24,40,100,103,288,290,912,increment:4,8,9,14,19,20,24,31,35,39,48,87,89,322,323,328,901,904,905,indata:178,inde:925,independ:21,26,138,163,245,305,892,index:6,22,29,42,366,891,901,indic:3,6,14,19,20,21,23,26,28,30,36,37,39,41,43,46,154,245,324,714,715,716,717,721,722,723,724,823,883,884,886,887,896,897,898,900,901,904,905,907,908,909,917,925,928,939,indirect:905,individu:9,20,905,925,939,inetd:8,12,34,41,infd:62,influenc:38,info2:904,info:20,34,229,645,647,651,660,812,818,874,904,inform:3,4,6,7,9,11,20,22,26,28,33,34,38,39,41,43,46,169,185,229,250,251,282,322,324,330,339,361,383,384,412,646,648,726,810,811,849,856,861,875,883,891,892,895,896,897,900,904,908,909,912,913,917,920,922,928,939,infrastructur:21,40,889,890,904,infrequ:904,inherit:924,932,ini:21,init:4,10,906,907,908,911,914,915,916,917,918,919,init_cr:46,initi:3,5,12,14,15,21,22,23,25,26,34,35,38,40,45,48,99,102,115,124,229,269,287,289,398,501,863,870,883,886,892,896,904,905,908,909,924,925,928,929,931,932,934,939,initiator_cred_handl:43,inittab:34,initvt:909,inject:25,inop:14,inout:98,99,100,102,103,114,287,288,289,290,295,326,327,356,358,360,361,372,403,inprinc:182,inptr:186,190,input:23,43,48,49,99,100,102,103,107,113,117,119,124,144,194,195,224,287,288,289,290,294,296,349,372,373,400,906,918,921,934,input_assoc_buff:43,input_ccach:928,input_cred_handl:43,input_message_buff:43,input_name_buff:910,input_name_typ:910,input_payload_buff:43,inputlen:104,inquir:3,15,19,23,inquiri:19,ins:32,insecur:14,32,39,43,230,insensit:39,347,692,884,insert:25,811,818,insid:15,26,195,897,904,insist:932,inspect:16,377,378,851,852,914,916,inspir:904,inst:50,instal:12,14,15,17,21,28,30,32,39,888,891,894,913,927,931,instanc:19,21,23,28,33,35,43,49,50,638,639,887,896,904,909,939,instead:3,4,6,8,14,20,21,23,24,34,37,38,46,239,246,278,307,339,341,413,415,852,892,904,905,910,917,927,929,932,938,institut:895,905,939,instruct:22,23,34,37,43,892,922,insuffici:223,231,300,320,322,892,int16_t:829,int32_t:830,int_max:773,intact:905,integ:3,15,20,21,23,36,37,882,896,897,900,910,integr:26,33,43,46,323,328,353,357,889,891,903,904,905,925,intel:905,intend:3,10,23,41,43,46,349,932,interact:2,3,21,23,39,365,892,intercept:28,910,interest:21,35,887,893,interfac:3,11,14,19,20,23,28,34,46,883,887,889,892,904,909,912,interface_modname_initvt:909,interface_module_initvt:909,interface_plugin:909,interfer:890,intermedi:20,21,23,43,224,896,897,904,925,intern:24,36,41,107,717,833,906,907,908,912,914,915,916,917,919,921,939,internet:38,interoper:37,379,380,883,910,interpos:28,912,interpret:3,36,43,46,152,245,910,928,932,934,interprocess_token:910,interrupt:14,260,905,intersect:26,interv:3,8,23,34,35,882,884,interven:23,intervent:14,26,introduc:3,20,21,907,911,915,916,918,intrud:925,invalid:14,21,23,50,136,139,156,260,313,925,928,929,invers:900,investig:892,invis:25,invoc:6,41,43,invok:4,8,9,11,12,21,23,24,46,80,136,245,383,910,917,918,919,928,930,932,involv:21,917,iov:48,100,103,288,290,813,904,iov_count:43,iprop:4,8,20,904,905,iprop_en:4,8,20,23,iprop_hdr:905,iprop_listen:20,iprop_logfil:20,23,iprop_master_ulogs:20,23,iprop_port:20,23,iprop_replica_pol:8,20,23,iprop_resync_timeout:20,23,iprop_slave_pol:20,iprop_ulogs:20,ipropd_svc:905,ipv4:38,ipv6:21,38,904,iran:905,is_last_req:245,824,is_skei:153,735,812,896,isi:932,isn:20,23,330,887,890,905,iso:891,isol:39,issu:2,3,14,20,21,23,26,29,32,35,36,37,39,43,46,318,408,870,892,904,908,917,925,928,issuanc:3,23,issuer:21,37,318,408,issueraltnam:37,item:253,717,909,917,iter:3,20,23,24,48,164,356,803,906,920,iterator_cr:920,iterator_fre:920,its:3,4,8,10,14,15,17,20,21,23,24,26,28,29,32,33,34,35,37,38,39,40,41,43,46,48,87,89,92,107,117,203,209,228,269,296,353,356,357,378,408,884,895,896,905,906,907,908,909,910,917,921,927,928,929,937,itself:3,4,8,10,14,15,20,21,23,28,43,46,198,199,200,201,202,203,206,207,208,209,212,215,216,221,331,722,812,883,886,888,910,917,925,ivec:186,190,jan:23,januari:23,882,884,jellinghau:905,jennif:3,23,924,925,939,jeremi:905,jimi:12,job:8,17,34,39,joeadmin:19,23,32,938,joeuser:939,johndo:21,jqpublic:932,json:3,36,46,365,368,724,726,896,jul:884,juli:884,just:6,14,15,20,21,23,33,34,43,323,636,883,890,893,908,925,932,938,k5_gic_opt:235,260,k5_random_kei:115,124,k5_vic_opt:411,412,k5ident:21,28,923,936,k5login:21,28,923,924,932,936,k5login_authorit:21,28,938,k5login_directori:21,28,k5srvutil:1,14,26,886,k5user:932,k5wiki:890,904,922,kadm5:3,4,6,18,20,21,23,24,34,889,903,904,905,912,914,kadm5_auth:19,904,912,kadm5_auth_modinfo:914,kadm5_auth_plugin:914,kadm5_auth_restrict:914,kadm5_hook:904,912,kadm5_hook_modinfo:915,kadm5_hook_plugin:915,kadm5_pass_q_:921,kadm:931,kadmin:1,2,4,5,6,8,10,11,12,14,15,16,19,20,21,22,24,25,26,32,34,35,37,39,40,166,245,379,883,884,886,889,904,905,912,915,930,931,939,kadmind:1,3,5,9,19,20,21,22,23,24,26,28,34,39,122,888,904,912,930,939,kadmind_listen:20,kadmind_port:4,20,34,kaduk:14,kbd5_util:23,kbuild:889,kcm:21,883,904,905,939,kcm_mach_servic:21,kcm_socket:21,kdb5_err:905,kdb5_ldap_util:1,3,4,10,20,22,23,24,kdb5_util:1,4,7,8,10,11,14,20,22,23,24,26,34,884,889,903,904,939,kdb5_util_path:4,kdb5_util_prog:8,kdb:4,22,23,24,35,889,904,905,912,916,928,931,kdb_convert:905,kdb_log:905,kdc1:39,kdc2:39,kdc:3,4,5,6,8,9,10,11,15,16,17,18,19,21,22,23,24,25,26,29,31,32,33,36,40,43,46,48,101,107,119,166,224,230,235,241,245,247,258,260,269,330,337,338,339,340,410,539,541,558,649,724,818,831,832,851,852,870,883,886,888,889,892,893,896,898,899,904,907,908,911,912,913,919,921,925,928,934,939,kdc_cert:37,kdc_default_opt:21,kdc_err_more_preauth_data_requir:904,kdc_listen:20,34,kdc_max_dgram_reply_s:20,kdc_opt_allow_postd:775,kdc_opt_canonic:775,kdc_opt_cname_in_addl_tkt:775,kdc_opt_disable_transited_check:775,kdc_opt_enc_tkt_in_skei:775,kdc_opt_forward:775,kdc_opt_postd:775,kdc_opt_proxi:775,kdc_opt_renew:775,kdc_opt_renewable_ok:21,775,kdc_opt_request_anonym:775,kdc_opt_valid:775,kdc_option:832,kdc_port:20,kdc_princ_nam:37,kdc_princip:37,kdc_principal_seq:37,kdc_tcp_listen:20,34,37,kdc_tcp_listen_backlog:20,kdc_tcp_port:20,kdc_timesync:21,kdc_tkt_common_mask:775,kdcdefault:10,34,37,40,kdcissu:48,kdckei:37,kdclist:34,kdcpolici:904,912,kdcpolicy_plugin:916,kdcpreauth:904,912,kdcpreauth_mymech_initvt:909,kdcpreauth_plugin:917,kdcproxi:29,kdestroi:33,883,904,923,926,928,929,933,934,939,keep:3,9,15,23,35,887,890,891,924,keepkvno:3,keepold:3,14,23,904,kei:2,3,5,6,9,10,11,12,15,16,19,20,21,25,28,32,34,36,37,38,40,41,43,46,48,73,77,87,89,100,103,105,106,108,113,114,117,119,129,130,141,153,155,181,216,224,229,234,258,276,277,280,292,293,305,306,311,318,322,327,337,338,339,340,348,351,356,360,361,408,410,435,436,659,726,736,742,799,811,812,818,819,820,833,834,836,886,887,888,889,892,893,896,897,898,903,904,908,910,917,925,928,929,934,939,kept:3,17,20,23,32,kerb_ap_options_cbt:904,kerber:14,33,34,932,kerbero:2,3,4,5,6,7,8,9,10,11,12,14,18,19,20,21,24,25,26,27,28,30,31,32,33,36,37,38,42,43,45,46,47,48,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,117,118,120,121,122,124,125,126,129,130,133,134,135,141,142,145,147,148,149,150,151,152,153,155,156,157,158,159,161,162,163,164,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,235,236,238,248,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,287,288,289,290,294,295,296,298,299,300,301,303,304,306,308,309,312,313,314,315,316,319,320,321,322,323,324,325,326,327,328,329,330,332,334,335,336,339,341,342,344,349,351,352,353,354,355,356,357,358,360,361,371,372,373,374,375,379,380,381,382,386,393,394,395,397,398,399,400,401,402,403,404,405,406,410,883,884,887,888,889,890,892,893,895,896,912,915,918,920,922,923,924,927,928,929,930,931,932,933,934,935,936,937,938,kerberos_db:8,kerboro:18,kern:20,kernel:883,889,904,key_data:286,293,key_exp:818,key_stash_fil:6,20,23,34,keyagr:37,keyblock:48,70,75,90,101,107,115,117,215,216,224,280,281,328,350,356,390,812,896,keyboard:4,6,10,23,48,keybyt:112,keydata:6,keyencipher:21,37,keyexchang:107,keyfil:6,20,22,23,keyfilenam:21,keyid:37,keyindex:6,keyinfo:6,26,keylength:112,keylist:11,15,keyprocarg:313,keyr:883,892,904,939,keysalt:2,3,15,23,903,keyspac:14,keytab:2,3,7,8,11,12,14,17,21,23,26,28,31,41,43,46,48,302,308,309,310,312,315,316,356,360,361,412,883,885,887,888,892,893,896,899,903,904,928,929,931,932,934,939,keytab_fil:8,928,keytab_nam:929,keytab_out:301,keytabl:836,keytabnam:892,keytyp:10,keyusag:37,keyutil:892,keyword:21,884,kfw:904,kgetcr:904,kile:672,kill:34,kind:38,43,105,883,905,908,910,917,kinit:3,12,15,16,21,22,23,28,29,33,34,35,37,41,46,883,884,904,908,923,926,927,929,932,933,934,935,939,kiprop:4,8,23,kkdcp:29,39,904,905,klau:905,kldap:20,22,klein:905,klist:14,15,33,883,886,923,926,927,928,932,933,939,klmdb:20,know:21,33,35,37,887,892,910,925,knowledg:0,14,17,410,908,917,known:6,20,23,26,38,43,46,48,152,231,315,642,643,893,904,937,korea:905,kpasswd:3,4,14,15,20,21,23,29,33,904,923,924,926,939,kpasswd_listen:20,kpasswd_port:20,kpasswd_serv:21,29,39,kpclientauth:20,kpkdc:21,kprop:1,4,6,8,15,23,24,34,35,889,903,905,939,kprop_path:4,kprop_port:4,903,939,kpropd:1,4,7,9,23,34,41,889,903,904,kpropd_rpc:905,kproplog:1,8,905,kpserverauth:21,37,krb4:904,krb524:21,krb524_convert_creds_kdc:775,krb524_init_et:775,krb524_krb4_disabl:51,krb5:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,22,23,24,25,26,27,28,29,30,31,32,33,35,36,37,38,39,40,41,42,43,44,45,46,47,49,50,51,52,53,54,55,56,57,58,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,206,207,208,209,210,211,212,213,214,215,216,217,218,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,270,271,272,273,274,275,276,277,278,279,280,281,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,776,777,778,779,780,781,782,783,784,785,786,787,788,789,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,932,933,934,935,936,937,938,939,krb5_425_conv_princip:48,krb5_524_conv_princip:48,krb5_524_convert_cr:48,776,krb5_address:52,53,54,64,82,84,172,198,232,233,234,240,329,790,810,811,812,818,819,826,832,krb5_address_compar:48,krb5_address_ord:48,krb5_address_search:48,krb5_addrtyp:790,791,krb5_allow_weak_crypto:48,krb5_altauth_att_challenge_respons:775,krb5_aname_to_localnam:48,904,918,krb5_anonymous_princip:48,krb5_anonymous_princstr:57,775,krb5_anonymous_realm:48,krb5_anonymous_realmstr:58,775,krb5_ap_rep:775,790,krb5_ap_rep_enc_part:48,354,372,790,krb5_ap_req:775,790,krb5_appdefault_boolean:48,60,krb5_appdefault_str:48,59,krb5_as_rep:775,831,krb5_as_req:775,832,krb5_auth_con_fre:48,78,krb5_auth_con_genaddr:48,82,84,krb5_auth_con_get_checksum_func:48,krb5_auth_con_getaddr:44,48,krb5_auth_con_getauthent:48,krb5_auth_con_getflag:48,krb5_auth_con_getkei:48,krb5_auth_con_getkey_k:48,krb5_auth_con_getlocalseqnumb:48,krb5_auth_con_getlocalsubkei:48,krb5_auth_con_getrcach:48,krb5_auth_con_getrecvsubkei:48,75,krb5_auth_con_getrecvsubkey_k:48,krb5_auth_con_getremoteseqnumb:48,krb5_auth_con_getremotesubkei:48,krb5_auth_con_getsendsubkei:48,70,krb5_auth_con_getsendsubkey_k:48,krb5_auth_con_init:48,61,krb5_auth_con_initivector:48,krb5_auth_con_set_checksum_func:48,krb5_auth_con_set_req_cksumtyp:48,krb5_auth_con_setaddr:44,48,krb5_auth_con_setflag:48,78,krb5_auth_con_setport:44,48,krb5_auth_con_setrcach:48,krb5_auth_con_setrecvsubkei:44,48,krb5_auth_con_setrecvsubkey_k:48,krb5_auth_con_setsendsubkei:44,48,krb5_auth_con_setsendsubkey_k:48,krb5_auth_con_setuseruserkei:48,356,krb5_auth_context:48,62,63,64,65,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,84,85,86,87,88,89,90,223,320,322,323,324,325,326,327,328,351,353,354,355,356,357,360,361,372,790,842,krb5_auth_context_do_sequ:66,69,74,83,322,323,324,328,353,357,775,krb5_auth_context_do_tim:66,78,83,322,323,328,353,357,775,krb5_auth_context_generate_local_addr:62,775,krb5_auth_context_generate_local_full_addr:62,775,krb5_auth_context_generate_remote_addr:62,775,krb5_auth_context_generate_remote_full_addr:62,775,krb5_auth_context_permit_al:775,krb5_auth_context_ret_sequ:66,83,322,323,324,328,351,353,357,775,krb5_auth_context_ret_tim:66,83,322,323,328,351,353,357,775,krb5_auth_context_use_subkei:775,krb5_authdata:173,184,189,195,200,318,319,408,790,799,812,819,832,krb5_authdata_and_or:775,krb5_authdata_ap_opt:775,krb5_authdata_auth_ind:775,krb5_authdata_cammac:775,krb5_authdata_etype_negoti:775,krb5_authdata_fx_armor:775,krb5_authdata_if_relev:775,krb5_authdata_initial_verified_ca:775,krb5_authdata_kdc_issu:775,krb5_authdata_mandatory_for_kdc:775,krb5_authdata_osf_dc:775,krb5_authdata_sesam:775,krb5_authdata_signticket:775,krb5_authdata_win2k_pac:775,krb5_authdatatyp:184,189,195,790,797,krb5_authent:48,65,790,872,krb5_bad_enctyp:116,286,krb5_boolean:52,54,55,105,109,110,127,128,129,130,160,192,253,283,284,285,298,299,317,338,340,345,346,347,359,385,790,812,824,846,krb5_build_princip:46,47,48,92,krb5_build_principal_alloc_va:47,48,91,94,krb5_build_principal_ext:47,48,krb5_build_principal_va:48,krb5_c_:123,186,188,190,191,196,197,281,348,350,407,krb5_c_block_siz:48,krb5_c_checksum_length:48,168,krb5_c_crypto_length:48,krb5_c_crypto_length_iov:48,krb5_c_decrypt:48,287,krb5_c_decrypt_iov:48,103,288,krb5_c_derive_prfplu:48,904,krb5_c_encrypt:48,krb5_c_encrypt_iov:48,290,krb5_c_encrypt_length:48,102,289,krb5_c_enctype_compar:48,krb5_c_free_stat:48,krb5_c_fx_cf2_simpl:48,krb5_c_init_st:48,krb5_c_is_coll_proof_cksum:48,krb5_c_is_keyed_cksum:48,krb5_c_keyed_checksum_typ:48,krb5_c_keylength:48,124,krb5_c_make_checksum:48,131,294,krb5_c_make_checksum_iov:48,130,295,krb5_c_make_random_kei:48,krb5_c_padding_length:48,krb5_c_prf:48,119,296,krb5_c_prf_length:48,117,krb5_c_prfplu:48,904,krb5_c_random_add_entropi:48,krb5_c_random_make_octet:48,krb5_c_random_os_entropi:48,krb5_c_random_se:48,krb5_c_random_to_kei:48,krb5_c_string_to_kei:48,126,390,krb5_c_string_to_key_with_param:48,krb5_c_valid_cksumtyp:48,krb5_c_valid_enctyp:48,krb5_c_verify_checksum:48,113,294,298,409,krb5_c_verify_checksum_iov:48,114,299,krb5_calculate_checksum:48,krb5_cc_badnam:223,krb5_cc_cache_match:48,krb5_cc_close:48,132,154,164,krb5_cc_copy_cr:48,krb5_cc_cursor:139,150,158,790,krb5_cc_default:48,krb5_cc_default_nam:48,135,156,krb5_cc_destroi:48,krb5_cc_dup:48,krb5_cc_end_seq_get:48,158,krb5_cc_gen_new:48,krb5_cc_get_config:48,krb5_cc_get_flag:48,krb5_cc_get_full_nam:48,krb5_cc_get_nam:48,krb5_cc_get_princip:47,48,krb5_cc_get_typ:48,krb5_cc_initi:48,145,krb5_cc_move:48,krb5_cc_new_uniqu:48,krb5_cc_next_cr:48,139,158,krb5_cc_nosupp:151,krb5_cc_notfound:132,154,165,krb5_cc_remove_cr:48,904,krb5_cc_resolv:48,144,krb5_cc_retrieve_cr:48,151,krb5_cc_select:48,krb5_cc_set_config:44,48,283,krb5_cc_set_default_nam:48,136,krb5_cc_set_flag:48,krb5_cc_start_seq_get:48,139,150,krb5_cc_store_cr:48,krb5_cc_support_switch:48,krb5_cc_switch:48,krb5_ccach:132,133,134,135,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,157,158,159,161,164,223,224,225,226,232,233,234,246,250,251,264,267,326,372,380,400,410,790,krb5_ccache_conf_data:896,krb5_cccol:906,krb5_cccol_cursor:162,163,164,790,krb5_cccol_cursor_fre:48,163,164,krb5_cccol_cursor_new:48,162,164,krb5_cccol_cursor_next:48,162,163,krb5_cccol_have_cont:48,krb5_cccol_last_change_tim:44,krb5_ccselect_moddata:906,krb5_ccselect_vt:909,krb5_certauth_hwauth:907,krb5_change_password:48,169,krb5_check_clockskew:48,krb5_checksum:48,113,129,131,294,298,409,790,799,847,krb5_checksum_s:48,krb5_chpw_fail:260,krb5_chpw_messag:48,krb5_chpw_pwdnull:260,krb5_cksumtyp:81,96,109,110,111,113,114,127,130,131,168,170,204,294,295,299,387,409,790,804,krb5_cksumtype_to_str:48,krb5_clear_error_messag:48,krb5_client_ktnam:15,886,903,939,krb5_clpreauth_moddata:908,krb5_clpreauth_modreq:908,krb5_config:21,34,903,904,939,krb5_config_cantopen:50,krb5_config_notenufspac:56,304,krb5_const:775,krb5_const_point:131,186,190,409,790,krb5_const_princip:50,56,57,141,155,182,283,308,318,337,338,339,340,344,345,346,347,356,359,385,402,403,404,405,790,krb5_context:46,48,49,50,51,52,53,54,55,56,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,171,172,173,174,175,177,178,179,180,181,182,183,184,186,188,189,190,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,245,246,247,248,250,251,252,253,257,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,372,373,374,376,377,378,379,380,381,383,384,385,386,390,393,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,413,414,415,416,790,824,842,851,852,858,863,874,909,krb5_copy_address:48,krb5_copy_authdata:48,krb5_copy_authent:48,krb5_copy_checksum:48,krb5_copy_context:48,krb5_copy_cr:48,krb5_copy_data:48,851,852,krb5_copy_error_messag:48,krb5_copy_keyblock:48,krb5_copy_keyblock_cont:48,krb5_copy_princip:47,48,krb5_copy_ticket:48,krb5_cred:46,48,51,150,151,153,159,166,220,224,225,226,232,233,234,235,260,264,267,272,320,322,327,351,372,379,398,400,410,775,790,krb5_cred_enc_part:790,809,krb5_cred_info:790,810,krb5_crypto_iov:98,100,103,114,130,288,290,295,299,790,krb5_crypto_typ:97,813,krb5_crypto_type_checksum:114,130,295,299,775,krb5_crypto_type_data:114,130,295,299,775,krb5_crypto_type_empti:775,krb5_crypto_type_head:775,krb5_crypto_type_pad:775,krb5_crypto_type_sign_onli:98,114,130,295,299,775,krb5_crypto_type_stream:775,krb5_crypto_type_trail:775,krb5_cryptotyp:97,790,813,krb5_cybersafe_secureid:775,krb5_data:48,58,59,60,99,100,101,102,103,106,108,113,117,119,120,121,123,124,125,126,129,141,155,166,169,185,223,229,230,258,265,279,284,287,288,289,290,294,296,298,320,321,322,323,324,325,326,327,328,330,332,337,338,344,351,352,353,354,355,356,357,361,372,379,380,390,401,790,807,812,813,817,822,826,842,847,851,852,854,855,856,868,876,881,krb5_db_entri:907,krb5_decode_authdata_contain:48,189,krb5_decode_ticket:48,krb5_decrypt:48,krb5_deltat:187,235,256,259,260,275,388,790,826,krb5_deltat_badformat:388,krb5_deltat_to_str:48,krb5_domain_x500_compress:775,krb5_eblock_enctyp:48,krb5_enc_data:99,102,287,289,790,793,795,809,831,832,869,krb5_enc_kdc_rep_part:790,831,krb5_enc_tkt_part:790,869,krb5_encode_authdata_contain:48,184,krb5_encpadata_req_enc_pa_rep:775,krb5_encrypt:48,krb5_encrypt_block:186,188,190,196,197,281,348,350,390,407,790,krb5_encrypt_s:48,krb5_enctyp:95,97,98,101,104,105,111,112,115,116,118,124,125,126,128,188,191,192,193,211,229,232,233,234,244,261,280,292,308,313,375,389,407,790,817,820,826,832,834,krb5_enctype_to_nam:48,krb5_enctype_to_str:48,krb5_end_seq_get:150,krb5_error:212,273,321,352,372,775,790,krb5_error_cod:46,49,50,55,56,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,129,130,131,132,133,134,135,137,138,139,140,141,142,143,145,147,148,149,150,151,152,153,154,155,156,157,158,159,161,162,163,164,165,166,167,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,186,187,189,190,192,193,194,195,196,197,214,217,223,224,225,226,227,228,229,230,231,232,233,234,235,236,238,245,246,247,248,250,251,252,253,257,260,261,262,264,265,266,267,268,269,271,272,273,274,275,276,277,278,279,280,281,282,286,287,288,289,290,293,294,295,296,298,299,300,301,302,303,304,305,306,307,308,309,311,312,313,314,315,316,318,319,320,321,322,323,324,325,326,327,328,329,330,332,333,334,335,336,337,338,339,340,341,342,343,344,348,349,350,351,352,353,354,355,356,357,358,360,361,365,366,368,369,370,371,372,373,374,375,376,379,380,381,382,383,384,386,387,388,389,390,391,392,393,394,395,397,398,399,400,401,402,403,404,405,406,407,408,409,410,413,414,415,416,790,841,842,851,852,858,863,909,krb5_euid:887,krb5_expand_hostnam:48,krb5_expire_callback_func:245,790,krb5_fast_requir:248,775,krb5_fcc_intern:135,krb5_fences_vt:909,krb5_fences_vtable_v2:909,krb5_find_authdata:48,krb5_finish_kei:48,krb5_finish_random_kei:48,krb5_flag:142,151,153,157,224,225,226,232,233,234,238,248,269,326,327,356,372,400,790,795,811,812,818,819,826,832,865,872,880,krb5_free_address:48,172,329,krb5_free_ap_rep_enc_part:48,354,372,krb5_free_authdata:48,173,195,319,krb5_free_authent:48,65,174,krb5_free_checksum:48,175,krb5_free_checksum_cont:48,113,294,krb5_free_cksumtyp:48,111,krb5_free_context:48,136,176,268,282,krb5_free_cr:48,177,224,372,krb5_free_cred_cont:46,48,150,153,272,398,krb5_free_data:48,178,krb5_free_data_cont:48,141,229,321,322,323,324,325,326,327,328,332,337,353,357,krb5_free_default_realm:48,227,krb5_free_enctyp:48,261,krb5_free_error:48,352,372,krb5_free_error_messag:48,228,krb5_free_host_realm:48,230,231,krb5_free_keyblock:48,67,72,76,180,280,313,krb5_free_keyblock_cont:48,115,125,126,181,krb5_free_keytab_entry_cont:48,307,308,krb5_free_princip:46,47,48,49,91,92,93,145,154,182,341,342,386,krb5_free_str:48,143,169,194,krb5_free_tgt_cr:48,351,krb5_free_ticket:48,183,356,360,krb5_free_unparsed_nam:48,402,404,krb5_fwd_tgt_cred:48,krb5_gc:400,krb5_gc_cach:224,775,krb5_gc_canonic:775,krb5_gc_constrained_deleg:775,krb5_gc_forward:775,krb5_gc_no_stor:775,krb5_gc_no_transit_check:775,krb5_gc_user_us:224,775,krb5_generate_seq_numb:324,krb5_get_credenti:48,372,377,378,400,krb5_get_credentials_renew:48,krb5_get_credentials_valid:48,krb5_get_default_realm:48,krb5_get_error_messag:48,823,krb5_get_etype_info:48,904,krb5_get_fallback_host_realm:48,krb5_get_host_realm:48,386,krb5_get_in_tkt_with_keytab:48,krb5_get_in_tkt_with_password:48,krb5_get_in_tkt_with_skei:48,krb5_get_init_cr:234,250,251,krb5_get_init_creds_keytab:48,232,krb5_get_init_creds_opt:46,229,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,275,790,krb5_get_init_creds_opt_address_list:775,krb5_get_init_creds_opt_alloc:46,48,237,239,krb5_get_init_creds_opt_anonym:775,krb5_get_init_creds_opt_canonic:775,krb5_get_init_creds_opt_chg_pwd_prmpt:775,krb5_get_init_creds_opt_etype_list:775,krb5_get_init_creds_opt_forward:775,krb5_get_init_creds_opt_fre:46,48,236,krb5_get_init_creds_opt_get_fast_flag:48,krb5_get_init_creds_opt_init:48,krb5_get_init_creds_opt_preauth_list:775,krb5_get_init_creds_opt_proxi:775,krb5_get_init_creds_opt_renew_lif:775,krb5_get_init_creds_opt_salt:775,krb5_get_init_creds_opt_set_address_list:48,krb5_get_init_creds_opt_set_anonym:46,48,krb5_get_init_creds_opt_set_canonic:48,krb5_get_init_creds_opt_set_change_password_prompt:48,krb5_get_init_creds_opt_set_etype_list:48,229,krb5_get_init_creds_opt_set_expire_callback:48,krb5_get_init_creds_opt_set_fast_ccach:48,krb5_get_init_creds_opt_set_fast_ccache_nam:48,229,246,krb5_get_init_creds_opt_set_fast_flag:48,247,krb5_get_init_creds_opt_set_forward:48,krb5_get_init_creds_opt_set_in_ccach:48,krb5_get_init_creds_opt_set_out_ccach:48,krb5_get_init_creds_opt_set_pa:48,254,krb5_get_init_creds_opt_set_pac_request:48,krb5_get_init_creds_opt_set_preauth_list:48,krb5_get_init_creds_opt_set_proxi:48,krb5_get_init_creds_opt_set_renew_lif:48,krb5_get_init_creds_opt_set_respond:46,48,krb5_get_init_creds_opt_set_salt:48,254,krb5_get_init_creds_opt_set_tkt_lif:46,48,krb5_get_init_creds_opt_tkt_lif:775,krb5_get_init_creds_password:46,48,233,243,245,349,904,krb5_get_permitted_enctyp:48,krb5_get_profil:48,krb5_get_prompt_typ:46,48,krb5_get_renewed_cr:48,225,krb5_get_server_rcach:48,krb5_get_time_offset:48,krb5_get_validated_cr:48,226,krb5_gic_opt_pa_data:790,krb5_init_context:48,205,krb5_init_context_kdc:269,775,krb5_init_context_profil:48,krb5_init_context_secur:269,775,krb5_init_creds_context:270,271,272,273,274,275,276,277,278,279,790,krb5_init_creds_fre:48,275,krb5_init_creds_get:48,272,274,275,krb5_init_creds_get_cr:48,271,krb5_init_creds_get_error:48,krb5_init_creds_get_tim:48,krb5_init_creds_init:48,270,271,279,349,krb5_init_creds_set_keytab:48,krb5_init_creds_set_password:48,krb5_init_creds_set_servic:48,krb5_init_creds_step:48,272,274,275,904,krb5_init_creds_step_flag_continu:279,775,krb5_init_keyblock:48,krb5_init_random_kei:48,krb5_init_secure_context:48,205,268,904,krb5_int16:790,krb5_int16_max:562,775,krb5_int16_min:775,krb5_int32:66,69,74,83,266,360,361,371,382,386,391,406,790,792,794,798,799,805,807,810,814,816,818,821,822,823,825,832,837,840,853,854,855,857,861,865,867,868,871,877,krb5_int32_max:564,775,krb5_int32_min:775,krb5_invalid_princip:50,krb5_is_config_princip:47,48,krb5_is_referral_realm:48,krb5_is_thread_saf:48,krb5_k:833,krb5_k_create_kei:48,krb5_k_decrypt:48,krb5_k_decrypt_iov:48,290,krb5_k_encrypt:48,krb5_k_encrypt_iov:48,288,krb5_k_free_kei:48,68,73,77,286,krb5_k_key_enctyp:48,krb5_k_key_keyblock:48,krb5_k_make_checksum:48,113,krb5_k_make_checksum_iov:48,114,299,krb5_k_prf:48,krb5_k_reference_kei:48,krb5_k_verify_checksum:48,129,krb5_k_verify_checksum_iov:48,130,295,krb5_kdc_profil:10,20,34,903,904,939,krb5_kdc_rep:232,233,234,790,krb5_kdc_req:790,krb5_kdc_unreach:260,krb5_kdcpolicy_moddata:916,krb5_kdcpreauth_moddata:917,krb5_kdcpreauth_modreq:917,krb5_kdcrep_modifi:267,krb5_kdcrep_skew:267,krb5_kei:48,68,73,77,87,89,287,288,289,290,291,294,295,296,297,298,299,790,krb5_key_st:833,krb5_keyblock:48,67,70,72,75,76,86,88,90,99,100,101,102,103,106,107,108,113,114,115,117,119,124,125,126,129,130,180,181,234,281,286,293,313,318,337,338,339,340,348,350,390,408,790,794,799,811,812,818,819,820,836,krb5_keytab:232,235,276,300,301,302,303,305,306,308,309,310,311,312,314,315,316,356,360,361,373,410,790,krb5_keytab_entri:217,300,307,308,312,314,790,krb5_keytab_entry_st:836,krb5_keyusag:99,100,102,103,108,113,114,129,130,287,288,289,290,294,295,298,299,790,krb5_keyusage_ad_it:775,krb5_keyusage_ad_kdcissued_cksum:775,krb5_keyusage_ad_mt:775,krb5_keyusage_ad_signedpath:775,krb5_keyusage_ap_rep_encpart:775,krb5_keyusage_ap_req_auth:775,krb5_keyusage_ap_req_auth_cksum:775,krb5_keyusage_app_data_cksum:775,krb5_keyusage_app_data_encrypt:775,krb5_keyusage_as_rep_encpart:775,krb5_keyusage_as_req:775,krb5_keyusage_as_req_pa_enc_t:775,krb5_keyusage_cammac:775,krb5_keyusage_enc_challenge_cli:775,krb5_keyusage_enc_challenge_kdc:775,krb5_keyusage_fast_enc:775,krb5_keyusage_fast_finish:775,krb5_keyusage_fast_rep:775,krb5_keyusage_fast_req_chksum:775,krb5_keyusage_gss_tok_m:775,krb5_keyusage_gss_tok_wrap_integ:775,krb5_keyusage_gss_tok_wrap_priv:775,krb5_keyusage_iakerb_finish:775,krb5_keyusage_kdc_rep_ticket:775,krb5_keyusage_krb_cred_encpart:775,krb5_keyusage_krb_error_cksum:775,krb5_keyusage_krb_priv_encpart:775,krb5_keyusage_krb_safe_cksum:775,krb5_keyusage_pa_as_fresh:775,krb5_keyusage_pa_fx_cooki:775,krb5_keyusage_pa_otp_request:775,krb5_keyusage_pa_pkinit_kx:775,krb5_keyusage_pa_s4u_x509_user_repli:601,775,krb5_keyusage_pa_s4u_x509_user_request:600,775,krb5_keyusage_pa_sam_challenge_cksum:775,krb5_keyusage_pa_sam_challenge_trackid:598,775,krb5_keyusage_pa_sam_respons:597,775,krb5_keyusage_spak:775,krb5_keyusage_tgs_rep_encpart_sesskei:775,krb5_keyusage_tgs_rep_encpart_subkei:775,krb5_keyusage_tgs_req_ad_sesskei:775,krb5_keyusage_tgs_req_ad_subkei:775,krb5_keyusage_tgs_req_auth:775,krb5_keyusage_tgs_req_auth_cksum:775,krb5_kpasswd_accessdeni:775,krb5_kpasswd_autherror:166,775,krb5_kpasswd_bad_vers:775,krb5_kpasswd_harderror:166,775,krb5_kpasswd_initial_flag_need:775,krb5_kpasswd_malform:166,775,krb5_kpasswd_softerror:166,775,krb5_kpasswd_success:166,379,775,krb5_kt_add_entri:48,krb5_kt_client_default:48,krb5_kt_close:48,315,krb5_kt_cursor:306,312,316,790,krb5_kt_default:48,krb5_kt_default_nam:48,krb5_kt_dup:48,krb5_kt_end:312,krb5_kt_end_seq_get:48,316,krb5_kt_free_entri:48,312,krb5_kt_get_entri:48,krb5_kt_get_nam:48,krb5_kt_get_typ:48,krb5_kt_have_cont:48,krb5_kt_name_toolong:309,krb5_kt_next_entri:48,krb5_kt_notfound:311,krb5_kt_nowrit:300,314,krb5_kt_read_service_kei:48,krb5_kt_remove_entri:48,krb5_kt_resolv:48,krb5_kt_start_seq_get:48,306,krb5_ktname:43,886,903,939,krb5_kuserok:47,48,904,918,krb5_kvno:308,313,790,817,836,krb5_last_req_entri:790,818,krb5_libos_badpwdmatch:260,358,krb5_libos_pwdintr:260,krb5_lname_no_tran:918,krb5_lname_notran:56,krb5_lrq_all_acct_exptim:775,krb5_lrq_all_last_initi:775,krb5_lrq_all_last_renew:775,krb5_lrq_all_last_req:775,krb5_lrq_all_last_tgt:775,krb5_lrq_all_last_tgt_issu:775,krb5_lrq_all_pw_exptim:775,krb5_lrq_none:775,krb5_lrq_one_acct_exptim:775,krb5_lrq_one_last_initi:775,krb5_lrq_one_last_renew:775,krb5_lrq_one_last_req:775,krb5_lrq_one_last_tgt:775,krb5_lrq_one_last_tgt_issu:775,krb5_lrq_one_pw_exptim:775,krb5_magic:790,791,793,794,795,797,799,804,807,809,810,811,812,815,817,818,819,820,822,831,832,834,836,840,845,854,855,859,868,869,872,876,877,881,krb5_make_authdata_kdc_issu:48,krb5_merge_authdata:48,krb5_mk_1cred:48,krb5_mk_error:48,krb5_mk_ncred:48,320,krb5_mk_priv:48,79,krb5_mk_rep:48,krb5_mk_rep_dc:48,krb5_mk_req:48,80,81,327,krb5_mk_req_checksum_func:63,80,790,krb5_mk_req_extend:48,326,krb5_mk_safe:48,323,krb5_msgtype:498,499,500,501,526,538,704,727,745,746,790,818,831,832,krb5_no_2nd_tkt:267,krb5_no_tkt_suppli:223,267,krb5_nt_ent_principal_and_id:775,krb5_nt_enterprise_princip:775,krb5_nt_ms_princip:775,krb5_nt_ms_principal_and_id:775,krb5_nt_princip:775,krb5_nt_smtp_name:775,krb5_nt_srv_hst:223,386,775,krb5_nt_srv_inst:775,krb5_nt_srv_xhst:775,krb5_nt_uid:775,krb5_nt_unknown:386,775,krb5_nt_wellknown:775,krb5_nt_x500_princip:775,krb5_octet:790,791,797,804,834,845,868,876,877,krb5_os_localaddr:48,krb5_pa_data:790,818,831,832,krb5_pa_pac_req:790,krb5_pa_server_referral_data:790,krb5_pa_svr_referral_data:790,krb5_pac:330,331,332,333,334,335,336,337,338,339,340,790,krb5_pac_add_buff:48,krb5_pac_client_info:330,775,krb5_pac_credentials_info:330,775,krb5_pac_data:849,krb5_pac_delegation_info:330,775,krb5_pac_fre:48,335,336,krb5_pac_get_buff:48,krb5_pac_get_client_info:48,904,krb5_pac_get_typ:48,krb5_pac_init:48,krb5_pac_logon_info:330,775,krb5_pac_pars:48,krb5_pac_privsvr_checksum:330,775,krb5_pac_server_checksum:330,775,krb5_pac_sign:48,338,krb5_pac_sign_ext:48,krb5_pac_upn_dns_info:330,775,krb5_pac_verifi:48,340,krb5_pac_verify_ext:48,krb5_padata_afs3_salt:775,krb5_padata_ap_req:690,775,krb5_padata_as_checksum:775,krb5_padata_as_fresh:775,krb5_padata_enc_sandia_securid:775,krb5_padata_enc_timestamp:775,krb5_padata_enc_unix_tim:775,krb5_padata_encrypted_challeng:775,krb5_padata_etype_info2:775,krb5_padata_etype_info:775,krb5_padata_for_us:775,krb5_padata_fx_cooki:775,krb5_padata_fx_error:775,krb5_padata_fx_fast:775,krb5_padata_get_from_typed_data:775,krb5_padata_non:775,krb5_padata_osf_dc:775,krb5_padata_otp_challeng:775,krb5_padata_otp_pin_chang:775,krb5_padata_otp_request:775,krb5_padata_pac_opt:775,krb5_padata_pac_request:775,krb5_padata_pk_as_rep:775,krb5_padata_pk_as_rep_old:775,krb5_padata_pk_as_req:775,krb5_padata_pk_as_req_old:775,krb5_padata_pkinit_kx:775,krb5_padata_pw_salt:775,krb5_padata_referr:775,krb5_padata_s4u_x509_us:775,krb5_padata_sam_challeng:775,krb5_padata_sam_challenge_2:775,krb5_padata_sam_redirect:775,krb5_padata_sam_respons:775,krb5_padata_sam_response_2:775,krb5_padata_sesam:775,krb5_padata_spak:775,krb5_padata_svr_referral_info:775,krb5_padata_tgs_req:775,krb5_padata_use_specified_kvno:775,krb5_parse_nam:46,47,48,342,402,krb5_parse_name_flag:47,48,krb5_plugin_no_handl:911,914,918,919,krb5_plugin_ver_notsupp:909,krb5_plugin_vt:909,krb5_pointer:186,190,197,281,313,350,360,361,372,790,801,838,krb5_post_recv_fn:377,790,krb5_pre_send_fn:378,790,krb5_preauth_fail:260,krb5_preauthtyp:232,233,234,254,790,826,845,krb5_prepend_error_messag:48,413,904,krb5_princ_compon:775,krb5_princ_nam:775,krb5_princ_nomatch:223,267,krb5_princ_realm:775,krb5_princ_set_realm:775,krb5_princ_set_realm_data:775,krb5_princ_set_realm_length:775,krb5_princ_siz:775,779,krb5_princ_typ:775,krb5_princip:46,47,48,49,91,92,93,94,132,145,147,154,182,218,223,229,235,260,264,267,275,313,317,360,361,372,379,380,381,386,408,410,790,799,811,812,818,819,822,831,832,836,847,848,869,krb5_principal2salt:48,krb5_principal_compar:47,48,346,347,385,krb5_principal_compare_any_realm:47,48,krb5_principal_compare_casefold:347,775,krb5_principal_compare_enterpris:347,775,krb5_principal_compare_flag:47,48,krb5_principal_compare_ignore_realm:347,775,krb5_principal_compare_utf8:347,775,krb5_principal_data:47,790,807,854,krb5_principal_parse_enterpris:342,775,krb5_principal_parse_ignore_realm:342,775,krb5_principal_parse_no_def_realm:775,krb5_principal_parse_no_realm:342,775,krb5_principal_parse_require_realm:342,775,krb5_principal_unparse_displai:404,775,krb5_principal_unparse_no_realm:404,775,krb5_principal_unparse_short:404,775,krb5_priv:775,krb5_process_kei:48,krb5_prog_etype_nosupp:375,krb5_prompt:349,790,858,krb5_prompt_typ:263,790,krb5_prompt_type_new_password:263,775,krb5_prompt_type_new_password_again:263,775,krb5_prompt_type_password:263,775,krb5_prompt_type_preauth:263,775,krb5_prompter_fct:260,275,790,krb5_prompter_posix:46,48,krb5_prop:15,34,41,krb5_pvno:775,krb5_pwd_data:790,krb5_pwqual_moddata:921,krb5_random_kei:48,krb5_randsourc:120,krb5_rc_close:265,krb5_rc_requir:320,322,krb5_rc_st:860,krb5_rcach:71,85,265,790,krb5_rd_cred:48,322,krb5_rd_error:48,krb5_rd_priv:48,79,861,krb5_rd_rep:48,krb5_rd_rep_dc:48,krb5_rd_req:48,krb5_rd_safe:48,861,krb5_read_error:48,krb5_read_password:48,krb5_realm_branch_char:775,krb5_realm_cant_resolv:260,krb5_realm_compar:47,48,krb5_recvauth:48,361,372,krb5_recvauth_badauthv:775,krb5_recvauth_skip_vers:775,krb5_recvauth_vers:48,krb5_referral_realm:48,775,krb5_replay_data:320,322,323,328,351,353,357,790,krb5_responder_context:46,362,363,364,365,366,367,368,369,370,790,863,krb5_responder_context_st:862,krb5_responder_fn:257,790,862,krb5_responder_get_challeng:46,48,363,862,krb5_responder_list_quest:46,48,862,krb5_responder_otp_challeng:46,364,365,790,krb5_responder_otp_challenge_fre:46,48,365,krb5_responder_otp_flags_collect_pin:717,775,krb5_responder_otp_flags_collect_token:775,krb5_responder_otp_flags_nextotp:775,krb5_responder_otp_flags_separate_pin:775,krb5_responder_otp_format_alphanumer:775,krb5_responder_otp_format_decim:775,krb5_responder_otp_format_hexadecim:775,krb5_responder_otp_get_challeng:46,48,krb5_responder_otp_set_answ:46,48,krb5_responder_otp_tokeninfo:790,864,krb5_responder_pkinit_challeng:46,367,368,790,krb5_responder_pkinit_challenge_fre:48,368,krb5_responder_pkinit_flags_token_:726,krb5_responder_pkinit_flags_token_user_pin_count_low:775,krb5_responder_pkinit_flags_token_user_pin_final_tri:775,krb5_responder_pkinit_flags_token_user_pin_lock:775,krb5_responder_pkinit_get_challeng:46,48,krb5_responder_pkinit_ident:790,866,krb5_responder_pkinit_set_answ:46,48,krb5_responder_question_otp:46,48,775,krb5_responder_question_password:46,775,krb5_responder_question_pkinit:46,48,775,krb5_responder_set_answ:46,48,363,862,krb5_respons:790,krb5_roundup:775,krb5_safe:775,krb5_salttype_to_str:48,krb5_sam_must_pk_encrypt_sad:775,krb5_sam_send_encrypted_sad:775,krb5_sam_use_sad_as_kei:775,krb5_sendauth:48,360,krb5_server_decrypt_ticket_keytab:48,krb5_set_default_realm:44,48,krb5_set_default_tgs_enctyp:48,261,krb5_set_error_messag:48,krb5_set_kdc_recv_hook:48,krb5_set_kdc_send_hook:48,krb5_set_password:47,48,169,krb5_set_password_using_ccach:47,48,krb5_set_principal_realm:47,48,krb5_set_real_tim:48,krb5_set_trace_callback:48,krb5_set_trace_filenam:48,krb5_sname_match:47,48,356,krb5_sname_to_princip:47,48,krb5_string_to_cksumtyp:48,krb5_string_to_deltat:48,krb5_string_to_enctyp:48,krb5_string_to_kei:48,krb5_string_to_salttyp:48,krb5_string_to_timestamp:48,krb5_tc_match_2nd_tkt:153,775,krb5_tc_match_authdata:153,775,krb5_tc_match_flag:153,775,krb5_tc_match_flags_exact:153,775,krb5_tc_match_is_skei:153,775,krb5_tc_match_ktyp:153,775,krb5_tc_match_srv_nameonli:153,775,krb5_tc_match_tim:153,775,krb5_tc_match_times_exact:153,775,krb5_tc_noticket:775,krb5_tc_openclos:775,krb5_tc_supported_ktyp:153,775,krb5_tgs_name:775,krb5_tgs_name_s:775,krb5_tgs_rep:775,krb5_tgs_req:775,832,krb5_ticket:48,185,221,356,360,361,373,790,795,809,831,832,872,krb5_ticket_tim:274,399,790,811,812,818,819,krb5_timeofdai:48,krb5_timestamp:45,167,266,333,337,338,339,340,382,392,393,394,395,406,790,794,799,810,818,822,824,832,836,840,847,861,868,870,krb5_timestamp_to_sfstr:48,krb5_timestamp_to_str:48,krb5_tkt_authent:790,krb5_tkt_creds_context:396,397,398,399,400,401,790,krb5_tkt_creds_fre:48,400,krb5_tkt_creds_get:48,398,399,400,krb5_tkt_creds_get_cr:48,397,krb5_tkt_creds_get_tim:48,krb5_tkt_creds_init:48,397,krb5_tkt_creds_step:48,398,399,400,krb5_tkt_creds_step_flag_continu:401,775,krb5_trace:41,383,384,939,krb5_trace_callback:383,790,875,krb5_trace_info:383,790,874,krb5_trace_nosupp:383,384,krb5_transit:790,819,krb5_typed_data:790,krb5_ui_2:790,krb5_ui_4:330,332,334,355,790,794,799,822,861,krb5_unparse_nam:47,48,403,404,krb5_unparse_name_ext:48,krb5_unparse_name_flag:47,48,krb5_unparse_name_flags_ext:48,krb5_us_timeofdai:48,krb5_use_enctyp:48,krb5_verify_authdata_kdc_issu:48,krb5_verify_checksum:48,krb5_verify_init_cr:46,48,412,krb5_verify_init_creds_opt:46,410,411,412,790,krb5_verify_init_creds_opt_ap_req_nofail:775,krb5_verify_init_creds_opt_init:46,48,410,krb5_verify_init_creds_opt_set_ap_req_nofail:46,48,410,krb5_vprepend_error_messag:48,krb5_vset_error_messag:48,krb5_vwrap_error_messag:48,krb5_wellknown_namestr:775,krb5_wrap_error_messag:48,415,904,krb5_x:775,krb5_xc:775,krb5cc_1984:932,krb5cc_320:925,krb5cc_:903,932,939,krb5cc_p11795:925,krb5cc_ttypa:925,krb5ccname:15,136,883,927,928,929,932,939,krb5kdc:0,1,2,3,4,5,6,7,8,9,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,krb5kdc_err_key_exp:260,krb5kdc_err_more_preauth_data_requir:917,krb5krb_ap_err_skew:167,krb5krb_err_response_too_big:279,401,krb5lib:34,krb5plugin_service_locate_ft:919,krb5rcachedir:887,903,939,krb5rcachenam:887,939,krb5rcachetyp:887,939,krb5srv:39,krb:48,904,905,krb_ap_rep:48,krb_ap_req:48,krb_error:48,372,krbadmin:20,22,krbcanonicalnam:22,krbcontain:20,22,krbcore:922,krbdev:922,krbprincipalnam:22,krbtest:16,23,35,41,897,898,937,krbtgt:3,19,26,37,41,43,278,639,743,896,897,898,904,925,934,kreen:905,ksu:905,923,926,939,ksu_opt:932,kswitch:883,923,926,939,ktadd:14,32,34,886,kth:905,ktid:315,ktrem:3,15,ktutil:1,2,886,889,904,ktype:128,232,233,234,261,832,kungliga:905,kv5m_context:135,156,kvno:3,6,11,14,15,16,23,26,29,32,34,41,308,410,817,869,897,904,923,926,lab:5,23,905,label:21,905,laboratori:905,lack:37,375,904,lag:932,larg:20,23,24,34,36,39,46,100,103,119,288,290,890,904,larger:24,32,37,882,900,904,largest:35,last:3,6,9,20,23,24,35,44,48,173,198,200,220,245,312,319,383,721,840,883,884,907,916,last_fail:6,last_req:818,last_success:6,lastpwd:6,latenc:24,later:3,19,20,21,23,26,33,37,38,39,41,43,136,247,726,882,897,900,904,905,911,918,latest:34,224,870,890,904,925,latter:385,883,launchpad:42,law:905,lawsuit:905,lawyer:905,layer:904,910,913,layout:43,903,lcom_err:931,lcurs:892,ldap:3,4,5,6,10,20,22,35,892,904,905,ldap_conns_per_serv:20,ldap_kadmind_dn:5,20,22,23,ldap_kadmind_sasl_authcid:5,20,23,ldap_kadmind_sasl_authzid:20,ldap_kadmind_sasl_mech:20,ldap_kadmind_sasl_realm:20,ldap_kdc_dn:5,20,22,23,ldap_kdc_sasl_authcid:5,20,23,ldap_kdc_sasl_authzid:20,ldap_kdc_sasl_mech:20,22,ldap_kdc_sasl_realm:20,ldap_kerberos_container_dn:20,22,ldap_serv:20,22,ldap_service_password_fil:20,22,ldapadd:22,ldapi:20,22,24,ldapuri:3,5,23,ldb:892,ldflag:892,ldif:22,ldname:892,ldopt:892,lead:20,932,learn:15,least:15,23,32,34,39,99,102,153,287,289,403,721,738,900,914,918,leav:3,14,23,24,28,32,33,left:20,21,280,898,909,leg:904,legaci:26,46,871,legal:280,932,legitim:25,46,887,932,lehman:905,lehmann:905,len:12,118,334,336,length:3,20,23,33,43,46,48,91,92,99,100,102,103,116,117,119,124,191,203,209,244,254,260,280,284,287,288,289,290,309,336,358,394,724,784,785,791,797,804,807,815,834,845,854,855,865,877,896,897,900,901,910,930,lengthi:904,less:3,15,20,25,883,890,900,901,904,let:99,287,919,938,letter:34,39,925,level:3,5,10,23,25,37,39,43,890,894,920,liabil:905,liabl:905,lib:37,890,892,903,905,931,libdefault:15,20,26,28,33,34,38,39,40,41,43,44,883,886,887,920,libdir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,libedit:892,libera:922,libev:905,libkdb5:907,libkdb_ldap:22,libkeyutil:892,libkrb5:21,28,43,882,904,libpam:42,librari:3,18,20,21,24,26,29,38,41,43,46,48,49,50,52,53,54,55,56,59,60,61,62,63,64,65,66,67,68,69,71,72,73,74,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,124,125,126,129,130,132,133,134,135,136,137,138,139,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,169,171,172,173,174,175,176,177,178,179,180,181,182,183,184,189,194,195,198,199,200,201,202,203,204,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,227,228,229,230,231,235,236,237,238,245,246,247,248,250,251,252,253,257,260,261,262,263,264,265,266,267,270,271,272,273,274,275,276,277,278,279,280,283,286,287,288,289,290,294,295,296,298,299,300,301,302,303,304,305,306,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,334,335,336,337,338,339,340,341,342,343,344,345,346,347,349,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,393,396,397,398,399,400,401,402,403,404,405,406,408,410,413,414,415,416,851,852,882,883,889,890,892,903,904,905,906,907,908,910,911,912,918,919,920,931,939,libtool:909,libverto:892,917,licens:891,892,895,904,life:3,5,19,23,928,lifetim:3,6,14,21,23,48,153,362,363,738,812,818,883,904,907,916,925,928,932,939,lightn:904,lightweight:889,like:3,6,8,12,14,15,19,21,23,32,33,34,37,38,39,41,43,192,883,887,888,890,892,894,905,909,913,925,likewis:932,limit:20,23,24,25,34,39,905,932,939,line:0,3,8,10,12,15,19,20,21,23,28,34,35,37,349,891,892,904,905,924,932,934,937,938,939,link:0,23,30,34,887,890,891,892,894,907,910,931,linkdn:3,23,linker:892,linux:883,892,904,list:0,2,3,4,6,10,14,15,19,21,26,28,32,34,36,39,40,43,46,48,93,153,164,184,189,195,214,230,231,318,375,408,413,414,415,819,862,883,892,893,903,905,907,908,911,917,920,924,925,929,932,937,938,list_mkei:23,list_princip:15,listen:4,8,10,20,34,39,904,listinfo:922,listpol:3,23,listprinc:3,23,liter:909,littl:910,live:6,15,909,lk5crypto:931,lkrb5:931,lmdb:20,24,892,904,lname:56,932,lndir:889,891,lnsize_in:56,lnsl:892,load:8,14,17,20,23,24,34,38,40,892,910,920,load_dump:6,23,loadabl:20,21,910,loader:892,local0:20,local7:20,local:3,5,8,12,14,15,20,21,22,23,28,32,34,36,39,43,46,48,62,64,80,230,231,322,323,324,326,328,341,353,356,357,386,395,404,518,519,703,884,887,888,889,892,894,896,897,898,903,904,911,912,924,925,928,929,931,932,934,939,local_addr:44,64,82,local_appdata:21,local_port:84,local_realm:932,localauth:904,912,localauth_plugin:918,localedir:892,localfr:28,localhost:15,localhostnam:43,localstatedir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,locat:4,7,8,10,15,19,20,21,22,24,25,29,34,39,41,43,48,883,887,890,892,893,901,903,904,905,912,920,925,927,928,929,931,932,933,934,939,locate_plugin:919,lock:6,20,23,24,34,35,722,723,901,904,925,lockdown_kei:3,19,23,904,lockit:3,lockout:3,20,23,24,25,30,lockout_polici:35,lockoutdur:3,23,35,lockouttim:3,23,log:8,9,23,24,26,28,33,34,37,39,46,48,723,883,904,912,924,925,927,932,938,939,log_:20,log_daemon:20,logic:39,login:20,21,33,38,41,46,925,932,939,logon:20,330,648,logout:925,927,longer:11,19,23,25,33,39,43,49,65,67,68,72,73,76,77,78,91,92,93,111,113,115,125,126,132,141,143,145,150,153,154,163,164,169,172,173,174,175,176,177,178,180,181,182,183,194,195,224,227,229,230,231,236,261,265,268,272,275,280,282,286,294,308,313,315,316,319,321,322,323,324,325,326,327,328,329,332,335,336,337,341,342,351,352,353,354,356,357,360,372,386,398,400,402,404,892,904,925,928,look:0,8,12,15,20,21,23,28,37,38,39,43,386,890,892,909,925,928,932,lookasid:892,lookup:21,22,33,38,39,194,801,892,904,919,lose:6,23,loss:23,905,lost:17,890,905,lot:39,lower:3,19,21,23,43,230,920,930,937,lowercas:23,38,887,lowest:21,lpr:20,lr_type:840,lr_type_interpretation_mask:775,lr_type_this_server_onli:775,lrealm:210,227,374,lsocket:892,lss:892,ltd:905,luke:39,luser:317,lxml:894,mac:889,mach:21,905,machin:4,8,12,14,15,17,18,21,31,32,34,37,38,39,883,888,892,924,925,938,939,maco:21,339,883,889,904,905,macro:417,875,932,made:8,21,23,34,41,136,253,269,375,883,904,905,913,915,933,939,magic:135,156,791,793,794,795,797,799,804,807,809,810,811,812,815,817,818,819,820,822,831,832,834,836,840,845,854,855,859,868,869,872,876,877,881,mai:3,6,8,10,11,14,15,19,20,21,22,23,24,25,26,28,33,34,35,36,37,38,39,40,41,43,46,99,107,120,122,126,158,195,224,228,229,241,245,258,262,287,327,356,372,377,378,385,386,410,717,833,851,863,875,884,887,890,892,893,896,897,900,901,904,905,908,910,911,913,914,915,916,917,920,922,924,925,927,928,932,937,939,mail:20,883,925,932,937,mailbox:887,mailman:922,main:365,368,922,maintain:0,9,15,20,23,890,892,939,mainten:3,6,23,maj_ver:909,major:43,891,909,make:0,3,6,12,14,15,17,20,21,22,23,25,26,28,32,33,34,35,37,39,41,43,48,112,236,241,250,365,368,400,882,890,891,892,894,896,904,905,910,924,928,933,makedepend:889,makefil:890,892,894,malform:166,223,614,896,malici:3,23,46,malloc:920,man:0,3,21,887,892,904,manag:5,19,23,33,904,920,923,939,mandatori:113,114,129,130,294,295,298,299,898,mandir:892,mani:3,17,21,23,28,35,39,41,913,925,939,manipul:22,23,45,813,886,manner:5,23,905,manual:0,6,10,15,23,33,34,890,892,904,manual_test:890,map:21,28,33,34,43,892,904,910,911,918,932,937,mapsiz:20,24,marc:905,mark:3,6,20,21,23,34,339,905,marker:896,904,marko:905,markup:0,894,marshal:896,897,904,masachusett:939,mask:66,83,142,153,157,masquerad:17,924,925,massachusett:895,905,master:3,4,5,6,10,20,26,34,35,39,41,888,893,903,904,master_kdc:21,39,master_key_nam:5,6,20,23,master_key_typ:5,6,14,20,23,34,match:0,2,3,6,15,19,20,21,23,28,29,33,37,38,43,48,59,60,119,151,153,195,223,224,267,308,356,360,372,400,731,732,733,734,735,736,737,739,742,832,883,887,901,903,904,920,934,937,939,materi:14,46,905,909,matt:905,matter:17,21,max_keytab_name_len:775,max_lif:6,20,34,max_read:20,24,max_renew_lif:6,max_renewable_lif:20,34,max_renewable_ticket_lif:5,23,max_ticket_lif:5,23,maxfailur:3,23,35,maximum:3,5,6,10,14,15,20,21,23,24,33,39,46,309,358,882,917,925,928,maxlif:3,19,23,maxnumb:3,23,maxpathlen:752,maxrenewlif:3,5,19,23,maxtktlif:5,23,mcred:153,md4:26,905,md5:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,mdb:24,mean:3,12,14,20,21,23,33,34,37,46,888,890,893,905,925,932,939,meaning:3,23,meant:925,measur:25,882,mech:28,903,904,939,mech_typ:910,mechan:3,16,20,21,22,23,36,37,39,40,43,46,154,250,887,896,897,903,904,908,909,912,917,919,928,939,mechglu:905,910,media:5,21,23,medvinski:932,meet:937,megabyt:20,24,891,mellon:905,member:20,membership:46,memori:15,41,43,48,93,142,223,231,300,320,322,323,328,353,354,357,410,813,883,886,892,904,909,911,918,memset:46,mention:20,22,905,merchant:905,merg:18,20,48,905,messag:3,8,20,21,24,34,41,48,78,360,372,378,526,533,704,727,793,818,822,831,832,851,852,869,875,887,889,897,904,905,909,924,925,931,932,934,939,message_out:169,message_typ:868,met:905,932,metadata:6,method:21,25,39,230,896,906,907,908,909,911,914,915,916,917,918,919,920,921,928,mexico:905,mgluep:905,mic:527,904,mic_token:43,michigan:905,microsecond:266,382,406,794,810,861,896,microsoft:20,21,26,29,42,43,379,448,904,910,microsystem:905,middl:887,might:14,17,23,28,29,34,35,38,39,43,890,892,896,905,909,924,939,migrat:14,23,41,904,miller:905,939,min:3,19,23,884,min_ver:909,minclass:3,23,minim:6,14,23,24,minimum:3,20,23,33,minlength:3,23,minlif:3,23,minor:14,43,891,904,909,910,919,minor_statu:43,910,minu:20,901,minut:5,20,21,23,884,887,924,925,939,mismatch:43,260,339,924,miss:267,894,mission:932,mistak:924,mistakenli:171,mit1:897,mit:3,5,12,14,15,17,19,20,21,24,28,30,31,32,34,38,39,41,43,45,46,882,883,889,891,892,894,895,896,897,898,908,910,912,913,917,920,922,924,925,928,939,mitig:25,46,887,904,mitiys4k5:34,mix:925,mk_cmd:892,mk_req:842,mkdir:890,mkei:3,6,23,mkey_convert:6,23,mkey_fil:6,23,mkeynam:5,6,10,23,mkeytyp:5,6,23,mkeyvno:5,6,23,mkvno:6,modbi:6,mode:3,6,8,14,20,23,41,462,474,716,892,904,928,932,modern:14,15,23,38,modestli:40,modif:6,9,19,21,34,905,modifi:3,6,9,15,18,19,25,28,32,34,40,43,100,103,114,136,144,146,158,288,290,295,310,337,362,363,852,892,904,905,915,920,928,modify_princip:26,modnam:21,28,modpol:3,23,modprinc:3,23,35,37,40,914,modtim:6,modul:3,4,6,20,21,23,35,252,268,892,894,902,904,906,907,908,911,913,914,915,916,917,918,919,920,921,928,939,modular:904,module_nam:21,modulenam:21,modulepath:21,modulo:901,moira:905,mon:3,23,35,monitor:25,month:884,904,more:6,14,15,19,20,21,22,23,25,29,32,34,35,37,38,39,41,43,46,262,279,341,401,560,724,726,747,875,883,886,887,889,892,893,897,904,911,917,922,924,939,more_preauth_data_requir:908,morn:33,most:2,6,17,20,21,23,24,25,26,28,33,34,37,39,40,41,43,48,154,883,886,887,889,904,908,909,910,925,927,939,mostli:892,move:20,27,34,48,msdn:904,msec_dirbit:775,msec_val_mask:775,msg:213,msg_type:818,831,832,mslsa:883,mssclogin:21,much:14,25,38,153,924,multi:35,37,904,multihom:21,multipl:3,10,14,15,16,20,21,22,23,24,28,34,35,36,37,39,43,46,833,883,887,890,904,909,910,917,928,937,939,multipli:35,multithread:48,muse:905,must:2,3,7,8,11,14,15,19,20,21,22,23,24,26,28,29,32,33,34,35,36,37,39,43,46,57,58,69,74,78,99,100,102,103,113,117,119,121,125,126,136,146,152,153,158,173,176,195,198,200,220,224,228,241,247,268,270,271,274,275,279,282,287,288,289,290,294,296,310,312,315,319,323,328,342,356,365,368,370,372,399,403,714,715,717,724,726,728,731,732,733,734,735,736,737,738,739,742,813,833,856,883,890,891,892,896,897,898,900,901,904,905,907,909,910,911,914,916,917,918,920,924,925,930,932,934,939,mutabl:833,mutex:833,mutual:34,327,372,433,498,793,928,932,my_cach:932,my_proxi:21,my_respond:46,mydir:883,mydomain:20,mymodul:28,mypreauth:28,myrealm:46,myremotetokentyp:20,name:2,3,4,5,6,8,10,12,14,15,16,19,20,21,22,23,24,28,29,30,32,33,34,36,37,40,46,48,49,50,59,60,141,147,153,155,159,214,222,223,227,230,235,246,247,252,260,264,267,278,308,313,315,317,318,326,330,337,338,339,340,347,349,356,359,362,374,379,381,402,403,404,405,408,410,496,633,635,636,637,638,642,645,651,726,737,799,819,848,858,862,869,884,886,891,894,896,897,900,903,904,905,906,909,911,918,919,920,921,925,927,928,929,930,931,932,934,939,name_s:304,name_str:37,name_typ:37,namelen:309,nat:21,23,nation:905,nativ:33,365,368,882,892,896,900,903,904,natur:38,naval:905,ncsa:42,nctx_out:176,ndnhnmn:884,nearli:3,necessari:3,14,21,22,23,24,33,34,37,39,43,260,338,340,384,403,908,909,913,924,925,necessarili:14,need:4,6,12,14,15,19,20,21,23,32,33,34,35,37,38,39,40,41,43,46,49,64,65,67,68,72,73,76,77,78,91,92,93,99,100,102,103,111,113,115,125,126,132,141,143,145,150,153,154,163,164,169,172,173,174,175,176,177,178,180,181,182,183,194,195,224,227,229,230,231,236,258,261,265,268,272,275,279,280,282,286,287,288,289,290,294,308,313,315,316,319,320,321,322,323,324,325,326,327,328,329,332,335,336,337,341,342,351,352,353,354,356,357,360,361,372,386,398,400,401,402,404,560,725,726,747,883,884,889,890,891,892,894,897,904,910,911,913,918,920,922,924,925,928,931,needchang:3,5,23,neg:28,871,900,neglig:905,negoex:904,912,negoti:896,904,910,neither:3,23,322,905,928,929,932,nersc:21,net:21,42,netbio:54,netbsd:904,905,netlib:892,netlogon:448,network:3,15,17,21,23,25,29,32,34,38,39,40,43,46,260,372,518,519,520,521,889,892,924,925,938,939,neuman:939,never:3,14,15,17,19,20,23,24,35,100,103,228,288,290,901,924,925,new_message_out:852,new_mkey_fil:6,23,new_princip:3,new_reply_out:851,852,new_stat:108,newer:6,14,20,23,892,newest:23,newli:3,6,23,26,37,107,113,125,126,176,294,326,327,356,360,361,372,883,890,904,newlin:341,349,newprinc:3,23,newpw:166,379,380,next:3,6,17,23,34,35,48,99,100,102,103,120,287,288,289,290,716,890,896,897,901,904,908,917,925,932,nfs:38,nii:932,nippon:905,nist:21,40,nitem:909,nktype:832,nlgilman:12,nls:904,no_auth_data_requir:3,23,no_host_referr:20,39,noaddress:21,nofail:46,nofork:4,nokei:3,23,37,non:2,3,14,19,21,23,26,33,37,43,44,99,100,102,103,113,122,129,130,155,224,241,245,250,269,287,288,289,290,294,298,299,313,327,339,356,372,379,380,385,851,896,900,904,928,931,932,nonc:355,810,818,832,904,none:3,20,21,22,23,26,36,37,57,58,132,273,285,302,366,369,887,897,932,939,nonexist:904,noninfring:905,nonrepudi:37,nonzero:21,224,934,noout:37,nopw:3,23,nor:905,929,932,norandkei:3,15,norealm:14,20,normal:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,north:905,nosync:20,24,notabl:23,note:3,5,6,14,20,21,23,26,32,34,154,241,245,597,598,600,601,884,890,917,925,928,932,938,939,noth:8,887,notic:17,24,905,notifi:922,novel:905,now:8,14,34,37,39,235,260,275,716,904,925,nowait:8,12,34,nrl:905,nss:905,nt_wellknown:749,ntlm:904,ntt:905,num:9,num_data:98,100,103,114,130,288,290,295,299,num_prompt:349,858,number:2,3,4,5,6,8,9,10,11,12,14,15,19,20,21,23,24,35,36,37,39,46,48,66,78,80,83,100,103,112,135,156,288,290,308,313,322,323,324,328,334,349,353,355,356,357,516,523,709,724,726,794,813,832,836,861,871,882,884,886,890,892,894,896,897,898,900,904,905,908,917,929,930,931,932,934,numer:6,34,166,379,380,884,904,929,numwork:10,object:3,5,6,20,21,22,24,25,28,35,36,43,48,262,269,726,890,892,896,905,906,907,908,909,910,911,914,915,916,917,918,919,920,921,observ:25,29,35,obtain:2,3,15,16,17,20,21,23,25,26,33,34,37,43,46,48,80,135,230,258,271,274,326,327,356,372,399,400,410,436,613,823,883,886,892,901,904,905,920,921,923,924,928,932,934,obvious:32,occasion:34,occur:3,6,9,23,78,339,383,904,occurr:171,octet:48,odd:925,oeap:476,off:15,21,24,25,28,33,35,39,349,358,offer:21,24,40,892,offlin:14,25,928,offset:10,48,406,896,901,often:20,22,23,28,33,38,39,886,890,913,939,oid:28,43,904,910,oid_op:905,ok_as_deleg:3,23,ok_to_auth_as_deleg:3,23,okai:3,23,925,929,old:2,3,6,14,15,20,21,23,34,37,243,343,416,904,924,old_cod:415,416,old_princip:3,oldcc:905,older:14,23,904,917,oldest_kvno_to_keep:3,om_uint32:43,910,omit:11,22,28,39,404,702,703,896,900,920,onc:3,6,14,15,21,23,34,43,46,78,358,721,883,887,890,915,919,924,939,one:2,3,5,6,9,15,16,17,19,20,21,23,24,25,26,28,32,34,35,36,37,38,39,40,41,43,46,48,153,243,263,264,270,271,275,279,327,330,341,353,357,386,726,883,884,886,887,890,892,893,894,896,897,901,904,906,908,909,911,914,917,918,924,925,928,930,932,933,ones:21,25,34,890,909,925,onli:3,4,6,8,9,10,14,15,18,19,20,21,22,23,26,28,32,33,34,35,38,39,41,43,46,48,54,114,153,224,228,241,245,295,322,358,362,363,540,717,737,848,875,882,883,888,890,892,896,901,904,905,910,911,917,918,920,924,925,928,932,934,937,939,onlin:14,25,onlyrealm:14,20,onto:17,21,32,34,892,910,925,opaqu:48,286,833,904,open:6,21,23,24,46,48,50,303,313,315,339,384,741,757,887,901,904,905,921,928,openldap:3,5,23,24,30,892,905,openldap_ldapconf:20,opensc:21,openssh:28,38,openssl:21,37,892,904,openvis:3,905,oper:2,3,5,9,10,14,15,19,20,21,22,24,26,28,33,34,35,37,41,43,48,62,119,120,121,122,136,156,158,379,380,383,741,823,833,883,889,890,891,892,897,901,903,904,905,914,918,928,932,939,oppos:37,opt:46,229,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,931,optim:892,optimist:20,40,48,254,option1:21,option2:21,option:2,11,12,15,19,22,24,28,29,34,35,36,37,39,43,48,59,60,224,225,226,229,232,233,234,235,253,260,269,275,322,323,326,327,328,341,372,400,410,412,541,724,794,795,799,810,811,818,822,826,827,832,870,886,890,891,904,907,908,909,911,914,916,918,925,939,oracl:42,905,order:3,4,6,14,16,17,19,20,21,22,23,32,33,34,35,37,43,46,48,245,724,883,886,887,891,892,896,900,905,906,910,920,939,ordinari:14,890,904,939,ordinarili:2,15,245,org:5,21,22,23,42,890,891,894,904,905,922,938,939,organ:891,905,orig_hostnam:194,origin:3,14,21,23,39,43,46,892,905,910,osconf:891,osf:668,other:3,4,6,10,14,15,19,20,21,23,24,26,28,34,35,37,38,39,43,46,154,279,308,356,401,639,726,823,882,883,886,889,890,891,892,896,897,900,904,905,908,910,914,915,916,918,919,920,922,924,925,930,932,937,938,othernam:37,otherrealm:21,otherwis:3,6,14,15,20,21,23,29,33,34,36,37,39,43,49,52,54,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,95,96,97,98,99,100,102,103,104,105,106,107,108,110,111,112,113,114,115,116,117,118,120,121,122,124,125,126,129,130,134,142,150,153,157,158,162,163,164,166,170,172,173,174,175,177,178,180,181,182,183,184,185,187,189,192,193,195,217,224,235,236,238,248,260,261,264,265,266,267,271,272,273,274,275,276,277,278,279,280,283,284,285,286,287,288,289,290,294,295,296,298,299,317,319,321,322,323,324,325,326,327,328,329,330,332,334,335,336,339,342,344,345,346,347,351,352,353,354,355,356,357,358,359,360,361,371,372,373,382,385,387,388,389,391,392,394,395,397,398,399,400,401,410,883,892,897,905,909,916,925,928,929,930,932,otp:3,16,25,30,46,365,682,684,685,708,724,903,904,our:20,36,889,890,905,out:3,8,12,21,23,24,33,35,36,37,41,43,49,50,56,59,60,63,64,65,66,67,68,69,71,72,73,74,76,77,78,89,91,92,93,95,96,97,99,101,102,104,105,107,108,111,112,113,115,116,117,118,119,121,122,124,125,126,129,130,132,134,135,138,141,142,143,145,149,150,152,153,154,158,163,164,166,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,194,195,223,224,227,229,230,231,235,236,238,251,260,261,262,264,265,266,267,268,269,272,273,274,275,279,280,282,286,287,289,294,296,298,299,301,303,304,305,306,308,309,312,313,315,316,318,319,320,321,322,323,324,325,326,327,328,329,332,334,335,336,337,338,341,342,344,351,352,353,354,355,356,357,358,360,361,365,368,371,372,379,380,386,387,388,389,391,392,393,394,395,398,399,400,401,402,404,405,406,408,527,528,530,531,534,883,892,904,905,924,927,934,out_cr:224,225,226,372,out_flag:238,outaddr:172,outag:20,39,outauthdat:319,outbuf:223,324,325,326,327,outcc:134,outcksum:131,outcr:177,outdata:178,outfil:6,outgo:15,910,outlin:0,29,outprinc:182,outptr:186,190,output:3,6,9,15,20,23,26,34,41,43,48,99,100,101,102,103,107,117,119,120,166,181,224,279,287,288,289,290,296,349,356,358,361,401,852,861,883,894,904,906,907,909,928,929,931,934,939,output_cr:43,output_cred_handl:43,output_message_buff:43,output_nam:910,output_payload_buff:43,outreach:14,outsid:15,883,939,over:0,10,14,15,20,21,23,24,28,32,34,36,38,39,43,46,48,107,113,114,117,155,164,294,295,296,322,360,372,803,904,906,912,920,924,925,overrid:3,6,10,14,20,21,23,36,48,375,377,378,383,384,851,892,900,904,928,overridden:2,10,11,19,21,887,904,overview:889,overwrit:6,23,381,927,overwrite_cr:43,overwritten:20,813,own:0,3,15,20,21,23,24,25,34,38,378,907,909,910,921,924,925,932,938,owner:905,ownership:887,p27:42,pa_as_fresh:898,pa_config_data:896,pa_hardwar:917,pa_real:908,pa_replaces_kei:917,pa_typ:845,896,pa_type_list:908,917,pac:3,20,23,48,333,673,846,849,904,928,pac_client_info:338,340,packag:29,34,890,905,packet:20,25,36,327,904,917,pad:43,48,99,100,103,104,287,288,290,531,901,padata:831,832,908,917,padl:905,page:0,3,21,891,892,904,pair:6,20,21,26,827,pam:33,parallel:10,39,890,904,param:49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,paramet:5,6,10,20,23,28,35,36,43,46,48,169,229,320,322,338,340,892,893,896,903,904,910,914,917,932,parent:21,39,883,903,pars:3,15,28,43,45,46,48,235,260,264,267,278,353,357,365,368,889,896,part:14,21,23,26,32,41,199,264,267,278,283,341,356,381,809,819,831,869,883,888,896,897,901,905,909,910,920,932,939,parti:28,36,43,904,905,939,partial:14,19,46,901,particip:21,34,particular:2,11,14,16,17,19,20,21,37,43,46,315,890,892,905,924,925,particularli:14,17,25,39,924,931,partit:39,pass:14,20,21,28,36,43,99,100,102,103,228,250,270,271,275,279,280,282,287,288,289,290,322,365,368,377,378,379,383,384,875,890,892,910,919,928,932,passcod:657,passiv:25,passwd:5,23,33,881,905,932,passwd_phrase_el:790,859,password:3,4,5,6,9,10,11,14,15,16,17,19,20,21,22,24,25,26,28,29,32,33,34,35,36,37,39,40,43,48,233,245,258,613,615,705,706,707,725,726,883,888,903,904,908,912,923,925,930,932,938,939,password_changing_servic:3,23,password_expir:245,824,past:3,23,922,pasword:25,patch:23,path:4,5,8,20,21,22,23,25,28,29,34,39,356,890,892,894,904,932,939,pathnam:4,8,21,23,24,28,29,37,886,890,893,939,pattern:6,21,28,937,payment:905,pdf:0,pem:16,21,29,37,934,peopl:20,pepper1:107,pepper2:107,pepper:48,per:3,6,9,10,14,18,20,21,23,26,28,36,39,43,46,883,906,908,911,914,915,917,918,919,920,921,perfect:887,perform:3,4,5,6,12,14,19,20,21,22,23,24,25,26,34,37,38,39,43,46,62,91,250,254,258,356,360,372,379,380,383,412,433,833,883,904,905,914,915,916,925,perhap:3,14,20,23,24,period:6,8,14,17,20,21,23,24,35,925,928,permiss:3,15,18,19,20,23,34,43,137,147,159,883,904,905,925,permit:3,19,21,23,26,36,48,194,251,353,357,903,904,905,928,938,permitted_enctyp:21,26,persist:21,883,person:17,34,905,924,925,pertain:10,905,pgp:891,922,phase:932,phrase:881,physic:32,39,pick:20,25,37,890,pid:4,8,10,904,pid_fil:4,8,10,piec:35,265,pin:366,369,714,717,721,722,723,724,856,pipermail:922,pkc:21,726,pkcs11:21,904,905,pkcs12:21,pkinit:3,16,23,25,30,40,41,107,644,675,676,677,678,726,892,899,904,905,912,928,pkinit_allow_upn:20,21,pkinit_anchor:3,20,21,23,37,928,pkinit_cert_match:3,21,37,904,pkinit_dh_min_bit:20,21,pkinit_eku:21,pkinit_eku_check:20,21,37,pkinit_ident:20,21,37,pkinit_ind:16,20,pkinit_kdc_hostnam:21,37,pkinit_pool:20,21,pkinit_require_crl_check:20,21,pkinit_require_fresh:20,37,pkinit_revok:20,21,pkinit_san:21,place:2,8,14,15,21,26,28,32,33,37,39,43,44,46,48,107,117,229,264,267,279,296,361,373,401,813,852,892,894,901,907,915,927,932,938,placehold:889,891,plain:897,plaintext:116,528,plan:23,platform:24,871,882,883,890,891,892,904,pleas:0,15,20,724,922,plu:20,925,932,plug:905,pluggabl:21,28,904,909,912,915,920,plugin:3,20,22,889,892,902,903,904,905,920,plugin_base_dir:21,pnl:21,point:3,14,15,21,23,32,34,43,327,403,410,813,883,888,892,904,922,pointer:24,43,44,46,91,135,136,173,198,200,203,209,213,217,220,230,231,256,262,263,319,320,327,329,354,362,363,383,392,403,811,813,818,858,869,906,907,908,909,914,915,917,919,921,pol:3,19,23,polici:3,4,5,6,16,19,20,21,24,25,34,35,169,356,904,912,913,914,921,925,929,930,policy_nam:5,23,poll:4,8,20,23,904,pool:14,pop:32,popul:14,24,44,148,901,popular:34,port:3,4,7,8,10,12,15,20,21,23,34,36,41,44,48,62,328,519,521,903,939,portabl:883,portiion:905,portion:21,36,153,266,315,382,406,737,794,799,810,822,861,905,portmapp:23,portnum:10,pose:14,posit:6,19,28,35,871,900,posix:6,871,882,897,898,901,possess:37,925,possibl:3,5,6,14,15,17,20,21,22,23,24,25,26,32,34,35,37,38,39,43,46,48,93,166,224,726,886,887,892,904,905,908,909,917,922,925,937,post:48,883,922,postdat:3,19,20,23,267,925,928,929,potenti:14,32,34,46,888,power:20,24,25,39,904,practic:14,21,46,99,287,904,pre:0,16,20,22,43,48,91,260,326,327,356,360,361,372,377,845,894,897,904,905,915,928,pre_auth_typ:232,233,234,preauth:20,660,827,896,904,905,908,917,preauth_list:254,826,preauth_list_length:254,826,preauth_plugin:908,917,preauth_requir:908,917,preauthent:3,16,20,21,23,25,28,30,37,41,46,48,250,708,818,831,832,845,862,896,904,909,912,925,928,929,prebuilt:890,preced:10,14,21,39,900,932,939,precis:33,precomput:48,predefin:39,prefer:3,21,23,38,43,236,886,887,904,911,preferred_preauth_typ:21,prefix:20,21,39,48,341,890,892,904,910,931,932,preiniti:117,119,121,296,prepar:48,79,316,400,prepend:39,343,416,892,preprocessor:892,prerequisit:890,894,preselect:928,presenc:21,896,present:8,14,16,20,21,22,23,28,34,36,37,43,46,245,322,330,342,351,362,363,370,385,613,697,699,700,870,886,887,890,896,900,901,904,920,925,929,934,939,preserv:6,905,presid:905,pressvr:14,presum:887,prevent:2,3,19,20,21,23,25,26,29,40,327,516,517,887,904,905,915,924,928,previou:0,3,21,23,34,37,42,44,156,250,261,279,381,401,415,416,896,previous:3,6,23,43,48,890,904,prf:48,118,897,904,primari:3,4,7,8,9,14,17,20,21,23,24,31,35,38,39,41,43,48,145,883,904,906,915,919,921,922,927,928,933,937,939,primarili:24,55,935,primary_kdc:21,princ1:37,345,346,347,359,princ2:37,345,346,347,359,princ:3,6,15,21,49,50,91,92,93,94,385,779,780,781,782,783,784,785,786,897,princ_flag:6,princ_lockout:6,princ_look_ahead:932,princ_meta:6,princ_nam:37,927,princ_out:154,princ_stringattr:6,princ_tktpolici:6,princip:2,3,4,5,6,7,8,9,10,11,12,14,16,17,19,20,21,22,24,25,26,28,29,30,31,32,33,36,37,40,41,43,45,46,48,78,141,147,148,153,155,159,166,223,229,235,242,260,264,267,275,308,313,318,326,330,337,338,339,340,356,360,361,372,400,402,403,404,405,408,410,496,636,643,651,693,695,737,749,811,812,818,822,831,832,836,848,883,884,886,887,893,897,898,900,903,904,906,907,913,914,916,917,918,921,924,925,928,929,930,932,933,934,937,938,939,principal_databas:8,principal_nam:37,principal_out:341,342,principal_seq:37,principalnam:904,principl:696,princnam:25,35,40,46,883,princname_out:333,print:3,6,7,8,23,358,904,931,932,934,printabl:362,370,prior:6,8,14,20,21,23,39,41,43,136,265,905,909,priorit:39,prioriti:14,20,39,230,883,887,906,priv:48,904,privat:21,37,704,892,897,898,904,922,privileg:3,15,19,34,43,48,253,924,938,939,privsvr:339,340,privsvr_kei:337,338,prng:120,121,122,892,904,905,probabl:6,12,14,23,34,890,problem:14,23,327,887,904,922,proce:932,procedur:6,26,32,34,889,890,proceed:23,process:3,4,6,8,9,10,14,15,20,21,23,24,25,34,38,43,46,48,136,154,169,352,410,883,886,887,904,907,908,911,914,915,916,917,919,921,928,939,procur:37,905,produc:6,21,23,46,104,124,891,901,908,911,917,929,931,product:34,905,prof_no_rel:920,profil:15,18,20,21,48,136,385,883,886,887,889,893,904,905,912,profile_module_init:920,profile_module_init_fn:920,profile_releas:262,profile_tcl:905,profile_vt:920,profit:905,program:2,3,4,6,8,12,15,20,21,23,26,28,30,32,33,34,37,38,39,41,43,46,56,268,375,887,889,890,891,894,896,903,904,905,925,931,932,939,programm:931,programmat:46,progress:14,20,prohibit:3,23,905,project:0,687,892,904,905,909,939,promot:14,905,prompt2:358,prompt:2,3,5,6,23,34,46,48,260,358,705,706,707,708,856,858,888,904,908,924,925,930,932,prompter:245,260,263,275,349,856,858,863,prone:904,proof:48,925,propag:4,6,7,8,14,17,19,20,21,24,31,35,889,904,905,924,proper:12,23,37,356,890,properli:29,34,37,41,882,892,properti:21,923,propog:8,proponli:4,23,proprietari:36,protect:6,15,25,26,32,35,37,40,43,78,247,323,328,726,833,887,904,protocol:2,3,14,21,23,29,39,43,48,247,662,681,709,818,822,831,832,887,889,902,904,914,925,928,934,939,prototyp:889,909,prove:46,898,908,917,provid:0,3,4,10,15,21,22,23,24,26,28,29,32,34,37,38,39,41,43,46,98,122,229,356,369,410,882,883,890,892,904,905,907,910,913,916,920,924,932,939,provis:905,proxi:20,21,25,30,36,39,43,904,925,929,proxiabl:3,20,21,23,48,826,925,928,929,932,proxy_imperson:896,pseudo:48,889,pto:183,ptr:38,43,197,281,336,350,788,789,818,819,869,pty:889,905,publish:38,905,punctuat:3,21,23,34,930,purg:3,6,14,904,purge_mkei:23,purgekei:14,23,37,purpos:10,15,21,26,28,34,892,905,928,935,put:4,10,34,341,794,pw_expir:6,pwchang:20,pwd:890,pwexpdat:3,23,pwexpir:3,19,23,26,pwqual:28,904,912,pwqual_plugin:921,pwservic:20,python:29,894,904,qop_req:43,qop_stat:43,qualif:21,904,qualifi:3,15,19,21,23,939,qualify_shortnam:21,38,904,qualiti:21,28,904,912,923,queri:3,21,23,39,43,46,904,question:0,20,39,48,365,368,724,725,726,862,863,922,queue:20,905,quietli:927,quit:6,32,quot:3,6,23,341,402,404,884,quux:21,r13:6,23,r18:6,23,r_address:810,rabbit:39,radiu:20,36,904,randkei:3,14,23,26,34,37,904,random:3,6,14,15,20,21,23,25,34,48,897,901,904,random_data:124,randomli:2,26,randsourc:120,rang:928,rapidli:15,rare:24,37,884,886,rassen:905,rather:3,4,5,6,10,15,20,21,23,32,38,39,56,279,401,883,890,897,910,928,raw:20,890,rc2:474,rc4:20,26,904,rcach:43,71,85,265,320,322,887,rcache2:887,904,rcmd:21,rcommand:638,rcptr:265,rctmpdir:893,rctx:46,362,363,364,365,366,367,368,369,370,863,rdata_out:320,322,323,328,351,353,357,rdn:21,33,38,43,reach:20,21,24,164,312,901,react:243,read:3,5,6,9,11,20,21,22,23,34,35,37,46,48,250,260,262,316,349,368,410,892,900,917,920,924,929,939,readabl:15,21,32,169,884,886,888,904,reader:21,24,readi:6,34,readlin:892,readm:889,891,real:21,347,382,693,932,realiti:0,realloc:44,realm1:10,realm2:10,realm3:10,realm:3,4,5,6,7,8,10,12,14,15,16,19,22,24,25,26,29,30,33,34,36,37,38,40,43,44,46,48,49,50,59,60,91,92,93,94,122,153,214,230,235,251,260,264,267,278,279,284,339,341,342,347,356,385,386,400,401,404,497,694,697,698,699,700,702,703,713,781,782,783,784,799,807,811,819,822,831,832,848,851,852,854,855,869,883,892,893,896,897,898,900,903,904,912,919,921,924,925,928,932,937,938,939,realm_try_domain:21,realmlist:214,realmnam:37,46,realmsp:230,231,reason:14,17,21,24,28,33,39,339,882,896,905,924,925,932,reboot:20,34,888,rebuild:892,894,receiv:3,4,8,9,14,20,21,23,37,39,41,43,48,223,245,273,322,323,327,328,351,353,357,360,371,372,862,907,908,917,918,921,925,939,recent:2,6,17,20,25,26,37,48,887,898,904,925,recipi:810,905,recogn:3,20,21,37,41,928,937,recognit:904,905,recommend:5,6,15,17,20,21,23,32,34,39,40,43,890,891,892,922,925,927,recomput:136,reconf:889,record:6,10,21,23,33,34,38,39,887,897,900,901,904,recov:6,23,904,908,recurs:6,23,24,904,recv_hook:377,recvauth:360,372,red:905,939,redhat:904,redirect:21,34,redistribut:905,reduc:14,21,33,100,103,288,290,890,892,redwood:905,ref:5,23,refcount:904,refer:3,5,15,19,20,22,23,39,43,45,48,87,89,138,286,305,848,904,905,913,918,932,referenc:22,896,905,referr:20,21,39,230,231,338,340,386,680,689,713,896,904,911,925,referral_valid_until:847,referred_realm:847,reflect:23,34,100,103,136,158,262,288,290,322,323,328,353,357,897,898,reforward:925,refrain:910,refresh:15,43,896,904,refresh_tim:896,refus:12,14,34,regard:905,regardless:6,19,21,43,regener:894,regent:905,regexp:21,region:43,114,130,295,299,813,regist:4,21,23,28,39,905,912,939,registr:21,regress:890,regul:905,regular:14,21,34,37,43,932,regularli:17,39,reiniti:148,reject:12,15,16,20,21,34,166,615,925,reject_bad_transit:20,rekei:14,rel:20,21,48,884,890,896,932,relai:10,relat:4,6,20,21,22,28,29,35,37,39,169,812,904,905,relationship:21,918,releas:0,3,4,6,8,14,15,16,19,20,21,23,24,25,26,33,35,37,38,39,40,41,43,46,48,68,73,77,82,84,113,125,126,154,163,176,203,209,214,230,231,265,268,282,294,312,316,882,883,887,897,898,900,901,904,907,908,909,910,911,913,914,915,916,917,918,928,934,939,relev:34,38,78,195,897,reli:15,34,892,reliabl:24,relianc:21,relinquish:85,reload:23,remain:3,4,6,14,20,23,43,44,245,640,882,883,900,901,905,915,917,932,rememb:34,37,896,remot:3,4,7,15,20,23,33,38,43,48,62,64,169,223,322,323,328,353,356,357,379,380,520,521,889,904,924,925,932,938,939,remote_addr:44,64,82,356,remote_port:84,remotehost:935,remov:2,3,6,20,23,26,28,37,38,48,155,890,904,915,924,renam:3,23,892,904,915,rename_sect:920,render:14,890,renew:3,5,6,20,21,23,48,832,870,904,916,925,928,929,932,939,renew_lif:256,826,renew_lifetim:21,renew_til:811,819,870,896,renewable_lif:928,renprinc:3,rep:185,199,324,325,354,355,793,818,831,846,rep_cksum:847,rep_result:372,repeat:6,20,21,34,833,896,910,repl:354,replac:3,5,21,23,28,34,70,75,94,123,186,188,190,191,196,197,225,226,232,233,234,281,348,350,407,892,900,905,908,928,replai:21,43,48,78,320,322,323,328,351,353,356,357,516,517,861,883,885,893,899,903,904,939,repli:12,26,46,107,245,258,267,279,349,354,355,377,378,401,716,831,851,852,856,897,904,908,917,928,replic:8,34,replica:4,6,7,8,9,14,15,17,20,21,23,31,32,35,41,889,904,replica_datatran:7,34,903,replica_datatrans_hostnam:23,replica_dumpfil:8,replica_host:7,replicahostnam:8,reply_out:852,report:6,38,889,904,922,928,934,repositori:894,repres:3,21,34,43,158,871,882,886,897,represent:21,43,48,341,342,395,403,404,799,818,831,832,869,882,896,900,905,representaton:793,reproduc:905,req:21,26,37,245,326,327,356,499,832,req_pac:253,request:3,4,6,8,9,10,14,15,16,19,20,21,22,23,24,25,28,33,35,36,37,38,40,43,46,48,153,166,195,223,224,229,235,241,253,260,267,276,277,327,356,375,400,498,500,501,614,662,681,738,745,746,793,795,818,832,840,884,886,887,896,897,898,904,907,908,910,916,917,922,925,928,932,934,939,request_fini:908,request_init:908,request_tim:868,requested_principal_nam:847,requir:3,4,6,8,9,12,14,15,16,20,21,22,23,24,25,26,28,32,34,35,36,37,38,39,40,43,46,48,98,112,116,117,120,236,241,247,248,320,322,323,328,351,353,357,539,724,848,863,882,883,890,891,892,894,897,904,905,907,910,917,920,925,930,938,939,require_auth:3,16,904,requires_hwauth:3,23,917,requires_preauth:3,5,14,23,25,35,37,40,requires_pwchang:5,23,requisit:894,research:905,resembl:726,reserv:895,905,reset:3,9,23,35,46,157,383,904,resid:15,39,46,888,905,937,938,residu:21,39,152,315,883,887,918,920,939,resiz:403,resolut:15,33,38,43,230,904,932,resolv:15,33,48,260,315,883,892,904,929,932,resourc:43,46,890,902,904,respect:3,11,34,82,84,224,341,884,905,910,924,respond:4,48,364,365,366,367,368,369,717,724,725,726,862,863,904,917,respons:3,4,23,37,40,46,85,166,229,245,279,354,401,498,500,538,560,725,745,747,793,832,868,904,905,908,911,917,928,935,939,rest:28,892,restart:12,14,19,20,23,24,34,37,41,restor:6,17,904,restrict:3,5,14,19,21,23,48,224,905,914,916,928,932,restrict_anonymous_to_tgt:20,37,restructuredtext:0,resubmit:928,result:0,14,15,21,23,37,39,40,41,43,46,48,99,102,107,117,124,144,156,158,189,195,228,287,289,296,318,372,373,400,402,403,416,892,896,897,901,904,905,906,911,916,917,918,925,932,934,result_cod:166,379,380,result_code_str:166,379,380,result_str:166,169,379,380,resum:23,resync:4,9,23,904,resynchron:9,ret:46,344,ret_as_repli:232,233,234,ret_princ:386,ret_valu:59,60,retain:2,3,14,20,23,905,914,916,938,retir:13,23,904,retransmit:892,retri:20,36,38,39,retriev:3,6,24,41,43,44,46,48,158,271,308,363,372,397,400,862,904,905,934,return_padata:917,return_pwd:358,retval:49,50,51,53,55,56,61,62,63,64,65,66,67,68,69,71,72,73,74,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,120,121,122,124,125,126,129,130,132,133,134,135,137,139,141,142,145,147,148,149,150,151,152,153,155,156,157,158,159,160,161,162,163,164,165,166,167,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,236,238,248,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,285,286,287,288,289,290,294,295,296,298,299,300,301,302,303,304,306,308,309,311,312,313,314,315,316,317,319,320,321,322,323,324,325,326,327,328,329,330,332,334,335,336,339,341,342,344,345,346,347,349,351,352,353,354,355,356,357,358,359,360,361,370,371,372,373,374,375,379,380,381,382,384,386,387,388,389,391,392,393,394,395,397,398,399,400,401,402,403,404,405,406,410,909,reus:23,rev:6,23,24,revers:6,15,21,23,33,43,905,929,review:891,revis:904,905,revoc:20,21,revok:20,21,35,rfc4120:29,rfc:14,20,21,39,43,48,318,379,380,408,438,439,442,443,444,446,447,454,455,456,457,458,459,460,461,506,535,537,595,652,655,656,657,658,659,660,661,663,664,665,666,668,669,670,671,674,675,677,679,684,687,689,691,724,887,896,897,898,901,904,908,910,rhost:223,ricciardi:42,richard:905,ride:20,right:5,19,20,23,100,103,288,290,813,895,901,905,risk:14,26,30,46,rkt:11,rlen:91,92,93,94,rlogin:932,rnd:38,roam:21,robbi:939,robin:15,robust:904,rock:908,917,roll:23,rollback:14,rollov:6,23,root:8,12,14,15,17,19,20,21,32,34,888,892,924,932,937,938,939,rotat:26,38,round:40,904,917,rout:34,routin:21,856,royal:905,royalti:905,rpath:890,892,931,rpc:20,21,23,43,48,611,889,904,905,rpcbind:23,rsa:37,472,475,476,477,905,928,rst:894,rtime:832,rule:3,15,19,21,23,28,38,39,43,154,932,934,937,938,run:3,4,6,8,9,10,12,14,15,20,21,23,24,26,28,32,33,34,37,39,41,883,890,891,892,894,903,904,927,929,932,939,runstatedir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,runtim:903,s2kparam:48,s2kparams_out:229,s4u2proxi:43,896,904,s4u2self:43,338,340,904,934,s4u:904,s4uself:20,s_address:810,safe:28,48,727,882,904,safer:924,safest:925,sai:887,sake:932,sale:905,salt:2,3,6,11,15,20,23,25,48,125,126,390,826,904,salt_out:229,salt_type_afs_length:775,salt_type_no_length:775,salttyp:6,20,26,371,salttypep:391,sam:682,684,685,904,samba:28,904,same:3,4,5,10,12,15,19,20,21,23,24,28,36,39,43,52,53,91,101,105,107,136,138,151,155,171,180,228,250,270,271,275,279,305,345,346,347,359,385,833,883,887,892,904,909,910,924,928,932,934,sampl:12,15,22,34,889,905,924,925,932,935,san:20,21,904,sandia:905,sasl:3,5,20,22,23,43,904,sasl_authcid:3,sasl_authzid:3,sasl_mech:3,sasl_realm:3,satisfactori:25,satisfi:890,save:37,40,66,83,523,524,897,904,917,sbin:8,12,34,892,903,sbindir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,scalar:897,scenario:14,904,schedul:14,23,schema:22,24,scheme:39,schneier:904,sclient:12,923,926,sclogin:20,scope:5,23,screen:925,screensav:925,script:3,4,10,23,34,889,890,892,904,search:5,20,21,23,38,48,151,153,195,224,313,883,890,901,904,927,933,search_scop:5,23,searchscop:5,23,sec:48,799,822,884,second:3,10,20,21,23,28,36,37,39,43,44,52,53,105,153,223,228,266,267,319,345,346,347,358,359,382,383,385,406,731,794,810,812,832,861,871,882,884,887,896,897,900,901,909,910,925,928,932,939,second_ticket:812,832,896,secondari:34,secret:3,20,21,36,43,46,836,924,section:3,10,19,22,23,28,33,34,35,37,39,41,43,48,119,318,408,595,669,670,671,887,890,891,896,897,901,904,920,921,932,937,sector:6,23,secur:3,7,14,15,20,21,23,25,30,31,34,37,39,41,43,46,250,322,559,888,889,904,905,922,925,939,securecooki:897,securid:657,904,sed:892,see:14,15,17,22,23,24,26,28,32,34,35,36,39,43,46,97,99,100,102,103,108,113,114,120,130,131,168,229,262,287,288,289,290,294,295,299,318,356,390,400,408,409,410,595,724,883,884,887,888,889,890,892,894,895,896,904,905,906,907,908,909,911,912,913,914,915,916,917,918,919,920,921,922,924,925,seed:122,131,328,409,901,seed_length:131,409,seen:887,segment:39,select:6,14,21,23,28,43,46,48,117,296,356,366,883,892,904,910,912,928,932,937,self:21,sell:905,semant:46,semfiajf42:20,send:0,4,15,20,21,23,25,26,32,34,41,48,229,245,322,360,372,377,887,889,892,904,922,924,928,939,send_hook:378,sendauth:12,34,48,sender:322,323,328,353,357,810,sensit:250,sent:6,20,23,25,36,37,41,43,322,372,378,852,887,890,897,904,917,925,sentenc:34,separ:0,3,5,6,10,16,19,20,21,22,23,24,25,28,39,50,341,343,416,717,891,892,897,904,910,920,924,939,seq:861,seq_numb:794,799,seqnumb:69,74,sequenc:25,37,48,66,78,80,83,322,323,324,328,353,355,356,357,516,523,794,799,861,888,896,897,900,910,sequence_count:859,sequenti:48,312,801,seri:48,901,serial:9,43,904,serv:4,10,21,23,904,server1:5,23,server:2,3,4,5,6,7,8,9,10,12,16,18,20,21,22,23,24,25,28,29,30,31,34,36,37,38,39,43,46,48,159,166,223,224,264,267,330,337,338,339,340,356,372,379,380,410,499,612,650,716,746,793,811,812,818,822,832,869,883,886,887,889,893,896,903,904,905,906,912,913,925,931,932,934,935,937,server_kei:337,338,server_port:12,server_str:169,serverauth:21,servic:2,3,5,8,10,12,15,16,19,20,21,22,24,28,29,31,32,33,34,43,48,166,224,235,245,260,264,267,326,327,360,379,410,638,639,640,724,864,883,887,889,896,904,905,906,911,919,925,928,934,937,939,service1:934,service2:934,service_loc:919,service_nam:928,service_passwd:5,23,sesam:46,687,session:3,14,15,21,23,33,34,43,46,48,224,318,322,327,351,408,435,436,799,811,812,818,819,883,887,925,929,934,939,session_enctyp:3,23,set:0,3,4,5,6,14,15,16,18,19,20,21,22,23,24,25,26,28,29,31,32,33,34,35,37,38,39,40,41,43,44,46,48,62,68,69,73,74,77,78,98,102,122,145,153,154,161,164,203,209,224,229,253,279,280,286,289,303,315,322,323,328,349,351,353,356,357,358,366,370,374,384,401,403,404,405,416,541,717,733,851,852,862,883,884,887,892,904,907,910,917,918,924,925,927,928,929,932,938,939,set_cooki:904,917,set_str:23,26,36,37,setstr:3,16,setuid:41,904,939,setup:23,34,122,890,904,sever:3,15,16,20,21,23,24,37,39,883,889,890,892,896,909,939,sfu:672,sha1:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,sha256:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,sha2:20,904,sha384:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,sha:14,20,904,shall:905,share:0,14,21,23,28,46,327,892,909,910,920,924,sharealik:905,sharp:19,she:925,938,shell:3,5,23,34,41,904,924,925,931,937,shorter:21,shortest:192,shortli:33,924,shortnam:21,904,should:0,2,3,4,5,6,10,12,14,15,17,20,21,22,23,24,25,26,28,29,32,33,34,37,38,39,43,46,71,85,144,152,223,245,249,255,269,279,306,315,322,324,327,339,356,358,362,363,401,726,846,851,852,871,882,883,884,888,890,892,896,898,904,905,906,908,909,910,914,915,916,917,919,920,921,924,925,928,932,934,939,show:2,6,20,41,856,883,894,903,925,929,shown:20,21,883,shrubberi:42,shutdown:24,sick:905,sid:21,633,634,side:23,43,360,372,887,sighup:10,41,sign1:43,sign2:43,sign:3,19,20,21,23,32,37,41,43,48,882,891,898,900,928,939,sign_onli:43,signal:10,signatur:408,471,472,477,891,910,920,signedpath:3,20,23,signific:25,35,silent:929,similar:6,21,22,29,43,92,105,113,114,126,129,130,246,294,295,296,298,299,323,326,338,340,342,346,361,403,404,413,415,904,909,919,925,932,similarli:15,341,726,925,simpl:5,12,17,23,107,417,883,887,simplest:28,43,883,890,simpli:28,36,37,40,43,46,725,890,910,924,925,simplifi:251,904,simul:932,simultan:833,sinc:3,12,14,15,17,21,22,23,37,48,327,721,871,882,896,910,917,938,939,singl:0,3,14,15,20,21,23,24,26,28,32,34,37,39,40,43,46,48,189,318,342,405,696,883,892,904,910,917,932,siphash:901,site:15,23,34,39,904,925,928,938,situat:14,20,24,28,39,934,size:9,20,21,23,24,37,41,48,97,98,100,103,114,116,130,186,190,288,290,295,299,358,403,405,813,892,900,901,size_return:358,size_t:95,96,98,100,103,104,112,114,116,118,130,131,168,170,186,187,190,191,192,193,280,288,290,295,299,334,336,366,371,394,395,409,sizeof:43,46,920,skei:20,812,skew:48,267,353,357,917,928,skip:22,23,37,410,412,892,slack:39,slash:341,939,slat:909,slightli:892,slot:11,21,901,slotid:21,slower:14,24,small:56,smaller:21,900,smard:21,smart:20,21,904,sms:19,smtp:637,sname:386,934,sni:904,sock_dgram:919,sock_stream:919,socket:20,21,36,48,372,903,919,soft:904,softwar:14,15,21,24,25,28,42,46,892,905,922,solari:31,890,892,904,solaris9ab:42,sole:21,28,solut:34,some:2,3,6,14,20,21,23,24,28,29,31,34,37,38,39,41,46,48,99,122,151,154,287,386,752,883,884,887,889,890,891,892,893,901,903,904,909,910,913,920,922,924,925,928,937,939,someon:17,21,34,924,925,someth:12,14,20,38,887,sometim:23,25,38,928,somewhat:37,887,song:905,sophist:46,sort:38,sourc:0,10,22,23,28,34,39,42,43,120,122,890,891,892,902,905,909,913,920,922,932,source_cache_nam:932,source_us:932,southern:905,space:3,16,20,24,37,38,56,99,102,117,119,121,287,289,296,304,343,358,403,416,884,891,spake:20,21,25,30,904,905,spake_preauth_group:20,21,40,spake_preauth_ind:20,spake_preauth_kdc_challeng:20,40,sparc:904,spars:901,spawn:4,special:20,23,28,35,43,404,643,701,883,904,905,910,928,specif:3,4,6,8,10,14,18,19,20,21,23,24,26,34,39,43,48,49,56,155,313,315,360,361,406,726,883,884,886,892,894,901,904,905,909,914,919,925,specifi:3,4,5,6,7,8,9,10,11,14,15,16,18,19,20,22,23,28,29,34,36,37,39,43,46,48,92,93,99,100,102,103,113,125,129,224,227,229,235,260,264,267,287,288,289,290,294,298,308,313,316,322,323,328,341,342,353,356,357,372,380,410,738,883,887,892,897,898,904,910,917,925,927,928,929,930,931,932,933,934,939,speed:22,25,sphinx:894,sphinx_arg:894,spi:910,split:3,39,904,spnego:904,905,910,spnego_mech:905,spoof:21,25,39,sprecif:891,spuriou:904,sqlite3:6,sqlite:6,squar:20,21,28,src:22,148,890,892,894,905,src_ctx:179,src_name:43,srcdir:894,srv:21,33,34,39,904,srvtab:11,ss_lib:892,sscope:5,23,sserver:1,935,ssh:15,33,925,938,939,sshd:21,sshing:939,ssl:29,37,sspi:904,stabl:904,914,915,916,921,stage:14,897,915,stai:3,15,stale:0,21,26,stamp:6,9,stand:34,standalon:8,41,904,standard:3,6,9,14,20,23,37,41,43,886,904,905,931,start:0,3,4,6,8,10,14,15,19,20,21,23,24,26,31,37,41,48,811,819,832,870,883,888,890,898,904,925,932,start_realm:896,start_tim:235,260,275,928,starttim:870,896,startup:34,904,stash:3,5,10,14,20,22,34,41,885,903,stash_fil:6,23,stashfilenam:5,6,23,stashsrvpw:3,20,22,23,state:6,9,14,20,34,46,48,78,99,100,102,103,287,288,289,290,833,897,903,904,905,906,908,909,911,914,915,917,918,919,920,921,statement:905,statu:3,823,904,905,907,910,929,932,934,stderr:20,939,stdin:349,stdlib:920,stdout:41,349,stduser:23,step:6,14,22,23,34,37,932,steve:939,still:3,4,6,10,14,20,21,23,32,33,34,35,39,148,269,890,904,928,932,934,stime:822,stockholm:905,stolen:925,stop:4,10,24,909,storag:46,48,57,58,82,84,159,170,187,192,193,280,358,371,395,883,store:2,3,4,5,6,8,14,15,17,20,21,22,23,24,26,34,37,46,48,80,99,100,102,103,224,235,250,287,288,289,290,322,323,327,328,353,356,357,358,403,410,544,717,826,883,886,887,890,893,896,901,904,921,925,928,929,932,934,str:43,strategi:35,strcmp:920,strdup:920,stream:8,12,20,34,36,43,strength:904,strengthen:14,strict:905,strictli:34,string2kei:14,string:3,5,6,15,16,19,20,21,23,25,26,28,34,36,37,39,43,46,48,101,166,169,192,228,229,258,264,267,278,343,362,370,376,379,380,413,414,415,416,724,725,726,807,812,823,854,855,875,883,884,887,892,904,905,907,909,910,917,918,920,928,932,strip_realm:20,36,strlcpy:905,strlen:43,46,strong:16,122,stronger:14,16,21,26,strongest:26,122,strptime:905,struct:43,48,51,262,269,791,793,794,795,796,797,799,802,803,804,808,809,810,811,812,813,815,817,818,819,820,822,826,827,828,831,832,833,834,835,836,840,845,846,847,848,849,855,856,859,860,861,862,864,865,866,867,868,869,870,872,873,875,876,877,880,881,914,920,structur:43,46,47,48,92,100,103,135,156,169,173,182,212,221,237,240,241,242,243,244,245,249,252,253,254,255,257,258,259,269,275,280,282,288,290,319,321,331,342,352,353,362,365,368,372,386,410,412,417,533,791,797,809,812,813,822,849,869,876,882,908,909,914,916,917,919,studio:904,style:3,21,23,39,413,414,415,633,635,sub:5,21,23,889,subcommand:14,subdirectori:21,28,889,894,903,subdomain:39,937,subject:0,20,21,23,37,905,subjectalternativenam:21,subjectaltnam:37,subjectkeyidentifi:37,subkei:48,80,322,351,356,794,799,sublicens:905,submit:26,43,subprocess:10,subregion:43,subschema:22,subscrib:922,subsect:16,20,21,22,24,25,28,29,35,37,40,subsequ:9,10,14,24,136,275,279,401,905,subsess:26,327,436,subset:39,889,892,substanti:905,substhtml:894,substitut:21,34,37,905,subsystem:892,subtag:21,subtre:3,5,20,22,23,subtree_dn_list:5,23,succe:20,21,34,43,46,410,succeed:12,34,success:3,6,8,20,23,24,25,35,46,49,50,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,124,125,126,129,130,132,133,134,135,137,141,142,144,145,147,148,149,150,152,153,155,156,157,158,159,161,162,163,164,166,167,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,236,238,248,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,286,287,288,289,290,294,295,296,298,299,300,301,303,304,306,308,309,312,313,314,315,316,319,320,321,322,323,324,325,326,327,328,329,330,332,334,335,336,339,341,342,344,349,351,352,353,354,355,356,357,358,360,361,371,372,373,374,375,379,380,381,382,386,387,388,389,391,392,393,394,395,397,398,399,400,401,402,403,404,405,406,410,412,616,823,887,908,911,921,932,934,successfulli:3,6,12,23,35,43,46,245,412,851,852,sudan:905,sudden:20,suffici:3,5,14,23,24,892,suffix:21,28,38,43,892,904,939,suggest:0,245,suit:34,889,890,892,904,suitabl:6,890,892,904,905,925,summar:929,summari:8,9,sun:905,suncc:892,sunw_dbprop_en:23,sunw_dbprop_master_ulogs:23,sunw_dbprop_slave_pol:23,sunwaadm:42,supersed:10,14,supervisor:10,supplement:20,suppli:3,11,43,46,48,223,245,258,262,267,276,277,278,328,339,369,370,383,721,722,862,892,908,909,917,support:3,4,6,8,10,11,20,21,22,23,24,25,26,37,39,40,43,46,48,153,161,247,253,375,383,384,539,742,883,885,889,890,891,892,896,897,901,904,905,908,909,910,917,922,928,supported_enctyp:14,20,26,34,904,suppos:925,938,suppress:3,6,20,23,892,904,927,932,934,sure:3,5,12,14,15,22,23,26,33,41,924,925,928,surpris:14,surround:28,surviv:20,883,susec:822,swap:34,39,sweden:905,swig:905,symbol:6,341,887,890,891,894,903,909,910,symmetri:20,synchron:9,14,15,21,24,34,41,48,271,400,716,904,917,syntact:21,syntax:20,21,37,904,synthes:378,851,synthet:377,896,syria:905,sysadv6:42,sysconfdir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,syslog:20,21,34,909,system:3,6,14,15,19,20,21,23,24,29,32,33,34,35,36,37,38,41,43,46,48,56,122,136,147,169,282,379,380,382,393,680,683,686,862,883,888,889,890,891,904,905,909,918,922,924,925,927,928,938,939,systest:3,23,t_mddriver:905,tab:3,6,23,341,904,tabdump:26,904,tabl:3,6,23,48,276,305,306,311,356,360,410,836,886,889,891,892,894,901,903,904,929,tabular:6,904,tag:20,21,34,896,901,tail:34,take:10,14,19,20,21,23,25,26,28,32,39,41,43,46,91,124,126,322,373,717,813,884,901,904,906,915,924,925,932,taken:6,14,39,245,887,901,talk:887,tamper:43,tape:32,tar:890,891,target:19,21,34,43,883,896,904,target_nam:43,target_princip:19,target_principal_nam:932,target_us:932,target_user_login_nam:932,task:14,46,91,tcl:890,892,tclpath:892,tcp:8,10,12,15,20,21,23,29,34,37,39,279,401,904,919,team:922,teardown:890,technet:42,techniqu:40,46,technolog:895,905,939,tekniska:905,telegraph:905,telephon:905,tell:4,10,890,924,925,931,telnet:21,638,932,temp:21,templat:889,temporari:3,21,23,34,37,886,887,903,904,939,temporarili:3,ten:33,925,tend:15,term:3,14,23,25,26,37,41,725,883,886,904,905,908,917,934,termin:4,10,48,173,195,220,230,231,240,261,322,349,351,358,363,403,889,920,932,ters:3,23,test1:3,23,884,test2:3,23,884,test3:3,23,884,test4:884,test:3,9,10,12,14,21,23,37,48,889,892,894,904,905,928,935,test_html:894,testdir:41,testus:3,23,texinfo:0,text:6,23,28,36,37,46,169,362,813,822,856,897,931,tgt:3,14,20,23,26,37,46,48,220,339,340,896,897,904,925,932,than:3,4,5,6,10,12,14,15,19,20,21,23,24,25,26,28,32,35,37,38,39,43,56,230,279,372,401,883,887,890,897,900,901,904,908,910,924,928,thei:3,6,9,14,15,20,21,23,28,33,34,37,38,39,41,43,46,229,322,372,717,833,882,883,886,890,892,896,904,917,924,925,936,939,them:3,14,15,20,22,23,24,25,29,32,34,37,39,41,46,82,84,253,327,341,400,717,883,890,892,904,905,909,910,920,925,927,939,themselv:6,23,theodor:905,theori:905,therebi:938,therefor:22,23,25,39,896,917,thereof:905,thi:0,2,3,4,5,6,8,9,10,11,12,14,15,17,19,20,21,22,23,24,25,26,27,28,32,33,34,35,36,37,38,39,40,41,43,46,48,49,50,55,57,58,59,60,61,62,67,68,69,71,72,73,74,76,77,78,81,82,84,85,86,87,88,89,92,93,98,99,100,101,102,103,104,105,107,113,114,116,117,119,120,122,124,125,126,129,130,133,136,137,139,141,144,148,150,151,153,156,157,158,159,167,169,171,172,173,174,175,177,178,180,181,182,183,192,194,195,198,199,200,201,202,203,205,206,207,208,209,212,215,216,221,228,235,236,241,243,245,246,252,253,254,258,260,261,262,264,265,266,267,270,271,272,275,276,277,278,279,287,288,289,290,294,295,296,298,299,306,315,318,320,321,322,323,324,326,327,328,330,331,337,338,339,340,342,349,352,353,354,355,356,357,358,360,361,365,368,370,372,373,375,377,379,380,382,383,384,386,393,397,398,400,401,403,404,406,408,410,412,413,415,714,715,716,717,721,722,723,725,818,836,870,871,882,883,887,888,889,890,891,892,896,897,901,902,903,904,905,906,908,910,912,914,915,916,917,918,920,921,922,924,925,927,928,929,931,932,934,938,939,think:38,909,924,third:21,28,36,37,896,904,905,939,thorough:39,those:3,6,14,15,19,21,23,25,26,34,39,43,46,892,894,900,904,905,908,910,913,914,917,934,938,939,though:14,890,925,thousand:24,thread:24,833,883,892,904,threadsaf:285,three:14,24,26,35,39,40,372,896,904,925,939,threeparamopen:775,through:15,16,20,21,23,24,28,29,33,34,35,39,46,230,282,383,384,412,896,901,904,915,924,925,throughput:20,24,thu:23,887,892,932,ticket:2,3,5,6,12,14,15,16,19,20,21,22,26,28,33,34,35,36,37,38,39,41,43,46,48,153,159,183,195,223,229,235,247,260,264,267,319,327,330,339,356,360,361,372,540,543,546,645,731,746,795,799,809,811,812,818,819,831,832,869,870,872,883,884,896,904,907,908,916,917,922,923,924,927,928,929,932,934,935,938,939,ticket_authdata:195,ticket_flag:5,23,812,896,ticket_info:810,ticket_lifetim:21,33,tied:915,tightli:14,28,32,888,till:832,time:0,2,3,5,6,9,10,14,15,19,20,21,22,23,24,26,28,34,35,36,37,39,41,43,44,48,136,158,224,228,235,245,260,275,353,356,357,395,721,738,739,794,810,811,812,818,819,832,836,870,882,883,885,887,888,892,893,896,897,901,903,904,905,910,916,924,925,928,929,932,939,time_offset:10,time_rec:43,904,time_req:43,time_t:6,871,882,timeofdai:406,timeout:14,20,36,timeret:393,timestamp:6,11,14,21,25,37,40,48,66,83,322,323,328,337,338,339,340,353,357,393,517,524,659,810,836,840,861,871,882,886,887,896,897,898,900,901,904,917,929,timestampp:392,titl:889,905,tkt:812,tkt_flg_anonym:775,tkt_flg_enc_pa_rep:775,tkt_flg_forward:775,tkt_flg_hw_auth:775,tkt_flg_initi:775,tkt_flg_invalid:775,tkt_flg_may_postd:775,tkt_flg_ok_as_deleg:775,tkt_flg_postdat:775,tkt_flg_pre_auth:775,tkt_flg_proxi:775,tkt_flg_proxiabl:775,tkt_flg_renew:775,tkt_flg_transit_policy_check:775,tkt_life:259,826,tktpolici:3,5,23,tls:22,tlyu:3,23,tmp:3,15,21,34,887,893,903,925,932,939,tmpbuild:890,tmpdir:887,939,tmppolici:5,23,todd:905,todo:924,togeth:15,token:16,20,21,46,365,593,715,716,717,719,722,723,899,904,910,917,928,token_flag:867,token_id:865,token_len:43,tokenid:724,tokeninfo:366,724,864,toler:21,tom:3,too:3,23,56,100,103,119,267,288,290,304,tool:6,23,889,891,904,909,toolkit:889,top:10,39,883,890,891,894,top_srcdir:894,topic:0,30,34,topolog:4,tort:905,tortiou:905,total:20,25,901,928,932,toward:0,23,tr_content:876,tr_type:876,trace:48,875,904,939,trace_log:41,track:3,6,9,23,35,887,922,trademark:905,tradit:6,35,traffic:29,trail:20,38,932,trailer:43,48,533,transact:24,939,transcript:897,transfer:4,37,transform:892,transit:20,21,24,356,536,545,662,681,819,876,925,928,929,934,transitori:14,translat:21,56,904,transmiss:17,transmit:23,43,279,401,904,917,transpar:939,transport:23,39,279,401,travers:6,23,treat:3,21,36,38,43,54,339,347,695,871,896,928,934,treatment:39,tree:0,22,23,24,34,891,892,894,910,913,920,tri:20,21,25,44,356,410,904,911,trigger:887,trillium:15,32,925,trim:99,287,trip:40,904,917,tripl:14,20,26,904,trivial:25,904,troubl:42,troubleshoot:30,34,true_principal_nam:847,truncat:901,925,trust:20,21,29,37,43,268,928,tryagain:908,tty04:20,tty:5,23,tune:22,39,tupl:3,23,turn:8,21,24,33,35,40,349,358,892,932,twice:3,23,24,34,896,915,924,930,two:3,18,20,21,23,24,26,28,34,35,37,38,48,53,358,884,896,897,900,904,906,910,918,925,928,932,txt:6,34,39,type:2,3,5,6,10,15,16,21,23,25,28,30,32,34,38,39,46,48,95,98,99,100,102,103,104,108,112,113,114,115,116,120,124,125,126,129,130,151,152,153,161,163,184,189,195,223,224,229,280,287,288,289,290,294,295,298,299,308,309,313,315,328,330,332,386,417,495,536,642,666,736,742,786,799,807,813,818,840,842,845,854,855,869,871,876,877,882,886,890,893,896,897,898,900,901,904,906,908,909,910,913,914,915,916,917,918,919,920,921,924,925,928,929,932,934,938,939,typedef:43,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,typic:4,15,20,21,26,33,38,39,43,46,98,253,894,903,906,908,909,914,915,917,921,928,934,u2u:934,ubuntu:42,904,ucb:932,udp:10,15,20,21,29,39,279,401,904,919,udp_preference_limit:21,uid:21,43,883,887,903,932,938,939,uid_t:43,uidnumb:883,uint16_t:878,uint32_t:871,879,882,uint8_t:844,uint_max:755,756,774,ulog:20,23,umich:905,unabl:17,21,23,unalloc:280,unam:28,unambigu:245,unansw:863,unauthent:32,unavail:23,34,39,unchang:3,14,15,932,unclean:24,uncommon:887,uncondition:228,892,unconfigur:39,894,undefin:932,under:3,5,6,10,20,21,22,23,38,155,159,887,890,901,904,905,underli:43,underneath:22,underscor:21,905,understand:46,undertaken:0,unenc_authdata:832,unencapsul:904,unencrypt:32,353,799,809,831,832,unescap:6,unfinish:917,unicod:905,unifi:0,unimpl:909,unimport:896,uninterrupt:14,uniqu:3,15,43,48,265,410,639,641,883,910,unit:884,892,905,925,univers:905,unix:6,15,20,21,28,31,36,43,909,910,920,unkei:46,unknown:12,38,41,611,896,934,unless:2,3,6,11,14,19,20,21,23,26,28,32,34,43,313,383,410,412,887,888,904,918,932,936,unlik:14,40,883,887,904,925,unlimit:905,unlink:6,23,unlock:23,35,904,unlockit:3,20,23,24,unmodifi:905,932,unnecessari:23,unpack:891,unpars:43,48,403,405,unpleas:14,unport:905,unprint:3,23,unqualifi:33,unquot:6,unrecogn:892,unrestrict:32,888,unser:43,unset:43,48,171,939,unsign:91,92,93,94,97,111,116,120,279,309,358,401,403,405,791,797,800,804,815,834,839,843,845,877,882,unspecifi:21,939,unstabl:915,unsuccess:37,unsupport:37,892,unswapp:883,untest:892,until:3,6,14,21,23,43,882,883,887,892,901,904,925,untrust:43,939,unus:149,265,349,372,904,unusu:28,37,unwrap:43,48,updat:2,4,6,8,9,14,20,21,22,24,26,34,35,99,100,102,103,224,287,288,289,290,683,686,892,897,904,913,922,update_princ_encrypt:14,23,update_rel:920,upgrad:21,23,26,34,39,upn:20,21,347,632,634,693,904,upon:6,8,23,892,932,upper:3,19,23,39,930,uppercas:21,918,939,upstream:23,892,904,upstreamhostnam:23,uri:3,5,20,21,23,33,34,39,904,url:20,24,29,39,usa:905,usabl:48,usag:20,21,37,43,99,100,102,103,108,113,114,129,130,287,288,289,290,294,295,298,299,833,882,897,898,931,932,usc:932,use:0,3,4,5,6,7,8,14,15,16,20,21,22,23,24,25,26,28,29,33,34,35,36,37,38,39,40,41,43,46,48,55,78,105,122,223,236,268,275,313,326,341,356,372,386,400,403,410,851,852,870,882,887,889,890,891,892,894,896,900,903,904,905,906,907,908,909,910,913,917,920,921,922,924,925,928,931,932,934,938,939,use_mkei:14,23,usec:799,810,822,861,used:2,3,4,5,6,7,8,9,10,11,12,14,15,16,18,19,20,21,22,23,24,25,26,28,34,36,37,38,39,40,41,43,46,56,81,98,100,103,120,121,129,144,223,224,227,228,229,235,241,247,248,254,258,260,264,267,277,288,290,298,313,322,323,324,326,327,328,341,342,349,353,356,357,372,400,410,412,726,811,833,842,852,856,871,882,883,886,887,888,889,890,896,897,900,901,903,904,905,907,908,909,910,911,917,920,922,925,927,928,929,930,931,932,934,936,937,939,useful:8,9,25,26,33,39,69,74,883,887,892,905,922,931,934,935,939,useless:14,user:0,3,5,6,8,14,15,16,19,20,21,22,23,25,26,33,34,35,36,37,38,39,41,43,48,56,90,136,169,224,227,323,327,328,330,358,546,636,651,716,723,856,883,884,887,889,890,892,894,902,903,904,905,908,921,922,924,925,927,928,930,932,934,937,938,939,user_dn:5,23,userconfig:21,userdata:323,328,userdata_out:353,357,userid:21,892,usernam:3,12,21,23,34,36,37,43,317,662,925,928,userok:918,userpolici:5,23,userprincipalnam:20,uses:2,3,4,14,15,18,19,20,21,22,23,24,26,28,35,36,37,39,40,43,45,101,122,246,326,379,380,402,413,415,871,883,887,896,897,898,900,904,920,930,931,939,using:3,6,11,12,14,15,16,18,19,20,21,22,23,24,25,26,28,29,33,34,36,37,38,39,40,41,43,46,48,113,117,125,129,156,228,247,250,267,279,294,298,322,324,328,337,341,351,356,363,372,375,401,613,862,883,886,891,892,894,896,898,901,904,909,910,911,917,918,924,925,928,929,932,934,935,937,938,939,usr:5,8,12,20,21,23,34,892,894,903,931,932,usual:3,10,12,20,21,23,25,35,37,39,46,99,287,883,886,892,896,909,925,934,939,utc:23,utf:46,347,362,370,695,904,905,util:22,23,34,39,47,890,892,905,927,939,uucp:20,v4_instance_convert:21,v4_realm:21,v4cred:51,v5cred:51,va_list:48,92,94,vagu:892,val:198,199,200,201,202,203,204,206,207,208,209,211,212,215,218,219,221,222,valid:20,21,23,39,43,48,66,83,109,124,129,153,160,224,235,248,260,269,275,298,327,330,339,340,342,347,356,362,363,404,410,870,883,884,889,896,900,904,916,925,928,934,938,939,valid_int_bit:775,valid_uint_bit:775,valu:3,5,6,10,14,15,16,19,20,21,22,23,24,25,26,28,33,34,36,37,38,39,43,46,48,66,83,117,125,126,136,151,153,156,166,224,245,248,252,263,265,269,296,330,365,366,368,372,383,385,394,708,714,715,717,719,724,726,782,783,784,823,827,840,851,852,871,882,883,884,886,887,892,893,894,896,897,898,900,901,904,908,910,917,918,920,925,927,928,929,931,932,937,939,valuabl:46,905,vaniti:38,vararg:91,vari:15,33,891,903,927,928,variabl:2,3,4,5,6,7,8,9,10,11,12,15,16,19,20,21,23,24,25,28,30,34,35,37,38,39,40,41,43,48,93,136,141,155,269,282,383,384,883,886,887,893,904,920,921,927,928,929,930,932,933,934,935,variad:91,413,415,variant:23,892,904,910,varieti:26,variou:14,30,43,356,889,893,904,925,vendor:724,865,931,verbatim:905,verbos:3,6,15,23,890,904,928,veri:14,20,21,23,920,verif:20,21,34,43,46,48,410,883,923,925,verifi:5,20,21,23,34,37,43,48,241,353,354,355,356,357,358,887,891,904,908,917,924,925,932,verifier_cred_handl:910,verify_ap_req_nofail:21,versa:37,904,version:0,2,3,5,6,9,10,14,15,20,23,24,26,29,38,42,43,44,48,155,228,247,308,313,360,372,611,709,807,809,831,836,869,882,886,890,891,892,894,896,898,900,901,904,905,909,915,919,929,931,932,934,935,939,verto:892,905,veto:916,via:0,3,6,8,20,21,23,34,35,46,48,274,383,399,812,904,910,912,932,938,vice:37,904,view:8,23,34,923,view_polici:23,viola:15,virtual:15,21,visibl:14,23,25,904,visit:925,vista:26,904,visual:904,vnder:14,vno:3,14,23,308,313,836,volum:904,vopt:46,vpath:890,891,vprintf:413,414,415,vtabl:908,909,917,920,vulner:14,23,32,46,904,922,wai:21,23,28,39,43,46,126,236,250,372,882,883,884,886,892,894,904,905,913,918,924,925,937,wait:8,20,23,39,wake:15,walk:6,23,924,want:3,23,28,34,540,546,890,919,924,925,932,warn:3,23,26,245,894,904,905,warranti:905,wasn:44,weak:14,20,21,26,41,web:34,883,904,week:5,23,weight:39,well:14,21,23,34,38,43,46,338,340,643,889,892,904,911,wellknown:37,46,497,749,went:925,were:14,15,21,34,43,410,613,883,904,905,925,what:6,14,19,20,21,23,26,38,43,887,908,909,917,921,924,925,931,whatev:39,whatsoev:905,when:3,4,6,8,9,10,12,14,15,16,17,20,21,22,23,26,28,29,33,34,36,37,38,39,40,41,43,46,49,65,67,68,72,73,76,77,78,79,85,91,92,93,111,113,115,125,126,132,136,141,143,145,150,153,154,163,164,169,172,173,174,175,176,177,178,180,181,182,183,194,195,224,227,228,229,230,231,235,236,250,254,258,260,261,265,268,272,275,280,282,286,294,308,313,315,316,319,321,322,323,324,325,326,327,328,329,332,335,336,337,341,342,349,351,352,353,354,356,357,358,360,372,386,398,400,402,404,724,725,726,883,886,892,894,896,901,903,904,906,910,911,915,918,920,921,922,924,925,927,928,929,931,932,934,937,939,whenev:46,where:3,4,6,7,8,14,15,17,20,21,23,25,28,39,43,46,315,386,882,883,886,887,890,891,892,897,904,909,925,928,932,939,whether:4,6,8,10,14,20,21,28,35,36,43,46,48,105,223,241,242,243,245,249,253,255,317,403,891,897,904,905,907,914,921,925,932,which:3,4,5,6,7,8,9,10,11,12,14,15,19,20,21,22,23,24,25,26,28,29,33,34,35,36,37,38,39,40,41,43,46,126,173,195,229,230,245,250,280,308,327,356,363,365,368,369,870,871,882,883,886,887,889,890,891,892,893,896,897,898,900,901,903,904,905,906,908,909,910,913,914,915,916,917,919,920,921,925,928,931,932,934,937,938,939,whichev:15,whitespac:3,20,21,23,who:0,5,16,20,23,25,34,37,924,925,whoami:909,whole:23,37,141,155,339,whom:905,924,whose:3,5,10,15,17,19,21,23,34,38,40,43,46,132,217,229,896,900,925,938,wicker:909,wicker_appear:909,wicker_brac:909,wicker_construct:909,wicker_foot:909,wicker_materi:909,wicker_slat:909,wide:21,29,36,wiki:42,890,904,wild:3,23,wildcard:19,20,904,937,willi:14,willing:20,21,26,win:905,winbind:28,winbind_krb5_loc:28,window:21,26,28,29,42,379,380,632,634,673,689,883,887,889,901,904,909,910,920,925,wish:16,21,34,39,43,250,890,891,892,893,905,910,921,924,925,939,with_realm:338,340,within:3,15,20,21,23,24,34,35,39,43,48,132,154,252,261,353,357,362,370,383,833,883,898,904,905,910,928,937,939,without:3,14,19,20,21,23,24,28,32,34,35,36,37,43,133,365,368,533,852,883,887,890,892,901,904,905,924,925,932,939,wkt:11,won:21,37,925,worcest:905,word:21,34,925,work:2,3,4,6,21,23,34,35,36,39,40,43,883,892,904,905,917,918,922,924,925,939,workdai:33,worker:10,24,workflow:14,workstat:46,worri:22,890,939,wors:21,worst:14,worth:32,would:5,6,14,16,17,20,21,23,25,28,32,34,37,38,39,40,43,46,888,904,910,924,925,931,938,939,wrap:23,48,318,910,wrapper:875,897,898,wrfile:14,writabl:15,34,314,920,write:0,6,8,10,11,20,21,22,23,24,28,34,35,251,349,384,883,901,904,909,920,939,writeabl:300,writer:0,written:3,4,155,836,886,901,905,wrong:35,37,905,925,932,wsgi:29,www:22,42,894,904,x11r6:890,x509:37,904,928,x509_anchor:21,928,x509_proxi:21,x509_proxy_ca:21,x509_user_ident:16,21,928,x86:892,904,x86_64:892,904,xconsortium:890,xml:894,xore:21,356,xst:3,15,xvm:14,xyz:939,yacc:892,yarrow:904,year:45,884,904,yes:3,5,23,892,928,yet:6,21,23,26,34,37,38,883,892,913,925,yflag:892,yield:917,you:0,3,5,12,15,16,17,20,21,22,23,24,28,32,33,34,35,37,39,40,41,723,884,888,890,891,892,893,894,905,922,924,925,927,932,939,your:0,12,17,20,21,23,26,32,33,34,37,39,890,891,892,905,913,923,925,927,936,939,your_princnam:37,your_realmnam:37,yourdir:34,yourself:925,939,yymmddhhmmss:884,yyyi:884,yyyymmddhhmmss:884,zanarotti:46,zephyr:14,905,zero:3,21,24,39,43,44,48,122,129,130,203,241,245,260,261,284,298,299,308,726,728,851,896,897,900,901,904,909,zone:14,39,884,zonetest:14},titles:"Contributing to the MIT Kerberos Documentation","Administration  programs","k5srvutil","kadmin","kadmind","kdb5_ldap_util","kdb5_util","kprop","kpropd","kproplog","krb5kdc","ktutil","sserver","Advanced topics","Retiring DES","Application servers","Authentication indicators","Backups of secure hosts","Configuration Files","kadm5.acl","kdc.conf","krb5.conf","Configuring Kerberos with OpenLDAP back-end","Database administration","Database types","Addressing dictionary attack risks","Encryption types","Environment variables","Host configuration","HTTPS proxy configuration","For administrators","Installation guide","UNIX Application Servers","Installing and configuring UNIX client machines","Installing KDCs","Account lockout","OTP Preauthentication","PKINIT configuration","Principal names and DNS","Realm configuration decisions","SPAKE Preauthentication","Troubleshooting","Various links","Developing with GSSAPI","Differences between Heimdal and MIT Kerberos API","For application developers","Initial credentials","Principal manipulation and parsing","krb5 API","krb5_425_conv_principal -  Convert a Kerberos V4 principal to a Kerberos V5 principal.","krb5_524_conv_principal -  Convert a Kerberos V5 principal to a Kerberos V4 principal.","krb5_524_convert_creds -  Convert a Kerberos V5 credentials to a Kerberos V4 credentials.","krb5_address_compare -  Compare two Kerberos addresses.","krb5_address_order -  Return an ordering of the specified addresses.","krb5_address_search -  Search a list of addresses for a specified address.","krb5_allow_weak_crypto -  Allow the application to override the profile\u2019s allow_weak_crypto setting.","krb5_aname_to_localname -  Convert a principal name to a local name.","krb5_anonymous_principal -  Build an anonymous principal.","krb5_anonymous_realm -  Return an anonymous realm data.","krb5_appdefault_boolean -  Retrieve a boolean value from the appdefaults section of krb5.conf.","krb5_appdefault_string -  Retrieve a string value from the appdefaults section of krb5.conf.","krb5_auth_con_free -  Free a krb5_auth_context structure.","krb5_auth_con_genaddrs -  Generate auth context addresses from a connected socket.","krb5_auth_con_get_checksum_func -  Get the checksum callback from an auth context.","krb5_auth_con_getaddrs -  Retrieve address fields from an auth context.","krb5_auth_con_getauthenticator -  Retrieve the authenticator from an auth context.","krb5_auth_con_getflags -  Retrieve flags from a krb5_auth_context structure.","krb5_auth_con_getkey -  Retrieve the session key from an auth context as a keyblock.","krb5_auth_con_getkey_k -  Retrieve the session key from an auth context.","krb5_auth_con_getlocalseqnumber -  Retrieve the local sequence number from an auth context.","krb5_auth_con_getlocalsubkey","krb5_auth_con_getrcache -  Retrieve the replay cache from an auth context.","krb5_auth_con_getrecvsubkey -  Retrieve the receiving subkey from an auth context as a keyblock.","krb5_auth_con_getrecvsubkey_k -  Retrieve the receiving subkey from an auth context as a keyblock.","krb5_auth_con_getremoteseqnumber -  Retrieve the remote sequence number from an auth context.","krb5_auth_con_getremotesubkey","krb5_auth_con_getsendsubkey -  Retrieve the send subkey from an auth context as a keyblock.","krb5_auth_con_getsendsubkey_k -  Retrieve the send subkey from an auth context.","krb5_auth_con_init -  Create and initialize an authentication context.","krb5_auth_con_initivector -  Cause an auth context to use cipher state.","krb5_auth_con_set_checksum_func -  Set a checksum callback in an auth context.","krb5_auth_con_set_req_cksumtype -  Set checksum type in an an auth context.","krb5_auth_con_setaddrs -  Set the local and remote addresses in an auth context.","krb5_auth_con_setflags -  Set a flags field in a krb5_auth_context structure.","krb5_auth_con_setports -  Set local and remote port fields in an auth context.","krb5_auth_con_setrcache -  Set the replay cache in an auth context.","krb5_auth_con_setrecvsubkey -  Set the receiving subkey in an auth context with a keyblock.","krb5_auth_con_setrecvsubkey_k -  Set the receiving subkey in an auth context.","krb5_auth_con_setsendsubkey -  Set the send subkey in an auth context with a keyblock.","krb5_auth_con_setsendsubkey_k -  Set the send subkey in an auth context.","krb5_auth_con_setuseruserkey -  Set the session key in an auth context.","krb5_build_principal -  Build a principal name using null-terminated strings.","krb5_build_principal_alloc_va -  Build a principal name, using a precomputed variable argument list.","krb5_build_principal_ext -  Build a principal name using length-counted strings.","krb5_build_principal_va","krb5_c_block_size -  Return cipher block size.","krb5_c_checksum_length -  Return the length of checksums for a checksum type.","krb5_c_crypto_length -  Return a length of a message field specific to the encryption type.","krb5_c_crypto_length_iov -  Fill in lengths for header, trailer and padding in a IOV array.","krb5_c_decrypt -  Decrypt data using a key (operates on keyblock).","krb5_c_decrypt_iov -  Decrypt data in place supporting AEAD (operates on keyblock).","krb5_c_derive_prfplus -  Derive a key using some input data (via RFC 6113 PRF+).","krb5_c_encrypt -  Encrypt data using a key (operates on keyblock).","krb5_c_encrypt_iov -  Encrypt data in place supporting AEAD (operates on keyblock).","krb5_c_encrypt_length -  Compute encrypted data length.","krb5_c_enctype_compare -  Compare two encryption types.","krb5_c_free_state -  Free a cipher state previously allocated by krb5_c_init_state() .","krb5_c_fx_cf2_simple -  Compute the KRB-FX-CF2 combination of two keys and pepper strings.","krb5_c_init_state -  Initialize a new cipher state.","krb5_c_is_coll_proof_cksum -  Test whether a checksum type is collision-proof.","krb5_c_is_keyed_cksum -  Test whether a checksum type is keyed.","krb5_c_keyed_checksum_types -  Return a list of keyed checksum types usable with an encryption type.","krb5_c_keylengths -  Return length of the specified key in bytes.","krb5_c_make_checksum -  Compute a checksum (operates on keyblock).","krb5_c_make_checksum_iov -  Fill in a checksum element in IOV array (operates on keyblock)","krb5_c_make_random_key -  Generate an enctype-specific random encryption key.","krb5_c_padding_length -  Return a number of padding octets.","krb5_c_prf -  Generate enctype-specific pseudo-random bytes.","krb5_c_prf_length -  Get the output length of pseudo-random functions for an encryption type.","krb5_c_prfplus -  Generate pseudo-random bytes using RFC 6113 PRF+.","krb5_c_random_add_entropy -  Add entropy to the pseudo-random number generator.","krb5_c_random_make_octets -  Generate pseudo-random bytes.","krb5_c_random_os_entropy -  Collect entropy from the OS if possible.","krb5_c_random_seed","krb5_c_random_to_key -  Generate an enctype-specific key from random data.","krb5_c_string_to_key -  Convert a string (such a password) to a key.","krb5_c_string_to_key_with_params -  Convert a string (such as a password) to a key with additional parameters.","krb5_c_valid_cksumtype -  Verify that specified checksum type is a valid Kerberos checksum type.","krb5_c_valid_enctype -  Verify that a specified encryption type is a valid Kerberos encryption type.","krb5_c_verify_checksum -  Verify a checksum (operates on keyblock).","krb5_c_verify_checksum_iov -  Validate a checksum element in IOV array (operates on keyblock).","krb5_calculate_checksum","krb5_cc_cache_match -  Find a credential cache with a specified client principal.","krb5_cc_close -  Close a credential cache handle.","krb5_cc_copy_creds -  Copy a credential cache.","krb5_cc_default -  Resolve the default credential cache name.","krb5_cc_default_name -  Return the name of the default credential cache.","krb5_cc_destroy -  Destroy a credential cache.","krb5_cc_dup -  Duplicate ccache handle.","krb5_cc_end_seq_get -  Finish a series of sequential processing credential cache entries.","krb5_cc_gen_new","krb5_cc_get_config -  Get a configuration value from a credential cache.","krb5_cc_get_flags -  Retrieve flags from a credential cache structure.","krb5_cc_get_full_name -  Retrieve the full name of a credential cache.","krb5_cc_get_name -  Retrieve the name, but not type of a credential cache.","krb5_cc_get_principal -  Get the default principal of a credential cache.","krb5_cc_get_type -  Retrieve the type of a credential cache.","krb5_cc_initialize -  Initialize a credential cache.","krb5_cc_move -  Move a credential cache.","krb5_cc_new_unique -  Create a new credential cache of the specified type with a unique name.","krb5_cc_next_cred -  Retrieve the next entry from the credential cache.","krb5_cc_remove_cred -  Remove credentials from a credential cache.","krb5_cc_resolve -  Resolve a credential cache name.","krb5_cc_retrieve_cred -  Retrieve a specified credentials from a credential cache.","krb5_cc_select -  Select a credential cache to use with a server principal.","krb5_cc_set_config -  Store a configuration value in a credential cache.","krb5_cc_set_default_name -  Set the default credential cache name.","krb5_cc_set_flags -  Set options flags on a credential cache.","krb5_cc_start_seq_get -  Prepare to sequentially read every credential in a credential cache.","krb5_cc_store_cred -  Store credentials in a credential cache.","krb5_cc_support_switch -  Determine whether a credential cache type supports switching.","krb5_cc_switch -  Make a credential cache the primary cache for its collection.","krb5_cccol_cursor_free -  Free a credential cache collection cursor.","krb5_cccol_cursor_new -  Prepare to iterate over the collection of known credential caches.","krb5_cccol_cursor_next -  Get the next credential cache in the collection.","krb5_cccol_have_content -  Check if the credential cache collection contains any credentials.","krb5_change_password -  Change a password for an existing Kerberos account.","krb5_check_clockskew -  Check if a timestamp is within the allowed clock skew of the current time.","krb5_checksum_size","krb5_chpw_message -  Get a result message for changing or setting a password.","krb5_cksumtype_to_string -  Convert a checksum type to a string.","krb5_clear_error_message -  Clear the extended error message in a context.","krb5_copy_addresses -  Copy an array of addresses.","krb5_copy_authdata -  Copy an authorization data list.","krb5_copy_authenticator -  Copy a krb5_authenticator structure.","krb5_copy_checksum -  Copy a krb5_checksum structure.","krb5_copy_context -  Copy a krb5_context structure.","krb5_copy_creds -  Copy a krb5_creds structure.","krb5_copy_data -  Copy a krb5_data object.","krb5_copy_error_message -  Copy the most recent extended error message from one context to another.","krb5_copy_keyblock -  Copy a keyblock.","krb5_copy_keyblock_contents -  Copy the contents of a keyblock.","krb5_copy_principal -  Copy a principal.","krb5_copy_ticket -  Copy a krb5_ticket structure.","krb5_decode_authdata_container -  Unwrap authorization data.","krb5_decode_ticket -  Decode an ASN.1-formatted ticket.","krb5_decrypt","krb5_deltat_to_string -  Convert a relative time value to a string.","krb5_eblock_enctype","krb5_encode_authdata_container -  Wrap authorization data in a container.","krb5_encrypt","krb5_encrypt_size","krb5_enctype_to_name -  Convert an encryption type to a name or alias.","krb5_enctype_to_string -  Convert an encryption type to a string.","krb5_expand_hostname -  Canonicalize a hostname, possibly using name service.","krb5_find_authdata -  Find authorization data elements.","krb5_finish_key","krb5_finish_random_key","krb5_free_addresses -  Free the data stored in array of addresses.","krb5_free_ap_rep_enc_part -  Free a krb5_ap_rep_enc_part structure.","krb5_free_authdata -  Free the storage assigned to array of authentication data.","krb5_free_authenticator -  Free a krb5_authenticator structure.","krb5_free_checksum -  Free a krb5_checksum structure.","krb5_free_checksum_contents -  Free the contents of a krb5_checksum structure.","krb5_free_cksumtypes -  Free an array of checksum types.","krb5_free_context -  Free a krb5 library context.","krb5_free_cred_contents -  Free the contents of a krb5_creds structure.","krb5_free_creds -  Free a krb5_creds structure.","krb5_free_data -  Free a krb5_data structure.","krb5_free_data_contents -  Free the contents of a krb5_data structure and zero the data field.","krb5_free_default_realm -  Free a default realm string returned by krb5_get_default_realm() .","krb5_free_enctypes -  Free an array of encryption types.","krb5_free_error -  Free an error allocated by krb5_read_error() or krb5_sendauth() .","krb5_free_error_message -  Free an error message generated by krb5_get_error_message() .","krb5_free_host_realm -  Free the memory allocated by krb5_get_host_realm() .","krb5_free_keyblock -  Free a krb5_keyblock structure.","krb5_free_keyblock_contents -  Free the contents of a krb5_keyblock structure.","krb5_free_keytab_entry_contents -  Free the contents of a key table entry.","krb5_free_principal -  Free the storage assigned to a principal.","krb5_free_string -  Free a string allocated by a krb5 function.","krb5_free_tgt_creds -  Free an array of credential structures.","krb5_free_ticket -  Free a ticket.","krb5_free_unparsed_name -  Free a string representation of a principal.","krb5_fwd_tgt_creds -  Get a forwarded TGT and format a KRB-CRED message.","krb5_get_credentials -  Get an additional ticket.","krb5_get_credentials_renew","krb5_get_credentials_validate","krb5_get_default_realm -  Retrieve the default realm.","krb5_get_error_message -  Get the (possibly extended) error message for a code.","krb5_get_etype_info -  Retrieve enctype, salt and s2kparams from KDC.","krb5_get_fallback_host_realm","krb5_get_host_realm -  Get the Kerberos realm names for a host.","krb5_get_in_tkt_with_keytab","krb5_get_in_tkt_with_password","krb5_get_in_tkt_with_skey","krb5_get_init_creds_keytab -  Get initial credentials using a key table.","krb5_get_init_creds_opt_alloc -  Allocate a new initial credential options structure.","krb5_get_init_creds_opt_free -  Free initial credential options.","krb5_get_init_creds_opt_get_fast_flags -  Retrieve FAST flags from initial credential options.","krb5_get_init_creds_opt_init","krb5_get_init_creds_opt_set_address_list -  Set address restrictions in initial credential options.","krb5_get_init_creds_opt_set_anonymous -  Set or unset the anonymous flag in initial credential options.","krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initial credential options.","krb5_get_init_creds_opt_set_change_password_prompt -  Set or unset change-password-prompt flag in initial credential options.","krb5_get_init_creds_opt_set_etype_list -  Set allowable encryption types in initial credential options.","krb5_get_init_creds_opt_set_expire_callback -  Set an expiration callback in initial credential options.","krb5_get_init_creds_opt_set_fast_ccache -  Set FAST armor cache in initial credential options.","krb5_get_init_creds_opt_set_fast_ccache_name -  Set location of FAST armor ccache in initial credential options.","krb5_get_init_creds_opt_set_fast_flags -  Set FAST flags in initial credential options.","krb5_get_init_creds_opt_set_forwardable -  Set or unset the forwardable flag in initial credential options.","krb5_get_init_creds_opt_set_in_ccache -  Set an input credential cache in initial credential options.","krb5_get_init_creds_opt_set_out_ccache -  Set an output credential cache in initial credential options.","krb5_get_init_creds_opt_set_pa -  Supply options for preauthentication in initial credential options.","krb5_get_init_creds_opt_set_pac_request -  Ask the KDC to include or not include a PAC in the ticket.","krb5_get_init_creds_opt_set_preauth_list -  Set preauthentication types in initial credential options.","krb5_get_init_creds_opt_set_proxiable -  Set or unset the proxiable flag in initial credential options.","krb5_get_init_creds_opt_set_renew_life -  Set the ticket renewal lifetime in initial credential options.","krb5_get_init_creds_opt_set_responder -  Set the responder function in initial credential options.","krb5_get_init_creds_opt_set_salt -  Set salt for optimistic preauthentication in initial credential options.","krb5_get_init_creds_opt_set_tkt_life -  Set the ticket lifetime in initial credential options.","krb5_get_init_creds_password -  Get initial credentials using a password.","krb5_get_permitted_enctypes -  Return a list of encryption types permitted for session keys.","krb5_get_profile -  Retrieve configuration profile from the context.","krb5_get_prompt_types -  Get prompt types array from a context.","krb5_get_renewed_creds -  Get renewed credential from KDC using an existing credential.","krb5_get_server_rcache -  Generate a replay cache object for server use and open it.","krb5_get_time_offsets -  Return the time offsets from the os context.","krb5_get_validated_creds -  Get validated credentials from the KDC.","krb5_init_context -  Create a krb5 library context.","krb5_init_context_profile -  Create a krb5 library context using a specified profile.","krb5_init_creds_free -  Free an initial credentials context.","krb5_init_creds_get -  Acquire credentials using an initial credentials context.","krb5_init_creds_get_creds -  Retrieve acquired credentials from an initial credentials context.","krb5_init_creds_get_error -  Get the last error from KDC from an initial credentials context.","krb5_init_creds_get_times -  Retrieve ticket times from an initial credentials context.","krb5_init_creds_init -  Create a context for acquiring initial credentials.","krb5_init_creds_set_keytab -  Specify a keytab to use for acquiring initial credentials.","krb5_init_creds_set_password -  Set a password for acquiring initial credentials.","krb5_init_creds_set_service -  Specify a service principal for acquiring initial credentials.","krb5_init_creds_step -  Get the next KDC request for acquiring initial credentials.","krb5_init_keyblock -  Initialize an empty krb5_keyblock .","krb5_init_random_key","krb5_init_secure_context -  Create a krb5 library context using only configuration files.","krb5_is_config_principal -  Test whether a principal is a configuration principal.","krb5_is_referral_realm -  Check for a match with KRB5_REFERRAL_REALM.","krb5_is_thread_safe -  Test whether the Kerberos library was built with multithread support.","krb5_k_create_key -  Create a krb5_key from the enctype and key data in a keyblock.","krb5_k_decrypt -  Decrypt data using a key (operates on opaque key).","krb5_k_decrypt_iov -  Decrypt data in place supporting AEAD (operates on opaque key).","krb5_k_encrypt -  Encrypt data using a key (operates on opaque key).","krb5_k_encrypt_iov -  Encrypt data in place supporting AEAD (operates on opaque key).","krb5_k_free_key -  Decrement the reference count on a key and free it if it hits zero.","krb5_k_key_enctype -  Retrieve the enctype of a krb5_key structure.","krb5_k_key_keyblock -  Retrieve a copy of the keyblock from a krb5_key structure.","krb5_k_make_checksum -  Compute a checksum (operates on opaque key).","krb5_k_make_checksum_iov -  Fill in a checksum element in IOV array (operates on opaque key)","krb5_k_prf -  Generate enctype-specific pseudo-random bytes (operates on opaque key).","krb5_k_reference_key -  Increment the reference count on a key.","krb5_k_verify_checksum -  Verify a checksum (operates on opaque key).","krb5_k_verify_checksum_iov -  Validate a checksum element in IOV array (operates on opaque key).","krb5_kt_add_entry -  Add a new entry to a key table.","krb5_kt_client_default -  Resolve the default client key table.","krb5_kt_close -  Close a key table handle.","krb5_kt_default -  Resolve the default key table.","krb5_kt_default_name -  Get the default key table name.","krb5_kt_dup -  Duplicate keytab handle.","krb5_kt_end_seq_get -  Release a keytab cursor.","krb5_kt_free_entry","krb5_kt_get_entry -  Get an entry from a key table.","krb5_kt_get_name -  Get a key table name.","krb5_kt_get_type -  Return the type of a key table.","krb5_kt_have_content -  Check if a keytab exists and contains entries.","krb5_kt_next_entry -  Retrieve the next entry from the key table.","krb5_kt_read_service_key -  Retrieve a service key from a key table.","krb5_kt_remove_entry -  Remove an entry from a key table.","krb5_kt_resolve -  Get a handle for a key table.","krb5_kt_start_seq_get -  Start a sequential retrieval of key table entries.","krb5_kuserok -  Determine if a principal is authorized to log in as a local user.","krb5_make_authdata_kdc_issued -  Encode and sign AD-KDCIssued authorization data.","krb5_merge_authdata -  Merge two authorization data lists into a new list.","krb5_mk_1cred -  Format a KRB-CRED message for a single set of credentials.","krb5_mk_error -  Format and encode a KRB_ERROR message.","krb5_mk_ncred -  Format a KRB-CRED message for an array of credentials.","krb5_mk_priv -  Format a KRB-PRIV message.","krb5_mk_rep -  Format and encrypt a KRB_AP_REP message.","krb5_mk_rep_dce -  Format and encrypt a KRB_AP_REP message for DCE RPC.","krb5_mk_req -  Create a KRB_AP_REQ message.","krb5_mk_req_extended -  Create a KRB_AP_REQ message using supplied credentials.","krb5_mk_safe -  Format a KRB-SAFE message.","krb5_os_localaddr -  Return all interface addresses for this host.","krb5_pac_add_buffer -  Add a buffer to a PAC handle.","krb5_pac_free -  Free a PAC handle.","krb5_pac_get_buffer -  Retrieve a buffer value from a PAC.","krb5_pac_get_client_info","krb5_pac_get_types -  Return an array of buffer types in a PAC handle.","krb5_pac_init -  Create an empty Privilege Attribute Certificate (PAC) handle.","krb5_pac_parse -  Unparse an encoded PAC into a new handle.","krb5_pac_sign -  Sign a PAC.","krb5_pac_sign_ext -  Sign a PAC, possibly with a specified realm.","krb5_pac_verify -  Verify a PAC.","krb5_pac_verify_ext -  Verify a PAC, possibly from a specified realm.","krb5_parse_name -  Convert a string principal name to a krb5_principal structure.","krb5_parse_name_flags -  Convert a string principal name to a krb5_principal with flags.","krb5_prepend_error_message -  Add a prefix to the message for an error code.","krb5_principal2salt -  Convert a principal name into the default salt for that principal.","krb5_principal_compare -  Compare two principals.","krb5_principal_compare_any_realm -  Compare two principals ignoring realm components.","krb5_principal_compare_flags -  Compare two principals with additional flags.","krb5_process_key","krb5_prompter_posix -  Prompt user for password.","krb5_random_key","krb5_rd_cred -  Read and validate a KRB-CRED message.","krb5_rd_error -  Decode a KRB-ERROR message.","krb5_rd_priv -  Process a KRB-PRIV message.","krb5_rd_rep -  Parse and decrypt a KRB_AP_REP message.","krb5_rd_rep_dce -  Parse and decrypt a KRB_AP_REP message for DCE RPC.","krb5_rd_req -  Parse and decrypt a KRB_AP_REQ message.","krb5_rd_safe -  Process KRB-SAFE message.","krb5_read_password -  Read a password from keyboard input.","krb5_realm_compare -  Compare the realms of two principals.","krb5_recvauth -  Server function for sendauth protocol.","krb5_recvauth_version -  Server function for sendauth protocol with version parameter.","krb5_responder_get_challenge -  Retrieve the challenge data for a given question in the responder context.","krb5_responder_list_questions -  List the question names contained in the responder context.","krb5_responder_otp_challenge_free -  Free the value returned by krb5_responder_otp_get_challenge() .","krb5_responder_otp_get_challenge -  Decode the KRB5_RESPONDER_QUESTION_OTP to a C struct.","krb5_responder_otp_set_answer -  Answer the KRB5_RESPONDER_QUESTION_OTP question.","krb5_responder_pkinit_challenge_free -  Free the value returned by krb5_responder_pkinit_get_challenge() .","krb5_responder_pkinit_get_challenge -  Decode the KRB5_RESPONDER_QUESTION_PKINIT to a C struct.","krb5_responder_pkinit_set_answer -  Answer the KRB5_RESPONDER_QUESTION_PKINIT question for one identity.","krb5_responder_set_answer -  Answer a named question in the responder context.","krb5_salttype_to_string -  Convert a salt type to a string.","krb5_sendauth -  Client function for sendauth protocol.","krb5_server_decrypt_ticket_keytab -  Decrypt a ticket using the specified key table.","krb5_set_default_realm -  Override the default realm for the specified context.","krb5_set_default_tgs_enctypes -  Set default TGS encryption types in a krb5_context structure.","krb5_set_error_message -  Set an extended error message for an error code.","krb5_set_kdc_recv_hook -  Set a KDC post-receive hook function.","krb5_set_kdc_send_hook -  Set a KDC pre-send hook function.","krb5_set_password -  Set a password for a principal using specified credentials.","krb5_set_password_using_ccache -  Set a password for a principal using cached credentials.","krb5_set_principal_realm -  Set the realm field of a principal.","krb5_set_real_time -  Set time offset field in a krb5_context structure.","krb5_set_trace_callback -  Specify a callback function for trace events.","krb5_set_trace_filename -  Specify a file name for directing trace events.","krb5_sname_match -  Test whether a principal matches a matching principal.","krb5_sname_to_principal -  Generate a full principal name from a service name.","krb5_string_to_cksumtype -  Convert a string to a checksum type.","krb5_string_to_deltat -  Convert a string to a delta time value.","krb5_string_to_enctype -  Convert a string to an encryption type.","krb5_string_to_key","krb5_string_to_salttype -  Convert a string to a salt type.","krb5_string_to_timestamp -  Convert a string to a timestamp.","krb5_timeofday -  Retrieve the current time with context specific time offset adjustment.","krb5_timestamp_to_sfstring -  Convert a timestamp to a string, with optional output padding.","krb5_timestamp_to_string -  Convert a timestamp to a string.","krb5_tkt_creds_free -  Free a TGS request context.","krb5_tkt_creds_get -  Synchronously obtain credentials using a TGS request context.","krb5_tkt_creds_get_creds -  Retrieve acquired credentials from a TGS request context.","krb5_tkt_creds_get_times -  Retrieve ticket times from a TGS request context.","krb5_tkt_creds_init -  Create a context to get credentials from a KDC\u2019s Ticket Granting Service.","krb5_tkt_creds_step -  Get the next KDC request in a TGS exchange.","krb5_unparse_name -  Convert a krb5_principal structure to a string representation.","krb5_unparse_name_ext -  Convert krb5_principal structure to string and length.","krb5_unparse_name_flags -  Convert krb5_principal structure to a string with flags.","krb5_unparse_name_flags_ext -  Convert krb5_principal structure to string format with flags.","krb5_us_timeofday -  Retrieve the system time of day, in sec and ms, since the epoch.","krb5_use_enctype","krb5_verify_authdata_kdc_issued -  Unwrap and verify AD-KDCIssued authorization data.","krb5_verify_checksum","krb5_verify_init_creds -  Verify initial credentials against a keytab.","krb5_verify_init_creds_opt_init -  Initialize a credential verification options structure.","krb5_verify_init_creds_opt_set_ap_req_nofail -  Set whether credential verification is required.","krb5_vprepend_error_message -  Add a prefix to the message for an error code using a va_list.","krb5_vset_error_message -  Set an extended error message for an error code using a va_list.","krb5_vwrap_error_message -  Add a prefix to a different error code\u2019s message using a va_list.","krb5_wrap_error_message -  Add a prefix to a different error code\u2019s message.","Complete reference - API and datatypes","ADDRTYPE_ADDRPORT","ADDRTYPE_CHAOS","ADDRTYPE_DDP","ADDRTYPE_INET","ADDRTYPE_INET6","ADDRTYPE_IPPORT","ADDRTYPE_ISO","ADDRTYPE_IS_LOCAL","ADDRTYPE_NETBIOS","ADDRTYPE_XNS","AD_TYPE_EXTERNAL","AD_TYPE_FIELD_TYPE_MASK","AD_TYPE_REGISTERED","AD_TYPE_RESERVED","AP_OPTS_ETYPE_NEGOTIATION","AP_OPTS_MUTUAL_REQUIRED","AP_OPTS_RESERVED","AP_OPTS_USE_SESSION_KEY","AP_OPTS_USE_SUBKEY","AP_OPTS_WIRE_MASK","CKSUMTYPE_CMAC_CAMELLIA128","CKSUMTYPE_CMAC_CAMELLIA256","CKSUMTYPE_CRC32","CKSUMTYPE_DESCBC","CKSUMTYPE_HMAC_MD5_ARCFOUR","CKSUMTYPE_HMAC_SHA1_96_AES128","CKSUMTYPE_HMAC_SHA1_96_AES256","CKSUMTYPE_HMAC_SHA1_DES3","CKSUMTYPE_HMAC_SHA256_128_AES128","CKSUMTYPE_HMAC_SHA384_192_AES256","CKSUMTYPE_MD5_HMAC_ARCFOUR","CKSUMTYPE_NIST_SHA","CKSUMTYPE_RSA_MD4","CKSUMTYPE_RSA_MD4_DES","CKSUMTYPE_RSA_MD5","CKSUMTYPE_RSA_MD5_DES","ENCTYPE_AES128_CTS_HMAC_SHA1_96","ENCTYPE_AES128_CTS_HMAC_SHA256_128","ENCTYPE_AES256_CTS_HMAC_SHA1_96","ENCTYPE_AES256_CTS_HMAC_SHA384_192","ENCTYPE_ARCFOUR_HMAC","ENCTYPE_ARCFOUR_HMAC_EXP","ENCTYPE_CAMELLIA128_CTS_CMAC","ENCTYPE_CAMELLIA256_CTS_CMAC","ENCTYPE_DES3_CBC_ENV","ENCTYPE_DES3_CBC_RAW","ENCTYPE_DES3_CBC_SHA","ENCTYPE_DES3_CBC_SHA1","ENCTYPE_DES_CBC_CRC","ENCTYPE_DES_CBC_MD4","ENCTYPE_DES_CBC_MD5","ENCTYPE_DES_CBC_RAW","ENCTYPE_DES_HMAC_SHA1","ENCTYPE_DSA_SHA1_CMS","ENCTYPE_MD5_RSA_CMS","ENCTYPE_NULL","ENCTYPE_RC2_CBC_ENV","ENCTYPE_RSA_ENV","ENCTYPE_RSA_ES_OAEP_ENV","ENCTYPE_SHA1_RSA_CMS","ENCTYPE_UNKNOWN","KDC_OPT_ALLOW_POSTDATE","KDC_OPT_CANONICALIZE","KDC_OPT_CNAME_IN_ADDL_TKT","KDC_OPT_DISABLE_TRANSITED_CHECK","KDC_OPT_ENC_TKT_IN_SKEY","KDC_OPT_FORWARDABLE","KDC_OPT_FORWARDED","KDC_OPT_POSTDATED","KDC_OPT_PROXIABLE","KDC_OPT_PROXY","KDC_OPT_RENEW","KDC_OPT_RENEWABLE","KDC_OPT_RENEWABLE_OK","KDC_OPT_REQUEST_ANONYMOUS","KDC_OPT_VALIDATE","KDC_TKT_COMMON_MASK","KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE","KRB5_ANONYMOUS_PRINCSTR","KRB5_ANONYMOUS_REALMSTR","KRB5_AP_REP","KRB5_AP_REQ","KRB5_AS_REP","KRB5_AS_REQ","KRB5_AUTHDATA_AND_OR","KRB5_AUTHDATA_AP_OPTIONS","KRB5_AUTHDATA_AUTH_INDICATOR","KRB5_AUTHDATA_CAMMAC","KRB5_AUTHDATA_ETYPE_NEGOTIATION","KRB5_AUTHDATA_FX_ARMOR","KRB5_AUTHDATA_IF_RELEVANT","KRB5_AUTHDATA_INITIAL_VERIFIED_CAS","KRB5_AUTHDATA_KDC_ISSUED","KRB5_AUTHDATA_MANDATORY_FOR_KDC","KRB5_AUTHDATA_OSF_DCE","KRB5_AUTHDATA_SESAME","KRB5_AUTHDATA_SIGNTICKET","KRB5_AUTHDATA_WIN2K_PAC","KRB5_AUTH_CONTEXT_DO_SEQUENCE","KRB5_AUTH_CONTEXT_DO_TIME","KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR","KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR","KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR","KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR","KRB5_AUTH_CONTEXT_PERMIT_ALL","KRB5_AUTH_CONTEXT_RET_SEQUENCE","KRB5_AUTH_CONTEXT_RET_TIME","KRB5_AUTH_CONTEXT_USE_SUBKEY","KRB5_CRED","KRB5_CRYPTO_TYPE_CHECKSUM","KRB5_CRYPTO_TYPE_DATA","KRB5_CRYPTO_TYPE_EMPTY","KRB5_CRYPTO_TYPE_HEADER","KRB5_CRYPTO_TYPE_PADDING","KRB5_CRYPTO_TYPE_SIGN_ONLY","KRB5_CRYPTO_TYPE_STREAM","KRB5_CRYPTO_TYPE_TRAILER","KRB5_CYBERSAFE_SECUREID","KRB5_DOMAIN_X500_COMPRESS","KRB5_ENCPADATA_REQ_ENC_PA_REP","KRB5_ERROR","KRB5_FAST_REQUIRED","KRB5_GC_CACHED","KRB5_GC_CANONICALIZE","KRB5_GC_CONSTRAINED_DELEGATION","KRB5_GC_FORWARDABLE","KRB5_GC_NO_STORE","KRB5_GC_NO_TRANSIT_CHECK","KRB5_GC_USER_USER","KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST","KRB5_GET_INIT_CREDS_OPT_ANONYMOUS","KRB5_GET_INIT_CREDS_OPT_CANONICALIZE","KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT","KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST","KRB5_GET_INIT_CREDS_OPT_FORWARDABLE","KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST","KRB5_GET_INIT_CREDS_OPT_PROXIABLE","KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE","KRB5_GET_INIT_CREDS_OPT_SALT","KRB5_GET_INIT_CREDS_OPT_TKT_LIFE","KRB5_INIT_CONTEXT_KDC","KRB5_INIT_CONTEXT_SECURE","KRB5_INIT_CREDS_STEP_FLAG_CONTINUE","KRB5_INT16_MAX","KRB5_INT16_MIN","KRB5_INT32_MAX","KRB5_INT32_MIN","KRB5_KEYUSAGE_AD_ITE","KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM","KRB5_KEYUSAGE_AD_MTE","KRB5_KEYUSAGE_AD_SIGNEDPATH","KRB5_KEYUSAGE_APP_DATA_CKSUM","KRB5_KEYUSAGE_APP_DATA_ENCRYPT","KRB5_KEYUSAGE_AP_REP_ENCPART","KRB5_KEYUSAGE_AP_REQ_AUTH","KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM","KRB5_KEYUSAGE_AS_REP_ENCPART","KRB5_KEYUSAGE_AS_REQ","KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS","KRB5_KEYUSAGE_CAMMAC","KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT","KRB5_KEYUSAGE_ENC_CHALLENGE_KDC","KRB5_KEYUSAGE_FAST_ENC","KRB5_KEYUSAGE_FAST_FINISHED","KRB5_KEYUSAGE_FAST_REP","KRB5_KEYUSAGE_FAST_REQ_CHKSUM","KRB5_KEYUSAGE_GSS_TOK_MIC","KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG","KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV","KRB5_KEYUSAGE_IAKERB_FINISHED","KRB5_KEYUSAGE_KDC_REP_TICKET","KRB5_KEYUSAGE_KRB_CRED_ENCPART","KRB5_KEYUSAGE_KRB_ERROR_CKSUM","KRB5_KEYUSAGE_KRB_PRIV_ENCPART","KRB5_KEYUSAGE_KRB_SAFE_CKSUM","KRB5_KEYUSAGE_PA_AS_FRESHNESS","KRB5_KEYUSAGE_PA_FX_COOKIE","KRB5_KEYUSAGE_PA_OTP_REQUEST","KRB5_KEYUSAGE_PA_PKINIT_KX","KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY","KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST","KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM","KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID","KRB5_KEYUSAGE_PA_SAM_RESPONSE","KRB5_KEYUSAGE_SPAKE","KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY","KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY","KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY","KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY","KRB5_KEYUSAGE_TGS_REQ_AUTH","KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM","KRB5_KPASSWD_ACCESSDENIED","KRB5_KPASSWD_AUTHERROR","KRB5_KPASSWD_BAD_VERSION","KRB5_KPASSWD_HARDERROR","KRB5_KPASSWD_INITIAL_FLAG_NEEDED","KRB5_KPASSWD_MALFORMED","KRB5_KPASSWD_SOFTERROR","KRB5_KPASSWD_SUCCESS","KRB5_LRQ_ALL_ACCT_EXPTIME","KRB5_LRQ_ALL_LAST_INITIAL","KRB5_LRQ_ALL_LAST_RENEWAL","KRB5_LRQ_ALL_LAST_REQ","KRB5_LRQ_ALL_LAST_TGT","KRB5_LRQ_ALL_LAST_TGT_ISSUED","KRB5_LRQ_ALL_PW_EXPTIME","KRB5_LRQ_NONE","KRB5_LRQ_ONE_ACCT_EXPTIME","KRB5_LRQ_ONE_LAST_INITIAL","KRB5_LRQ_ONE_LAST_RENEWAL","KRB5_LRQ_ONE_LAST_REQ","KRB5_LRQ_ONE_LAST_TGT","KRB5_LRQ_ONE_LAST_TGT_ISSUED","KRB5_LRQ_ONE_PW_EXPTIME","KRB5_NT_ENTERPRISE_PRINCIPAL","KRB5_NT_ENT_PRINCIPAL_AND_ID","KRB5_NT_MS_PRINCIPAL","KRB5_NT_MS_PRINCIPAL_AND_ID","KRB5_NT_PRINCIPAL","KRB5_NT_SMTP_NAME","KRB5_NT_SRV_HST","KRB5_NT_SRV_INST","KRB5_NT_SRV_XHST","KRB5_NT_UID","KRB5_NT_UNKNOWN","KRB5_NT_WELLKNOWN","KRB5_NT_X500_PRINCIPAL","KRB5_PAC_CLIENT_INFO","KRB5_PAC_CREDENTIALS_INFO","KRB5_PAC_DELEGATION_INFO","KRB5_PAC_LOGON_INFO","KRB5_PAC_PRIVSVR_CHECKSUM","KRB5_PAC_SERVER_CHECKSUM","KRB5_PAC_UPN_DNS_INFO","KRB5_PADATA_AFS3_SALT","KRB5_PADATA_AP_REQ","KRB5_PADATA_AS_CHECKSUM","KRB5_PADATA_AS_FRESHNESS","KRB5_PADATA_ENCRYPTED_CHALLENGE","KRB5_PADATA_ENC_SANDIA_SECURID","KRB5_PADATA_ENC_TIMESTAMP","KRB5_PADATA_ENC_UNIX_TIME","KRB5_PADATA_ETYPE_INFO","KRB5_PADATA_ETYPE_INFO2","KRB5_PADATA_FOR_USER","KRB5_PADATA_FX_COOKIE","KRB5_PADATA_FX_ERROR","KRB5_PADATA_FX_FAST","KRB5_PADATA_GET_FROM_TYPED_DATA","KRB5_PADATA_NONE","KRB5_PADATA_OSF_DCE","KRB5_PADATA_OTP_CHALLENGE","KRB5_PADATA_OTP_PIN_CHANGE","KRB5_PADATA_OTP_REQUEST","KRB5_PADATA_PAC_OPTIONS","KRB5_PADATA_PAC_REQUEST","KRB5_PADATA_PKINIT_KX","KRB5_PADATA_PK_AS_REP","KRB5_PADATA_PK_AS_REP_OLD","KRB5_PADATA_PK_AS_REQ","KRB5_PADATA_PK_AS_REQ_OLD","KRB5_PADATA_PW_SALT","KRB5_PADATA_REFERRAL","KRB5_PADATA_S4U_X509_USER","KRB5_PADATA_SAM_CHALLENGE","KRB5_PADATA_SAM_CHALLENGE_2","KRB5_PADATA_SAM_REDIRECT","KRB5_PADATA_SAM_RESPONSE","KRB5_PADATA_SAM_RESPONSE_2","KRB5_PADATA_SESAME","KRB5_PADATA_SPAKE","KRB5_PADATA_SVR_REFERRAL_INFO","KRB5_PADATA_TGS_REQ","KRB5_PADATA_USE_SPECIFIED_KVNO","KRB5_PRINCIPAL_COMPARE_CASEFOLD","KRB5_PRINCIPAL_COMPARE_ENTERPRISE","KRB5_PRINCIPAL_COMPARE_IGNORE_REALM","KRB5_PRINCIPAL_COMPARE_UTF8","KRB5_PRINCIPAL_PARSE_ENTERPRISE","KRB5_PRINCIPAL_PARSE_IGNORE_REALM","KRB5_PRINCIPAL_PARSE_NO_DEF_REALM","KRB5_PRINCIPAL_PARSE_NO_REALM","KRB5_PRINCIPAL_PARSE_REQUIRE_REALM","KRB5_PRINCIPAL_UNPARSE_DISPLAY","KRB5_PRINCIPAL_UNPARSE_NO_REALM","KRB5_PRINCIPAL_UNPARSE_SHORT","KRB5_PRIV","KRB5_PROMPT_TYPE_NEW_PASSWORD","KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN","KRB5_PROMPT_TYPE_PASSWORD","KRB5_PROMPT_TYPE_PREAUTH","KRB5_PVNO","KRB5_REALM_BRANCH_CHAR","KRB5_RECVAUTH_BADAUTHVERS","KRB5_RECVAUTH_SKIP_VERSION","KRB5_REFERRAL_REALM","KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN","KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN","KRB5_RESPONDER_OTP_FLAGS_NEXTOTP","KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN","KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC","KRB5_RESPONDER_OTP_FORMAT_DECIMAL","KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL","KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW","KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY","KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED","KRB5_RESPONDER_QUESTION_OTP","KRB5_RESPONDER_QUESTION_PASSWORD","KRB5_RESPONDER_QUESTION_PKINIT","KRB5_SAFE","KRB5_SAM_MUST_PK_ENCRYPT_SAD","KRB5_SAM_SEND_ENCRYPTED_SAD","KRB5_SAM_USE_SAD_AS_KEY","KRB5_TC_MATCH_2ND_TKT","KRB5_TC_MATCH_AUTHDATA","KRB5_TC_MATCH_FLAGS","KRB5_TC_MATCH_FLAGS_EXACT","KRB5_TC_MATCH_IS_SKEY","KRB5_TC_MATCH_KTYPE","KRB5_TC_MATCH_SRV_NAMEONLY","KRB5_TC_MATCH_TIMES","KRB5_TC_MATCH_TIMES_EXACT","KRB5_TC_NOTICKET","KRB5_TC_OPENCLOSE","KRB5_TC_SUPPORTED_KTYPES","KRB5_TGS_NAME","KRB5_TGS_NAME_SIZE","KRB5_TGS_REP","KRB5_TGS_REQ","KRB5_TKT_CREDS_STEP_FLAG_CONTINUE","KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL","KRB5_WELLKNOWN_NAMESTR","LR_TYPE_INTERPRETATION_MASK","LR_TYPE_THIS_SERVER_ONLY","MAX_KEYTAB_NAME_LEN","MSEC_DIRBIT","MSEC_VAL_MASK","SALT_TYPE_AFS_LENGTH","SALT_TYPE_NO_LENGTH","THREEPARAMOPEN","TKT_FLG_ANONYMOUS","TKT_FLG_ENC_PA_REP","TKT_FLG_FORWARDABLE","TKT_FLG_FORWARDED","TKT_FLG_HW_AUTH","TKT_FLG_INITIAL","TKT_FLG_INVALID","TKT_FLG_MAY_POSTDATE","TKT_FLG_OK_AS_DELEGATE","TKT_FLG_POSTDATED","TKT_FLG_PRE_AUTH","TKT_FLG_PROXIABLE","TKT_FLG_PROXY","TKT_FLG_RENEWABLE","TKT_FLG_TRANSIT_POLICY_CHECKED","VALID_INT_BITS","VALID_UINT_BITS","krb5 simple macros","krb524_convert_creds_kdc","krb524_init_ets","krb5_const","krb5_princ_component","krb5_princ_name","krb5_princ_realm","krb5_princ_set_realm","krb5_princ_set_realm_data","krb5_princ_set_realm_length","krb5_princ_size","krb5_princ_type","krb5_roundup","krb5_x","krb5_xc","krb5 types and structures","krb5_address","krb5_addrtype","krb5_ap_rep","krb5_ap_rep_enc_part","krb5_ap_req","krb5_auth_context","krb5_authdata","krb5_authdatatype","krb5_authenticator","krb5_boolean","krb5_cc_cursor","krb5_ccache","krb5_cccol_cursor","krb5_checksum","krb5_cksumtype","krb5_const_pointer","krb5_const_principal","krb5_context","krb5_cred","krb5_cred_enc_part","krb5_cred_info","krb5_creds","krb5_crypto_iov","krb5_cryptotype","krb5_data","krb5_deltat","krb5_enc_data","krb5_enc_kdc_rep_part","krb5_enc_tkt_part","krb5_encrypt_block","krb5_enctype","krb5_error","krb5_error_code","krb5_expire_callback_func","krb5_flags","krb5_get_init_creds_opt","krb5_gic_opt_pa_data","krb5_init_creds_context","krb5_int16","krb5_int32","krb5_kdc_rep","krb5_kdc_req","krb5_key","krb5_keyblock","krb5_keytab","krb5_keytab_entry","krb5_keyusage","krb5_kt_cursor","krb5_kvno","krb5_last_req_entry","krb5_magic","krb5_mk_req_checksum_func","krb5_msgtype","krb5_octet","krb5_pa_data","krb5_pa_pac_req","krb5_pa_server_referral_data","krb5_pa_svr_referral_data","krb5_pac","krb5_pointer","krb5_post_recv_fn","krb5_pre_send_fn","krb5_preauthtype","krb5_principal","krb5_principal_data","krb5_prompt","krb5_prompt_type","krb5_prompter_fct","krb5_pwd_data","krb5_rcache","krb5_replay_data","krb5_responder_context","krb5_responder_fn","krb5_responder_otp_challenge","krb5_responder_otp_tokeninfo","krb5_responder_pkinit_challenge","krb5_responder_pkinit_identity","krb5_response","krb5_ticket","krb5_ticket_times","krb5_timestamp","krb5_tkt_authent","krb5_tkt_creds_context","krb5_trace_callback","krb5_trace_info","krb5_transited","krb5_typed_data","krb5_ui_2","krb5_ui_4","krb5_verify_init_creds_opt","passwd_phrase_element","Year 2038 considerations for uses of krb5_timestamp","Credential cache","Supported date and time formats","Kerberos V5 concepts","keytab","replay cache","stash file","Organization of the source directory","Doing the build","Building Kerberos V5","Options to <em>configure</em>","osconf.hin","How to build this documentation from the source","Copyright","Credential cache file format","KDC cookie format","PKINIT freshness tokens","Protocols and file formats","Keytab file format","Replay cache file format","MIT Kerberos Documentation (1.19.2)","MIT Kerberos defaults","MIT Kerberos features","MIT Kerberos License information","Credential cache selection interface (ccselect)","PKINIT certificate authorization interface (certauth)","Client preauthentication interface (clpreauth)","General plugin concepts","GSSAPI mechanism interface","Host-to-realm interface (hostrealm)","For plugin module developers","Internal pluggable interfaces","kadmin authorization interface (kadm5_auth)","KADM5 hook interface (kadm5_hook)","KDC policy interface (kdcpolicy)","KDC preauthentication interface (kdcpreauth)","Local authorization interface (localauth)","Server location interface (locate)","Configuration interface (profile)","Password quality interface (pwqual)","Resources","For users","Password management","Ticket management","User commands","kdestroy","kinit","klist","kpasswd","krb5-config","ksu","kswitch","kvno","sclient","User config files",".k5identity",".k5login","kerberos",titleterms:{"boolean":59,"byte":112,117,119,121,296,"default":14,28,36,135,136,145,156,210,227,301,303,304,344,374,375,883,886,887,903,"export":43,"function":118,219,257,360,361,372,377,378,383,"import":43,"new":108,149,236,300,319,336,932,"null":91,"public":48,775,790,"return":53,58,95,96,97,111,112,116,136,210,261,266,310,329,334,364,367,"switch":34,160,"while":41,Adding:14,15,23,DES:14,DNS:15,38,Doing:890,For:30,45,912,923,One:46,TGS:375,396,397,398,399,401,THE:932,The:14,32,36,Using:15,890,abbrevi:884,about:23,32,absolut:884,acceptor:43,access:924,account:35,166,924,acl:19,34,acquir:15,271,272,275,276,277,278,279,398,ad_type_extern:428,ad_type_field_type_mask:429,ad_type_regist:430,ad_type_reserv:431,add:34,120,300,330,343,413,415,416,add_entri:11,add_mkei:6,add_polici:3,23,add_princip:3,23,addit:31,126,224,347,address:25,52,53,54,62,64,82,172,198,240,329,addrtype_addrport:418,addrtype_chao:419,addrtype_ddp:420,addrtype_inet6:422,addrtype_inet:421,addrtype_ipport:423,addrtype_is_loc:425,addrtype_iso:424,addrtype_netbio:426,addrtype_xn:427,adjust:393,admin:39,41,administr:1,23,30,34,advanc:13,advic:32,38,aead:43,100,103,288,290,against:410,alia:192,all:329,alloc:106,212,214,219,236,allow:55,167,244,allow_weak_crypto:55,also:2,3,4,5,6,7,8,9,10,11,12,19,20,21,927,928,929,930,931,932,933,934,935,937,938,939,alter:883,ani:165,anonym:37,46,57,58,241,anoth:179,answer:366,369,370,ap_opts_etype_negoti:432,ap_opts_mutual_requir:433,ap_opts_reserv:434,ap_opts_use_session_kei:435,ap_opts_use_subkei:436,ap_opts_wire_mask:437,api:44,48,417,894,appdefault:21,59,60,applic:14,15,32,38,45,55,archiv:922,argument:92,ark:6,armor:246,247,arrai:98,114,130,172,198,200,204,211,220,263,295,299,322,334,ask:253,asn:185,assign:200,218,attack:25,attribut:43,335,auth:62,63,64,65,67,68,69,71,72,73,74,76,77,79,80,81,82,84,85,86,87,88,89,90,authdata:913,authent:16,23,41,65,78,200,932,author:28,37,173,184,189,195,317,318,319,408,907,913,914,918,932,939,autoconf:890,avail:23,awai:26,back:17,22,background:0,887,backup:17,behavior:19,38,berkelei:24,between:44,binari:890,block:95,buffer:330,332,334,bug:939,build:57,91,92,93,890,891,894,built:285,cach:71,85,132,133,134,135,136,137,139,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,246,250,251,265,380,883,887,896,901,906,call:48,callback:46,63,80,245,383,cannot:41,canonic:38,194,242,capath:21,caus:79,ccach:138,247,883,ccselect:21,906,cert:41,certauth:21,907,certif:37,41,335,907,cf2:107,chain:41,challeng:362,chang:23,166,169,243,924,change_password:3,23,channel:922,check:165,167,284,311,checksum:63,80,81,96,109,110,111,113,114,127,129,130,170,204,294,295,298,299,387,choos:26,cipher:79,95,106,108,cksumtype_cmac_camellia128:438,cksumtype_cmac_camellia256:439,cksumtype_crc32:440,cksumtype_descbc:441,cksumtype_hmac_md5_arcfour:442,cksumtype_hmac_sha1_96_aes128:443,cksumtype_hmac_sha1_96_aes256:444,cksumtype_hmac_sha1_des3:445,cksumtype_hmac_sha256_128_aes128:446,cksumtype_hmac_sha384_192_aes256:447,cksumtype_md5_hmac_arcfour:448,cksumtype_nist_sha:449,cksumtype_rsa_md4:450,cksumtype_rsa_md4_d:451,cksumtype_rsa_md5:452,cksumtype_rsa_md5_d:453,clean:890,clear:171,clear_list:11,client:15,29,33,37,132,301,372,886,908,clock:15,167,close:133,302,clpreauth:21,908,code:228,343,376,413,414,415,416,collect:122,161,162,163,164,165,883,collis:109,combin:107,command:3,5,6,11,926,common:12,commonli:892,compar:52,105,345,346,347,359,compat:26,complet:417,compon:346,comput:104,107,113,294,concept:885,909,conf:20,21,34,59,60,config:931,936,configur:15,18,22,26,28,29,33,34,35,36,37,39,141,155,262,282,283,892,896,920,connect:41,62,consider:36,882,constrain:43,contain:165,189,311,363,content:18,31,181,203,206,209,216,217,891,912,context:62,63,64,65,67,68,69,71,72,73,74,76,77,78,79,80,81,82,84,85,86,87,88,89,90,171,179,205,262,263,266,268,269,270,271,272,273,274,275,282,362,363,370,374,393,396,397,398,399,400,932,contribut:0,conveni:48,convert:49,50,51,56,125,126,170,187,192,193,341,342,344,371,387,388,389,391,392,394,395,402,403,404,405,cooki:897,copi:134,172,173,174,175,176,177,178,179,180,181,182,183,293,copyright:895,correct:15,count:93,291,297,creat:5,6,23,34,37,41,78,149,268,269,275,282,286,326,327,335,400,932,create_polici:5,cred:223,320,322,351,credenti:15,41,43,46,51,132,133,134,135,136,137,139,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,220,235,236,237,238,240,241,242,243,244,245,246,247,248,249,250,251,252,254,255,256,257,258,259,260,264,267,270,271,272,273,274,275,276,277,278,279,320,322,327,379,380,397,398,400,410,411,412,883,896,906,cross:23,current:167,393,cursor:162,306,daemon:34,dai:406,data:58,99,100,101,102,103,104,124,173,184,189,195,198,200,209,286,287,288,289,290,318,319,362,408,913,databas:3,14,17,23,24,34,39,913,datatyp:417,date:23,884,db2:24,dbdefault:20,dbmodul:20,dce:325,355,decis:39,declar:791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,decod:185,352,365,368,decrement:291,decrypt:99,100,287,288,354,355,356,373,defin:36,del_str:3,deleg:43,delet:23,delete_entri:11,delete_polici:3,23,delete_princip:3,23,delta:388,deprec:48,775,deriv:101,descript:2,3,4,5,6,7,8,9,10,11,12,19,927,928,929,930,931,932,933,934,935,937,938,939,destroi:5,6,23,137,925,destroy_polici:5,determin:160,317,develop:43,45,912,dictionari:25,differ:23,44,415,416,direct:384,directli:48,directori:889,890,892,discoveri:39,document:0,884,894,902,domain_realm:21,dump:6,23,duplic:138,305,durat:884,dure:41,each:34,edit:34,effect:932,element:114,130,195,295,299,empti:280,335,encod:318,321,336,encrypt:20,26,41,97,102,103,104,105,111,115,118,128,192,193,211,244,261,289,290,324,325,375,389,enctyp:26,115,117,124,229,286,292,296,enctype_aes128_cts_hmac_sha1_96:454,enctype_aes128_cts_hmac_sha256_128:455,enctype_aes256_cts_hmac_sha1_96:456,enctype_aes256_cts_hmac_sha384_192:457,enctype_arcfour_hmac:458,enctype_arcfour_hmac_exp:459,enctype_camellia128_cts_cmac:460,enctype_camellia256_cts_cmac:461,enctype_des3_cbc_env:462,enctype_des3_cbc_raw:463,enctype_des3_cbc_sha1:465,enctype_des3_cbc_sha:464,enctype_des_cbc_crc:466,enctype_des_cbc_md4:467,enctype_des_cbc_md5:468,enctype_des_cbc_raw:469,enctype_des_hmac_sha1:470,enctype_dsa_sha1_cm:471,enctype_md5_rsa_cm:472,enctype_nul:473,enctype_rc2_cbc_env:474,enctype_rsa_env:475,enctype_rsa_es_oaep_env:476,enctype_sha1_rsa_cm:477,enctype_unknown:478,end:22,entri:139,150,217,300,308,311,312,314,316,896,900,entropi:120,122,environ:2,3,4,5,6,7,8,9,10,11,12,27,892,927,928,929,930,932,933,934,935,939,epoch:406,error:12,41,171,179,212,213,228,273,343,352,376,413,414,415,416,event:383,384,everi:158,exampl:10,11,15,19,23,46,892,931,937,938,exchang:41,401,execut:932,exist:166,264,311,expans:21,expir:41,245,extend:171,179,228,376,414,extens:43,fact:904,fail:34,41,fast:238,246,247,248,featur:892,904,field:64,83,84,97,209,381,382,file:8,18,20,21,23,32,33,34,282,384,888,896,899,900,901,927,928,929,933,934,936,fill:98,114,295,find:132,195,fine:892,finish:139,firewal:15,flag:66,83,142,157,238,241,242,243,248,249,255,342,347,404,405,format:23,185,223,320,321,322,323,324,325,328,405,884,896,897,899,900,901,forward:223,249,free:61,106,162,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,237,270,291,331,364,367,396,frequent:41,48,fresh:37,898,from:14,15,23,26,59,60,62,63,64,65,66,67,68,69,71,72,73,74,76,77,122,124,141,142,150,151,153,179,229,238,262,263,264,266,267,272,273,274,286,293,308,312,313,314,332,340,358,386,398,399,400,894,909,full:143,386,gener:37,62,115,117,119,120,121,124,213,265,296,386,903,909,get:15,41,46,63,118,141,145,164,169,223,224,228,231,235,260,263,264,267,273,279,304,308,309,315,400,401,get_init_cr:46,get_polici:3,23,get_princip:3,23,get_str:3,getdat:884,given:362,grant:400,924,gssapi:28,43,910,guid:31,handl:133,138,302,305,315,330,331,334,335,336,has:41,header:98,896,heimdal:44,hin:893,histori:3,14,23,939,hit:291,hook:377,378,915,host:17,28,32,34,41,231,329,911,hostnam:39,194,hostrealm:21,911,how:894,http:29,ident:21,369,ignor:346,includ:253,increment:23,34,297,indic:16,inform:15,21,23,887,905,initi:41,43,46,78,108,147,235,236,237,238,240,241,242,243,244,245,246,247,248,249,250,251,252,254,255,256,257,258,259,260,270,271,272,273,274,275,276,277,278,279,280,410,411,input:101,250,358,instal:31,33,34,890,892,932,instanc:36,instruct:932,interact:46,interfac:21,48,329,906,907,908,910,911,913,914,915,916,917,918,919,920,921,intern:790,913,interoper:904,interpos:910,iov:43,98,114,130,295,299,irc:922,iter:163,its:161,k5ident:937,k5login:938,k5srvutil:2,kadm5:19,915,kadm5_auth:21,914,kadm5_hook:21,915,kadmin:3,23,914,kadmind:4,909,kdb5_ldap_util:5,kdb5_util:6,kdb:913,kdc:14,20,28,34,35,37,39,41,229,253,264,267,273,279,377,378,400,401,897,903,909,916,917,kdc_opt_allow_postd:479,kdc_opt_canonic:480,kdc_opt_cname_in_addl_tkt:481,kdc_opt_disable_transited_check:482,kdc_opt_enc_tkt_in_skei:483,kdc_opt_forward:484,485,kdc_opt_postd:486,kdc_opt_proxi:487,488,kdc_opt_renew:489,490,kdc_opt_renewable_ok:491,kdc_opt_request_anonym:492,kdc_opt_valid:493,kdc_tkt_common_mask:494,kdcdefault:20,kdcissu:318,408,kdcpolici:916,kdcpreauth:21,917,kdestroi:925,927,kei:14,23,26,67,68,90,99,101,102,107,110,111,112,115,124,125,126,217,235,261,286,287,288,289,290,291,294,295,296,297,298,299,300,301,302,303,304,308,309,310,312,313,314,315,316,373,900,kerbero:0,15,17,22,23,34,39,44,49,50,51,52,127,128,166,231,285,885,891,902,903,904,905,913,925,939,keyblock:67,72,73,76,86,88,99,100,102,103,113,114,129,130,180,181,286,293,keyboard:358,keysalt:20,keytab:15,32,34,38,276,305,306,311,410,886,900,kinit:925,928,kldap:24,klist:925,929,klmdb:24,known:163,kpasswd:930,kprop:7,41,kpropd:8,kproplog:9,krb524_convert_creds_kdc:776,krb524_init_et:777,krb5:21,34,48,59,60,205,219,268,269,282,775,790,931,krb5_425_conv_princip:49,krb5_524_conv_princip:50,krb5_524_convert_cr:51,krb5_address:791,krb5_address_compar:52,krb5_address_ord:53,krb5_address_search:54,krb5_addrtyp:792,krb5_allow_weak_crypto:55,krb5_altauth_att_challenge_respons:495,krb5_aname_to_localnam:56,krb5_anonymous_princip:57,krb5_anonymous_princstr:496,krb5_anonymous_realm:58,krb5_anonymous_realmstr:497,krb5_ap_rep:498,793,krb5_ap_rep_enc_part:199,794,krb5_ap_req:499,795,krb5_appdefault_boolean:59,krb5_appdefault_str:60,krb5_as_rep:500,krb5_as_req:501,krb5_auth_con_fre:61,krb5_auth_con_genaddr:62,krb5_auth_con_get_checksum_func:63,krb5_auth_con_getaddr:64,krb5_auth_con_getauthent:65,krb5_auth_con_getflag:66,krb5_auth_con_getkei:67,krb5_auth_con_getkey_k:68,krb5_auth_con_getlocalseqnumb:69,krb5_auth_con_getlocalsubkei:70,krb5_auth_con_getrcach:71,krb5_auth_con_getrecvsubkei:72,krb5_auth_con_getrecvsubkey_k:73,krb5_auth_con_getremoteseqnumb:74,krb5_auth_con_getremotesubkei:75,krb5_auth_con_getsendsubkei:76,krb5_auth_con_getsendsubkey_k:77,krb5_auth_con_init:78,krb5_auth_con_initivector:79,krb5_auth_con_set_checksum_func:80,krb5_auth_con_set_req_cksumtyp:81,krb5_auth_con_setaddr:82,krb5_auth_con_setflag:83,krb5_auth_con_setport:84,krb5_auth_con_setrcach:85,krb5_auth_con_setrecvsubkei:86,krb5_auth_con_setrecvsubkey_k:87,krb5_auth_con_setsendsubkei:88,krb5_auth_con_setsendsubkey_k:89,krb5_auth_con_setuseruserkei:90,krb5_auth_context:61,66,83,796,krb5_auth_context_do_sequ:516,krb5_auth_context_do_tim:517,krb5_auth_context_generate_local_addr:518,krb5_auth_context_generate_local_full_addr:519,krb5_auth_context_generate_remote_addr:520,krb5_auth_context_generate_remote_full_addr:521,krb5_auth_context_permit_al:522,krb5_auth_context_ret_sequ:523,krb5_auth_context_ret_tim:524,krb5_auth_context_use_subkei:525,krb5_authdata:797,krb5_authdata_and_or:502,krb5_authdata_ap_opt:503,krb5_authdata_auth_ind:504,krb5_authdata_cammac:505,krb5_authdata_etype_negoti:506,krb5_authdata_fx_armor:507,krb5_authdata_if_relev:508,krb5_authdata_initial_verified_ca:509,krb5_authdata_kdc_issu:510,krb5_authdata_mandatory_for_kdc:511,krb5_authdata_osf_dc:512,krb5_authdata_sesam:513,krb5_authdata_signticket:514,krb5_authdata_win2k_pac:515,krb5_authdatatyp:798,krb5_authent:174,201,799,krb5_boolean:800,krb5_build_princip:91,krb5_build_principal_alloc_va:92,krb5_build_principal_ext:93,krb5_build_principal_va:94,krb5_c_block_siz:95,krb5_c_checksum_length:96,krb5_c_crypto_length:97,krb5_c_crypto_length_iov:98,krb5_c_decrypt:99,krb5_c_decrypt_iov:100,krb5_c_derive_prfplu:101,krb5_c_encrypt:102,krb5_c_encrypt_iov:103,krb5_c_encrypt_length:104,krb5_c_enctype_compar:105,krb5_c_free_stat:106,krb5_c_fx_cf2_simpl:107,krb5_c_init_st:106,108,krb5_c_is_coll_proof_cksum:109,krb5_c_is_keyed_cksum:110,krb5_c_keyed_checksum_typ:111,krb5_c_keylength:112,krb5_c_make_checksum:113,krb5_c_make_checksum_iov:114,krb5_c_make_random_kei:115,krb5_c_padding_length:116,krb5_c_prf:117,krb5_c_prf_length:118,krb5_c_prfplu:119,krb5_c_random_add_entropi:120,krb5_c_random_make_octet:121,krb5_c_random_os_entropi:122,krb5_c_random_se:123,krb5_c_random_to_kei:124,krb5_c_string_to_kei:125,krb5_c_string_to_key_with_param:126,krb5_c_valid_cksumtyp:127,krb5_c_valid_enctyp:128,krb5_c_verify_checksum:129,krb5_c_verify_checksum_iov:130,krb5_calculate_checksum:131,krb5_cc_cache_match:132,krb5_cc_close:133,krb5_cc_copy_cr:134,krb5_cc_cursor:801,krb5_cc_default:135,krb5_cc_default_nam:136,krb5_cc_destroi:137,krb5_cc_dup:138,krb5_cc_end_seq_get:139,krb5_cc_gen_new:140,krb5_cc_get_config:141,krb5_cc_get_flag:142,krb5_cc_get_full_nam:143,krb5_cc_get_nam:144,krb5_cc_get_princip:145,krb5_cc_get_typ:146,krb5_cc_initi:147,krb5_cc_move:148,krb5_cc_new_uniqu:149,krb5_cc_next_cr:150,krb5_cc_remove_cr:151,krb5_cc_resolv:152,krb5_cc_retrieve_cr:153,krb5_cc_select:154,krb5_cc_set_config:155,krb5_cc_set_default_nam:156,krb5_cc_set_flag:157,krb5_cc_start_seq_get:158,krb5_cc_store_cr:159,krb5_cc_support_switch:160,krb5_cc_switch:161,krb5_ccach:802,krb5_cccol_cursor:803,krb5_cccol_cursor_fre:162,krb5_cccol_cursor_new:163,krb5_cccol_cursor_next:164,krb5_cccol_have_cont:165,krb5_change_password:166,krb5_check_clockskew:167,krb5_checksum:175,202,203,804,krb5_checksum_s:168,krb5_chpw_messag:169,krb5_cksumtyp:805,krb5_cksumtype_to_str:170,krb5_clear_error_messag:171,krb5_const:778,krb5_const_point:806,krb5_const_princip:807,krb5_context:176,375,382,808,krb5_copy_address:172,krb5_copy_authdata:173,krb5_copy_authent:174,krb5_copy_checksum:175,krb5_copy_context:176,krb5_copy_cr:177,krb5_copy_data:178,krb5_copy_error_messag:179,krb5_copy_keyblock:180,krb5_copy_keyblock_cont:181,krb5_copy_princip:182,krb5_copy_ticket:183,krb5_cred:177,206,207,526,809,812,krb5_cred_enc_part:810,krb5_cred_info:811,krb5_crypto_iov:813,krb5_crypto_type_checksum:527,krb5_crypto_type_data:528,krb5_crypto_type_empti:529,krb5_crypto_type_head:530,krb5_crypto_type_pad:531,krb5_crypto_type_sign_onli:532,krb5_crypto_type_stream:533,krb5_crypto_type_trail:534,krb5_cryptotyp:814,krb5_cybersafe_secureid:535,krb5_data:178,208,209,815,krb5_decode_authdata_contain:184,krb5_decode_ticket:185,krb5_decrypt:186,krb5_deltat:816,krb5_deltat_to_str:187,krb5_domain_x500_compress:536,krb5_eblock_enctyp:188,krb5_enc_data:817,krb5_enc_kdc_rep_part:818,krb5_enc_tkt_part:819,krb5_encode_authdata_contain:189,krb5_encpadata_req_enc_pa_rep:537,krb5_encrypt:190,krb5_encrypt_block:820,krb5_encrypt_s:191,krb5_enctyp:821,krb5_enctype_to_nam:192,krb5_enctype_to_str:193,krb5_error:538,822,krb5_error_cod:823,krb5_expand_hostnam:194,krb5_expire_callback_func:824,krb5_fast_requir:539,krb5_find_authdata:195,krb5_finish_kei:196,krb5_finish_random_kei:197,krb5_flag:825,krb5_free_address:198,krb5_free_ap_rep_enc_part:199,krb5_free_authdata:200,krb5_free_authent:201,krb5_free_checksum:202,krb5_free_checksum_cont:203,krb5_free_cksumtyp:204,krb5_free_context:205,krb5_free_cr:207,krb5_free_cred_cont:206,krb5_free_data:208,krb5_free_data_cont:209,krb5_free_default_realm:210,krb5_free_enctyp:211,krb5_free_error:212,krb5_free_error_messag:213,krb5_free_host_realm:214,krb5_free_keyblock:215,krb5_free_keyblock_cont:216,krb5_free_keytab_entry_cont:217,krb5_free_princip:218,krb5_free_str:219,krb5_free_tgt_cr:220,krb5_free_ticket:221,krb5_free_unparsed_nam:222,krb5_fwd_tgt_cred:223,krb5_gc_cach:540,krb5_gc_canonic:541,krb5_gc_constrained_deleg:542,krb5_gc_forward:543,krb5_gc_no_stor:544,krb5_gc_no_transit_check:545,krb5_gc_user_us:546,krb5_get_credenti:224,krb5_get_credentials_renew:225,krb5_get_credentials_valid:226,krb5_get_default_realm:210,227,krb5_get_error_messag:213,228,krb5_get_etype_info:229,krb5_get_fallback_host_realm:230,krb5_get_host_realm:214,231,krb5_get_in_tkt_with_keytab:232,krb5_get_in_tkt_with_password:233,krb5_get_in_tkt_with_skei:234,krb5_get_init_creds_keytab:235,krb5_get_init_creds_opt:826,krb5_get_init_creds_opt_address_list:547,krb5_get_init_creds_opt_alloc:236,krb5_get_init_creds_opt_anonym:548,krb5_get_init_creds_opt_canonic:549,krb5_get_init_creds_opt_chg_pwd_prmpt:550,krb5_get_init_creds_opt_etype_list:551,krb5_get_init_creds_opt_forward:552,krb5_get_init_creds_opt_fre:237,krb5_get_init_creds_opt_get_fast_flag:238,krb5_get_init_creds_opt_init:239,krb5_get_init_creds_opt_preauth_list:553,krb5_get_init_creds_opt_proxi:554,krb5_get_init_creds_opt_renew_lif:555,krb5_get_init_creds_opt_salt:556,krb5_get_init_creds_opt_set_address_list:240,krb5_get_init_creds_opt_set_anonym:241,krb5_get_init_creds_opt_set_canonic:242,krb5_get_init_creds_opt_set_change_password_prompt:243,krb5_get_init_creds_opt_set_etype_list:244,krb5_get_init_creds_opt_set_expire_callback:245,krb5_get_init_creds_opt_set_fast_ccach:246,krb5_get_init_creds_opt_set_fast_ccache_nam:247,krb5_get_init_creds_opt_set_fast_flag:248,krb5_get_init_creds_opt_set_forward:249,krb5_get_init_creds_opt_set_in_ccach:250,krb5_get_init_creds_opt_set_out_ccach:251,krb5_get_init_creds_opt_set_pa:252,krb5_get_init_creds_opt_set_pac_request:253,krb5_get_init_creds_opt_set_preauth_list:254,krb5_get_init_creds_opt_set_proxi:255,krb5_get_init_creds_opt_set_renew_lif:256,krb5_get_init_creds_opt_set_respond:257,krb5_get_init_creds_opt_set_salt:258,krb5_get_init_creds_opt_set_tkt_lif:259,krb5_get_init_creds_opt_tkt_lif:557,krb5_get_init_creds_password:260,krb5_get_permitted_enctyp:261,krb5_get_profil:262,krb5_get_prompt_typ:263,krb5_get_renewed_cr:264,krb5_get_server_rcach:265,krb5_get_time_offset:266,krb5_get_validated_cr:267,krb5_gic_opt_pa_data:827,krb5_init_context:268,krb5_init_context_kdc:558,krb5_init_context_profil:269,krb5_init_context_secur:559,krb5_init_creds_context:828,krb5_init_creds_fre:270,krb5_init_creds_get:271,krb5_init_creds_get_cr:272,krb5_init_creds_get_error:273,krb5_init_creds_get_tim:274,krb5_init_creds_init:275,krb5_init_creds_set_keytab:276,krb5_init_creds_set_password:277,krb5_init_creds_set_servic:278,krb5_init_creds_step:279,krb5_init_creds_step_flag_continu:560,krb5_init_keyblock:280,krb5_init_random_kei:281,krb5_init_secure_context:282,krb5_int16:829,krb5_int16_max:561,krb5_int16_min:562,krb5_int32:830,krb5_int32_max:563,krb5_int32_min:564,krb5_is_config_princip:283,krb5_is_referral_realm:284,krb5_is_thread_saf:285,krb5_k_create_kei:286,krb5_k_decrypt:287,krb5_k_decrypt_iov:288,krb5_k_encrypt:289,krb5_k_encrypt_iov:290,krb5_k_free_kei:291,krb5_k_key_enctyp:292,krb5_k_key_keyblock:293,krb5_k_make_checksum:294,krb5_k_make_checksum_iov:295,krb5_k_prf:296,krb5_k_reference_kei:297,krb5_k_verify_checksum:298,krb5_k_verify_checksum_iov:299,krb5_kdc_rep:831,krb5_kdc_req:832,krb5_kei:286,292,293,833,krb5_keyblock:215,216,280,834,krb5_keytab:835,krb5_keytab_entri:836,krb5_keyusag:837,krb5_keyusage_ad_it:565,krb5_keyusage_ad_kdcissued_cksum:566,krb5_keyusage_ad_mt:567,krb5_keyusage_ad_signedpath:568,krb5_keyusage_ap_rep_encpart:571,krb5_keyusage_ap_req_auth:572,krb5_keyusage_ap_req_auth_cksum:573,krb5_keyusage_app_data_cksum:569,krb5_keyusage_app_data_encrypt:570,krb5_keyusage_as_rep_encpart:574,krb5_keyusage_as_req:575,krb5_keyusage_as_req_pa_enc_t:576,krb5_keyusage_cammac:577,krb5_keyusage_enc_challenge_cli:578,krb5_keyusage_enc_challenge_kdc:579,krb5_keyusage_fast_enc:580,krb5_keyusage_fast_finish:581,krb5_keyusage_fast_rep:582,krb5_keyusage_fast_req_chksum:583,krb5_keyusage_gss_tok_m:584,krb5_keyusage_gss_tok_wrap_integ:585,krb5_keyusage_gss_tok_wrap_priv:586,krb5_keyusage_iakerb_finish:587,krb5_keyusage_kdc_rep_ticket:588,krb5_keyusage_krb_cred_encpart:589,krb5_keyusage_krb_error_cksum:590,krb5_keyusage_krb_priv_encpart:591,krb5_keyusage_krb_safe_cksum:592,krb5_keyusage_pa_as_fresh:593,krb5_keyusage_pa_fx_cooki:594,krb5_keyusage_pa_otp_request:595,krb5_keyusage_pa_pkinit_kx:596,krb5_keyusage_pa_s4u_x509_user_repli:597,krb5_keyusage_pa_s4u_x509_user_request:598,krb5_keyusage_pa_sam_challenge_cksum:599,krb5_keyusage_pa_sam_challenge_trackid:600,krb5_keyusage_pa_sam_respons:601,krb5_keyusage_spak:602,krb5_keyusage_tgs_rep_encpart_sesskei:603,krb5_keyusage_tgs_rep_encpart_subkei:604,krb5_keyusage_tgs_req_ad_sesskei:605,krb5_keyusage_tgs_req_ad_subkei:606,krb5_keyusage_tgs_req_auth:607,krb5_keyusage_tgs_req_auth_cksum:608,krb5_kpasswd_accessdeni:609,krb5_kpasswd_autherror:610,krb5_kpasswd_bad_vers:611,krb5_kpasswd_harderror:612,krb5_kpasswd_initial_flag_need:613,krb5_kpasswd_malform:614,krb5_kpasswd_softerror:615,krb5_kpasswd_success:616,krb5_kt_add_entri:300,krb5_kt_client_default:301,krb5_kt_close:302,krb5_kt_cursor:838,krb5_kt_default:303,krb5_kt_default_nam:304,krb5_kt_dup:305,krb5_kt_end_seq_get:306,krb5_kt_free_entri:307,krb5_kt_get_entri:308,krb5_kt_get_nam:309,krb5_kt_get_typ:310,krb5_kt_have_cont:311,krb5_kt_next_entri:312,krb5_kt_read_service_kei:313,krb5_kt_remove_entri:314,krb5_kt_resolv:315,krb5_kt_start_seq_get:316,krb5_kuserok:317,krb5_kvno:839,krb5_last_req_entri:840,krb5_lrq_all_acct_exptim:617,krb5_lrq_all_last_initi:618,krb5_lrq_all_last_renew:619,krb5_lrq_all_last_req:620,krb5_lrq_all_last_tgt:621,krb5_lrq_all_last_tgt_issu:622,krb5_lrq_all_pw_exptim:623,krb5_lrq_none:624,krb5_lrq_one_acct_exptim:625,krb5_lrq_one_last_initi:626,krb5_lrq_one_last_renew:627,krb5_lrq_one_last_req:628,krb5_lrq_one_last_tgt:629,krb5_lrq_one_last_tgt_issu:630,krb5_lrq_one_pw_exptim:631,krb5_magic:841,krb5_make_authdata_kdc_issu:318,krb5_merge_authdata:319,krb5_mk_1cred:320,krb5_mk_error:321,krb5_mk_ncred:322,krb5_mk_priv:323,krb5_mk_rep:324,krb5_mk_rep_dc:325,krb5_mk_req:326,krb5_mk_req_checksum_func:842,krb5_mk_req_extend:327,krb5_mk_safe:328,krb5_msgtype:843,krb5_nt_ent_principal_and_id:633,krb5_nt_enterprise_princip:632,krb5_nt_ms_princip:634,krb5_nt_ms_principal_and_id:635,krb5_nt_princip:636,krb5_nt_smtp_name:637,krb5_nt_srv_hst:638,krb5_nt_srv_inst:639,krb5_nt_srv_xhst:640,krb5_nt_uid:641,krb5_nt_unknown:642,krb5_nt_wellknown:643,krb5_nt_x500_princip:644,krb5_octet:844,krb5_os_localaddr:329,krb5_pa_data:845,krb5_pa_pac_req:846,krb5_pa_server_referral_data:847,krb5_pa_svr_referral_data:848,krb5_pac:849,krb5_pac_add_buff:330,krb5_pac_client_info:645,krb5_pac_credentials_info:646,krb5_pac_delegation_info:647,krb5_pac_fre:331,krb5_pac_get_buff:332,krb5_pac_get_client_info:333,krb5_pac_get_typ:334,krb5_pac_init:335,krb5_pac_logon_info:648,krb5_pac_pars:336,krb5_pac_privsvr_checksum:649,krb5_pac_server_checksum:650,krb5_pac_sign:337,krb5_pac_sign_ext:338,krb5_pac_upn_dns_info:651,krb5_pac_verifi:339,krb5_pac_verify_ext:340,krb5_padata_afs3_salt:652,krb5_padata_ap_req:653,krb5_padata_as_checksum:654,krb5_padata_as_fresh:655,krb5_padata_enc_sandia_securid:657,krb5_padata_enc_timestamp:658,krb5_padata_enc_unix_tim:659,krb5_padata_encrypted_challeng:656,krb5_padata_etype_info2:661,krb5_padata_etype_info:660,krb5_padata_for_us:662,krb5_padata_fx_cooki:663,krb5_padata_fx_error:664,krb5_padata_fx_fast:665,krb5_padata_get_from_typed_data:666,krb5_padata_non:667,krb5_padata_osf_dc:668,krb5_padata_otp_challeng:669,krb5_padata_otp_pin_chang:670,krb5_padata_otp_request:671,krb5_padata_pac_opt:672,krb5_padata_pac_request:673,krb5_padata_pk_as_rep:675,krb5_padata_pk_as_rep_old:676,krb5_padata_pk_as_req:677,krb5_padata_pk_as_req_old:678,krb5_padata_pkinit_kx:674,krb5_padata_pw_salt:679,krb5_padata_referr:680,krb5_padata_s4u_x509_us:681,krb5_padata_sam_challeng:682,krb5_padata_sam_challenge_2:683,krb5_padata_sam_redirect:684,krb5_padata_sam_respons:685,krb5_padata_sam_response_2:686,krb5_padata_sesam:687,krb5_padata_spak:688,krb5_padata_svr_referral_info:689,krb5_padata_tgs_req:690,krb5_padata_use_specified_kvno:691,krb5_parse_nam:341,krb5_parse_name_flag:342,krb5_pointer:850,krb5_post_recv_fn:851,krb5_pre_send_fn:852,krb5_preauthtyp:853,krb5_prepend_error_messag:343,krb5_princ_compon:779,krb5_princ_nam:780,krb5_princ_realm:781,krb5_princ_set_realm:782,krb5_princ_set_realm_data:783,krb5_princ_set_realm_length:784,krb5_princ_siz:785,krb5_princ_typ:786,krb5_princip:341,342,402,403,404,405,854,krb5_principal2salt:344,krb5_principal_compar:345,krb5_principal_compare_any_realm:346,krb5_principal_compare_casefold:692,krb5_principal_compare_enterpris:693,krb5_principal_compare_flag:347,krb5_principal_compare_ignore_realm:694,krb5_principal_compare_utf8:695,krb5_principal_data:855,krb5_principal_parse_enterpris:696,krb5_principal_parse_ignore_realm:697,krb5_principal_parse_no_def_realm:698,krb5_principal_parse_no_realm:699,krb5_principal_parse_require_realm:700,krb5_principal_unparse_displai:701,krb5_principal_unparse_no_realm:702,krb5_principal_unparse_short:703,krb5_priv:704,krb5_process_kei:348,krb5_prompt:856,krb5_prompt_typ:857,krb5_prompt_type_new_password:705,krb5_prompt_type_new_password_again:706,krb5_prompt_type_password:707,krb5_prompt_type_preauth:708,krb5_prompter_fct:858,krb5_prompter_posix:349,krb5_pvno:709,krb5_pwd_data:859,krb5_random_kei:350,krb5_rcach:860,krb5_rd_cred:351,krb5_rd_error:352,krb5_rd_priv:353,krb5_rd_rep:354,krb5_rd_rep_dc:355,krb5_rd_req:356,krb5_rd_safe:357,krb5_read_error:212,krb5_read_password:358,krb5_realm_branch_char:710,krb5_realm_compar:359,krb5_recvauth:360,krb5_recvauth_badauthv:711,krb5_recvauth_skip_vers:712,krb5_recvauth_vers:361,krb5_referral_realm:284,713,krb5_replay_data:861,krb5_responder_context:862,krb5_responder_fn:863,krb5_responder_get_challeng:362,krb5_responder_list_quest:363,krb5_responder_otp_challeng:864,krb5_responder_otp_challenge_fre:364,krb5_responder_otp_flags_collect_pin:714,krb5_responder_otp_flags_collect_token:715,krb5_responder_otp_flags_nextotp:716,krb5_responder_otp_flags_separate_pin:717,krb5_responder_otp_format_alphanumer:718,krb5_responder_otp_format_decim:719,krb5_responder_otp_format_hexadecim:720,krb5_responder_otp_get_challeng:364,365,krb5_responder_otp_set_answ:366,krb5_responder_otp_tokeninfo:865,krb5_responder_pkinit_challeng:866,krb5_responder_pkinit_challenge_fre:367,krb5_responder_pkinit_flags_token_user_pin_count_low:721,krb5_responder_pkinit_flags_token_user_pin_final_tri:722,krb5_responder_pkinit_flags_token_user_pin_lock:723,krb5_responder_pkinit_get_challeng:367,368,krb5_responder_pkinit_ident:867,krb5_responder_pkinit_set_answ:369,krb5_responder_question_otp:365,366,724,krb5_responder_question_password:725,krb5_responder_question_pkinit:368,369,726,krb5_responder_set_answ:370,krb5_respons:868,krb5_roundup:787,krb5_safe:727,krb5_salttype_to_str:371,krb5_sam_must_pk_encrypt_sad:728,krb5_sam_send_encrypted_sad:729,krb5_sam_use_sad_as_kei:730,krb5_sendauth:212,372,krb5_server_decrypt_ticket_keytab:373,krb5_set_default_realm:374,krb5_set_default_tgs_enctyp:375,krb5_set_error_messag:376,krb5_set_kdc_recv_hook:377,krb5_set_kdc_send_hook:378,krb5_set_password:379,krb5_set_password_using_ccach:380,krb5_set_principal_realm:381,krb5_set_real_tim:382,krb5_set_trace_callback:383,krb5_set_trace_filenam:384,krb5_sname_match:385,krb5_sname_to_princip:386,krb5_string_to_cksumtyp:387,krb5_string_to_deltat:388,krb5_string_to_enctyp:389,krb5_string_to_kei:390,krb5_string_to_salttyp:391,krb5_string_to_timestamp:392,krb5_tc_match_2nd_tkt:731,krb5_tc_match_authdata:732,krb5_tc_match_flag:733,krb5_tc_match_flags_exact:734,krb5_tc_match_is_skei:735,krb5_tc_match_ktyp:736,krb5_tc_match_srv_nameonli:737,krb5_tc_match_tim:738,krb5_tc_match_times_exact:739,krb5_tc_noticket:740,krb5_tc_openclos:741,krb5_tc_supported_ktyp:742,krb5_tgs_name:743,krb5_tgs_name_s:744,krb5_tgs_rep:745,krb5_tgs_req:746,krb5_ticket:183,869,krb5_ticket_tim:870,krb5_timeofdai:393,krb5_timestamp:871,882,krb5_timestamp_to_sfstr:394,krb5_timestamp_to_str:395,krb5_tkt_authent:872,krb5_tkt_creds_context:873,krb5_tkt_creds_fre:396,krb5_tkt_creds_get:397,krb5_tkt_creds_get_cr:398,krb5_tkt_creds_get_tim:399,krb5_tkt_creds_init:400,krb5_tkt_creds_step:401,krb5_tkt_creds_step_flag_continu:747,krb5_trace_callback:874,krb5_trace_info:875,krb5_transit:876,krb5_typed_data:877,krb5_ui_2:878,krb5_ui_4:879,krb5_unparse_nam:402,krb5_unparse_name_ext:403,krb5_unparse_name_flag:404,krb5_unparse_name_flags_ext:405,krb5_us_timeofdai:406,krb5_use_enctyp:407,krb5_verify_authdata_kdc_issu:408,krb5_verify_checksum:409,krb5_verify_init_cr:410,krb5_verify_init_creds_opt:880,krb5_verify_init_creds_opt_ap_req_nofail:748,krb5_verify_init_creds_opt_init:411,krb5_verify_init_creds_opt_set_ap_req_nofail:412,krb5_vprepend_error_messag:413,krb5_vset_error_messag:414,krb5_vwrap_error_messag:415,krb5_wellknown_namestr:749,krb5_wrap_error_messag:416,krb5_x:788,krb5_xc:789,krb5kdc:10,krb:107,223,320,322,323,328,351,352,353,357,krb_ap_rep:324,325,354,355,krb_ap_req:326,327,356,krb_error:321,krbtgt:14,23,ksu:932,kswitch:933,ktadd:3,15,ktremov:3,15,ktutil:11,kvno:934,last:273,ldap:23,24,legaci:14,48,length:93,96,97,98,104,112,118,403,lib:889,libdefault:21,librari:205,268,269,282,285,licens:905,lifetim:256,259,lightn:24,like:903,line:5,6,link:42,list:5,11,20,23,41,54,92,111,173,261,319,363,904,922,list_mkei:6,list_polici:3,5,23,list_princip:3,23,list_request:3,11,lndir:890,load:6,local:56,69,82,84,317,918,localauth:21,918,locat:28,247,919,lock:3,lockout:35,log:20,41,317,909,login:28,lr_type_interpretation_mask:750,lr_type_this_server_onli:751,machin:33,macro:775,mail:922,make:161,man:894,manag:924,925,manipul:47,map:24,39,master:14,23,match:284,385,max_keytab_name_len:752,mechan:28,910,member:791,793,794,795,797,799,804,807,809,810,811,812,813,815,817,818,819,820,822,826,827,831,832,834,836,840,845,846,847,848,854,855,856,859,861,864,865,866,867,868,869,870,872,875,876,877,880,881,memori:24,214,merg:319,messag:12,43,97,169,171,179,213,223,228,320,321,322,323,324,325,326,327,328,343,351,352,353,354,355,356,357,376,413,414,415,416,mic:43,migrat:26,mismatch:38,mit:0,23,44,902,903,904,905,modifi:5,23,modify_polici:3,5,23,modify_princip:3,23,modul:19,24,28,909,910,912,most:179,892,move:148,msec_dirbit:753,msec_val_mask:754,multithread:285,name:38,39,43,56,91,92,93,135,136,143,144,149,152,156,192,194,231,304,309,341,342,344,363,370,384,386,883,887,892,negoex:910,next:150,164,279,312,401,note:927,number:69,74,116,120,object:23,178,265,obtain:397,891,925,octet:116,offset:266,382,393,older:26,one:179,369,onli:282,onto:39,opaqu:287,288,289,290,294,295,296,298,299,open:265,openldap:22,oper:23,99,100,102,103,113,114,129,130,287,288,289,290,294,295,296,298,299,optimist:258,option:3,4,5,6,7,8,9,10,20,21,23,46,157,236,237,238,240,241,242,243,244,245,246,247,248,249,250,251,252,254,255,256,257,258,259,394,411,892,927,928,929,930,931,932,933,934,order:53,organ:889,osconf:893,other:36,otp:20,36,output:118,251,394,over:163,overrid:38,55,374,overview:23,pac:253,330,331,332,334,335,336,337,338,339,340,packag:892,894,pad:98,116,394,page:894,922,paramet:21,126,361,pars:47,354,355,356,passwd_phrase_el:881,password:23,46,125,126,166,169,243,260,277,349,358,379,380,921,924,path:903,pepper:107,perform:35,permit:261,pin:46,pkinit:20,21,37,46,898,907,place:100,103,288,290,pluggabl:913,plugin:21,28,909,912,polici:23,916,port:39,84,possibl:122,194,228,338,340,post:377,pre:378,preauthent:36,40,252,254,258,908,917,precomput:92,prefix:343,413,415,416,prepar:158,163,prerequisit:891,previous:106,prf:101,119,primari:34,161,princip:15,23,34,35,38,47,49,50,56,57,91,92,93,132,145,154,182,218,222,278,283,317,341,342,344,345,346,347,359,379,380,381,385,386,896,priv:323,353,privileg:23,335,procedur:14,process:139,353,357,profil:28,55,262,269,920,program:1,892,prompt:243,263,349,prompter:46,proof:109,propag:23,34,39,903,properti:925,protocol:360,361,372,899,provis:38,proxi:29,proxiabl:255,pseudo:117,118,119,120,121,296,purge_mkei:6,purgekei:3,pwqual:21,921,qualiti:921,924,question:46,362,363,366,369,370,quick:904,quit:3,11,random:115,117,118,119,120,121,124,296,rare:48,read:158,351,358,read_kt:11,realm:20,21,23,28,39,58,210,227,231,338,340,346,359,374,381,911,receiv:72,73,86,87,377,recent:179,refer:31,291,297,417,894,refus:41,reject:41,rel:187,releas:306,894,remot:74,82,84,remov:14,15,151,314,rename_princip:3,renew:256,264,replai:71,85,265,887,901,replic:35,replica:34,39,903,represent:222,402,request:26,279,396,397,398,399,401,requir:412,932,resolv:135,152,301,303,resourc:922,respond:46,257,362,363,370,restor:23,restrict:240,939,result:169,retir:14,retriev:23,59,60,64,65,66,67,68,69,71,72,73,74,76,77,142,143,144,146,150,153,227,229,238,262,272,274,292,293,312,313,316,332,362,393,398,399,406,revers:38,rfc:101,119,risk:25,rout:41,rpc:325,355,s2kparam:229,s4u:43,safe:328,357,salt:229,258,344,371,391,salt_type_afs_length:755,salt_type_no_length:756,sampl:20,21,sclient:935,search:54,sec:406,section:20,21,59,60,secur:17,32,38,897,932,see:2,3,4,5,6,7,8,9,10,11,12,19,20,21,927,928,929,930,931,932,933,934,935,937,938,939,seen:41,select:26,154,906,send:76,77,88,89,378,sendauth:41,360,361,372,separ:890,sequenc:69,74,sequenti:139,158,316,seri:139,server:14,15,32,41,154,265,360,361,919,servic:14,23,26,38,39,194,278,313,386,400,session:26,67,68,90,261,set:55,80,81,82,83,84,85,86,87,88,89,90,156,157,169,240,241,242,243,244,245,246,247,248,249,250,251,254,255,256,257,258,259,277,320,375,376,377,378,379,380,381,382,412,414,set_str:3,setup:35,shell:38,932,should:48,side:932,sign:318,337,338,simpl:775,894,sinc:406,singl:320,890,site:894,size:95,skew:15,167,socket:62,softwar:891,some:32,101,sourc:889,894,spake:40,897,specif:38,97,115,117,124,296,393,specifi:21,53,54,112,127,128,132,149,153,269,276,278,338,340,373,374,379,383,384,sserver:12,ssh:38,start:34,316,stash:6,23,888,stashsrvpw:5,state:35,79,106,108,storag:200,218,store:43,155,159,198,string:60,91,93,107,125,126,170,187,193,210,219,222,341,342,371,387,388,389,391,392,394,395,402,403,404,405,strong:14,struct:365,368,structur:20,21,61,66,83,142,174,175,176,177,183,199,201,202,203,206,207,208,209,215,216,220,236,292,293,341,375,382,402,403,404,405,411,790,subkei:72,73,76,77,86,87,88,89,sun:23,suppli:252,327,support:14,41,100,103,160,285,288,290,884,synchron:397,synopsi:2,3,4,5,6,7,8,9,10,11,12,927,928,929,930,931,932,933,934,935,syntax:19,system:406,892,903,tabdump:6,tabl:217,235,300,301,302,303,304,308,309,310,312,313,314,315,316,373,tarbal:894,target:932,termin:91,test:35,109,110,283,285,385,890,tgt:223,thi:329,884,894,threeparamopen:757,ticket:23,185,221,224,253,256,259,274,373,399,400,925,time:46,167,187,266,274,382,388,393,399,406,884,timestamp:167,392,394,395,tkt_flg_anonym:758,tkt_flg_enc_pa_rep:759,tkt_flg_forward:760,761,tkt_flg_hw_auth:762,tkt_flg_initi:763,tkt_flg_invalid:764,tkt_flg_may_postd:765,tkt_flg_ok_as_deleg:766,tkt_flg_postdat:767,tkt_flg_pre_auth:768,tkt_flg_proxi:770,tkt_flg_proxiabl:769,tkt_flg_renew:771,tkt_flg_transit_policy_check:772,token:36,37,43,898,tool:883,topic:13,trace:41,383,384,trailer:98,tree:890,trivial:897,troubleshoot:41,42,tune:892,tutori:42,two:52,105,107,319,345,346,347,359,type:14,20,24,26,36,41,43,81,96,97,105,109,110,111,118,127,128,144,146,149,160,170,192,193,204,211,244,254,261,263,310,334,371,375,387,389,391,790,883,887,892,uniqu:149,unix:32,33,903,unlock:3,unpars:336,unset:241,242,243,249,255,unwrap:184,408,updat:23,894,update_princ_encrypt:6,upgrad:14,usabl:111,usag:14,use:79,154,265,276,883,use_mkei:6,used:48,884,892,user:46,317,349,923,926,936,uses:882,using:91,92,93,99,101,102,119,194,235,260,264,269,271,282,287,289,327,373,379,380,397,413,414,415,890,util:889,va_list:413,414,415,valid:127,128,130,267,299,351,valid_int_bit:773,valid_uint_bit:774,valu:59,60,141,155,187,332,364,367,388,variabl:26,27,92,892,939,variou:42,verif:41,411,412,924,verifi:46,127,128,129,298,339,340,408,410,version:361,897,via:101,view:5,925,view_polici:5,web:894,922,whether:109,110,160,283,285,385,412,whitepap:42,wiki:922,within:167,890,without:894,work:15,wrap:43,189,write_kt:11,year:882,your:15,924,zero:209,291}})
\ No newline at end of file
+Search.setIndex({docnames:"about","admin/admin_commands/index","admin/admin_commands/k5srvutil","admin/admin_commands/kadmin_local","admin/admin_commands/kadmind","admin/admin_commands/kdb5_ldap_util","admin/admin_commands/kdb5_util","admin/admin_commands/kprop","admin/admin_commands/kpropd","admin/admin_commands/kproplog","admin/admin_commands/krb5kdc","admin/admin_commands/ktutil","admin/admin_commands/sserver","admin/advanced/index","admin/advanced/retiring-des","admin/appl_servers","admin/auth_indicator","admin/backup_host","admin/conf_files/index","admin/conf_files/kadm5_acl","admin/conf_files/kdc_conf","admin/conf_files/krb5_conf","admin/conf_ldap","admin/database","admin/dbtypes","admin/dictionary","admin/enctypes","admin/env_variables","admin/host_config","admin/https","admin/index","admin/install","admin/install_appl_srv","admin/install_clients","admin/install_kdc","admin/lockout","admin/otp","admin/pkinit","admin/princ_dns","admin/realm_config","admin/spake","admin/troubleshoot","admin/various_envs","appdev/gssapi","appdev/h5l_mit_apidiff","appdev/index","appdev/init_creds","appdev/princ_handle","appdev/refs/api/index","appdev/refs/api/krb5_425_conv_principal","appdev/refs/api/krb5_524_conv_principal","appdev/refs/api/krb5_524_convert_creds","appdev/refs/api/krb5_address_compare","appdev/refs/api/krb5_address_order","appdev/refs/api/krb5_address_search","appdev/refs/api/krb5_allow_weak_crypto","appdev/refs/api/krb5_aname_to_localname","appdev/refs/api/krb5_anonymous_principal","appdev/refs/api/krb5_anonymous_realm","appdev/refs/api/krb5_appdefault_boolean","appdev/refs/api/krb5_appdefault_string","appdev/refs/api/krb5_auth_con_free","appdev/refs/api/krb5_auth_con_genaddrs","appdev/refs/api/krb5_auth_con_get_checksum_func","appdev/refs/api/krb5_auth_con_getaddrs","appdev/refs/api/krb5_auth_con_getauthenticator","appdev/refs/api/krb5_auth_con_getflags","appdev/refs/api/krb5_auth_con_getkey","appdev/refs/api/krb5_auth_con_getkey_k","appdev/refs/api/krb5_auth_con_getlocalseqnumber","appdev/refs/api/krb5_auth_con_getlocalsubkey","appdev/refs/api/krb5_auth_con_getrcache","appdev/refs/api/krb5_auth_con_getrecvsubkey","appdev/refs/api/krb5_auth_con_getrecvsubkey_k","appdev/refs/api/krb5_auth_con_getremoteseqnumber","appdev/refs/api/krb5_auth_con_getremotesubkey","appdev/refs/api/krb5_auth_con_getsendsubkey","appdev/refs/api/krb5_auth_con_getsendsubkey_k","appdev/refs/api/krb5_auth_con_init","appdev/refs/api/krb5_auth_con_initivector","appdev/refs/api/krb5_auth_con_set_checksum_func","appdev/refs/api/krb5_auth_con_set_req_cksumtype","appdev/refs/api/krb5_auth_con_setaddrs","appdev/refs/api/krb5_auth_con_setflags","appdev/refs/api/krb5_auth_con_setports","appdev/refs/api/krb5_auth_con_setrcache","appdev/refs/api/krb5_auth_con_setrecvsubkey","appdev/refs/api/krb5_auth_con_setrecvsubkey_k","appdev/refs/api/krb5_auth_con_setsendsubkey","appdev/refs/api/krb5_auth_con_setsendsubkey_k","appdev/refs/api/krb5_auth_con_setuseruserkey","appdev/refs/api/krb5_build_principal","appdev/refs/api/krb5_build_principal_alloc_va","appdev/refs/api/krb5_build_principal_ext","appdev/refs/api/krb5_build_principal_va","appdev/refs/api/krb5_c_block_size","appdev/refs/api/krb5_c_checksum_length","appdev/refs/api/krb5_c_crypto_length","appdev/refs/api/krb5_c_crypto_length_iov","appdev/refs/api/krb5_c_decrypt","appdev/refs/api/krb5_c_decrypt_iov","appdev/refs/api/krb5_c_derive_prfplus","appdev/refs/api/krb5_c_encrypt","appdev/refs/api/krb5_c_encrypt_iov","appdev/refs/api/krb5_c_encrypt_length","appdev/refs/api/krb5_c_enctype_compare","appdev/refs/api/krb5_c_free_state","appdev/refs/api/krb5_c_fx_cf2_simple","appdev/refs/api/krb5_c_init_state","appdev/refs/api/krb5_c_is_coll_proof_cksum","appdev/refs/api/krb5_c_is_keyed_cksum","appdev/refs/api/krb5_c_keyed_checksum_types","appdev/refs/api/krb5_c_keylengths","appdev/refs/api/krb5_c_make_checksum","appdev/refs/api/krb5_c_make_checksum_iov","appdev/refs/api/krb5_c_make_random_key","appdev/refs/api/krb5_c_padding_length","appdev/refs/api/krb5_c_prf","appdev/refs/api/krb5_c_prf_length","appdev/refs/api/krb5_c_prfplus","appdev/refs/api/krb5_c_random_add_entropy","appdev/refs/api/krb5_c_random_make_octets","appdev/refs/api/krb5_c_random_os_entropy","appdev/refs/api/krb5_c_random_seed","appdev/refs/api/krb5_c_random_to_key","appdev/refs/api/krb5_c_string_to_key","appdev/refs/api/krb5_c_string_to_key_with_params","appdev/refs/api/krb5_c_valid_cksumtype","appdev/refs/api/krb5_c_valid_enctype","appdev/refs/api/krb5_c_verify_checksum","appdev/refs/api/krb5_c_verify_checksum_iov","appdev/refs/api/krb5_calculate_checksum","appdev/refs/api/krb5_cc_cache_match","appdev/refs/api/krb5_cc_close","appdev/refs/api/krb5_cc_copy_creds","appdev/refs/api/krb5_cc_default","appdev/refs/api/krb5_cc_default_name","appdev/refs/api/krb5_cc_destroy","appdev/refs/api/krb5_cc_dup","appdev/refs/api/krb5_cc_end_seq_get","appdev/refs/api/krb5_cc_gen_new","appdev/refs/api/krb5_cc_get_config","appdev/refs/api/krb5_cc_get_flags","appdev/refs/api/krb5_cc_get_full_name","appdev/refs/api/krb5_cc_get_name","appdev/refs/api/krb5_cc_get_principal","appdev/refs/api/krb5_cc_get_type","appdev/refs/api/krb5_cc_initialize","appdev/refs/api/krb5_cc_move","appdev/refs/api/krb5_cc_new_unique","appdev/refs/api/krb5_cc_next_cred","appdev/refs/api/krb5_cc_remove_cred","appdev/refs/api/krb5_cc_resolve","appdev/refs/api/krb5_cc_retrieve_cred","appdev/refs/api/krb5_cc_select","appdev/refs/api/krb5_cc_set_config","appdev/refs/api/krb5_cc_set_default_name","appdev/refs/api/krb5_cc_set_flags","appdev/refs/api/krb5_cc_start_seq_get","appdev/refs/api/krb5_cc_store_cred","appdev/refs/api/krb5_cc_support_switch","appdev/refs/api/krb5_cc_switch","appdev/refs/api/krb5_cccol_cursor_free","appdev/refs/api/krb5_cccol_cursor_new","appdev/refs/api/krb5_cccol_cursor_next","appdev/refs/api/krb5_cccol_have_content","appdev/refs/api/krb5_change_password","appdev/refs/api/krb5_check_clockskew","appdev/refs/api/krb5_checksum_size","appdev/refs/api/krb5_chpw_message","appdev/refs/api/krb5_cksumtype_to_string","appdev/refs/api/krb5_clear_error_message","appdev/refs/api/krb5_copy_addresses","appdev/refs/api/krb5_copy_authdata","appdev/refs/api/krb5_copy_authenticator","appdev/refs/api/krb5_copy_checksum","appdev/refs/api/krb5_copy_context","appdev/refs/api/krb5_copy_creds","appdev/refs/api/krb5_copy_data","appdev/refs/api/krb5_copy_error_message","appdev/refs/api/krb5_copy_keyblock","appdev/refs/api/krb5_copy_keyblock_contents","appdev/refs/api/krb5_copy_principal","appdev/refs/api/krb5_copy_ticket","appdev/refs/api/krb5_decode_authdata_container","appdev/refs/api/krb5_decode_ticket","appdev/refs/api/krb5_decrypt","appdev/refs/api/krb5_deltat_to_string","appdev/refs/api/krb5_eblock_enctype","appdev/refs/api/krb5_encode_authdata_container","appdev/refs/api/krb5_encrypt","appdev/refs/api/krb5_encrypt_size","appdev/refs/api/krb5_enctype_to_name","appdev/refs/api/krb5_enctype_to_string","appdev/refs/api/krb5_expand_hostname","appdev/refs/api/krb5_find_authdata","appdev/refs/api/krb5_finish_key","appdev/refs/api/krb5_finish_random_key","appdev/refs/api/krb5_free_addresses","appdev/refs/api/krb5_free_ap_rep_enc_part","appdev/refs/api/krb5_free_authdata","appdev/refs/api/krb5_free_authenticator","appdev/refs/api/krb5_free_checksum","appdev/refs/api/krb5_free_checksum_contents","appdev/refs/api/krb5_free_cksumtypes","appdev/refs/api/krb5_free_context","appdev/refs/api/krb5_free_cred_contents","appdev/refs/api/krb5_free_creds","appdev/refs/api/krb5_free_data","appdev/refs/api/krb5_free_data_contents","appdev/refs/api/krb5_free_default_realm","appdev/refs/api/krb5_free_enctypes","appdev/refs/api/krb5_free_error","appdev/refs/api/krb5_free_error_message","appdev/refs/api/krb5_free_host_realm","appdev/refs/api/krb5_free_keyblock","appdev/refs/api/krb5_free_keyblock_contents","appdev/refs/api/krb5_free_keytab_entry_contents","appdev/refs/api/krb5_free_principal","appdev/refs/api/krb5_free_string","appdev/refs/api/krb5_free_tgt_creds","appdev/refs/api/krb5_free_ticket","appdev/refs/api/krb5_free_unparsed_name","appdev/refs/api/krb5_fwd_tgt_creds","appdev/refs/api/krb5_get_credentials","appdev/refs/api/krb5_get_credentials_renew","appdev/refs/api/krb5_get_credentials_validate","appdev/refs/api/krb5_get_default_realm","appdev/refs/api/krb5_get_error_message","appdev/refs/api/krb5_get_etype_info","appdev/refs/api/krb5_get_fallback_host_realm","appdev/refs/api/krb5_get_host_realm","appdev/refs/api/krb5_get_in_tkt_with_keytab","appdev/refs/api/krb5_get_in_tkt_with_password","appdev/refs/api/krb5_get_in_tkt_with_skey","appdev/refs/api/krb5_get_init_creds_keytab","appdev/refs/api/krb5_get_init_creds_opt_alloc","appdev/refs/api/krb5_get_init_creds_opt_free","appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags","appdev/refs/api/krb5_get_init_creds_opt_init","appdev/refs/api/krb5_get_init_creds_opt_set_address_list","appdev/refs/api/krb5_get_init_creds_opt_set_anonymous","appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize","appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt","appdev/refs/api/krb5_get_init_creds_opt_set_etype_list","appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name","appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags","appdev/refs/api/krb5_get_init_creds_opt_set_forwardable","appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache","appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache","appdev/refs/api/krb5_get_init_creds_opt_set_pa","appdev/refs/api/krb5_get_init_creds_opt_set_pac_request","appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list","appdev/refs/api/krb5_get_init_creds_opt_set_proxiable","appdev/refs/api/krb5_get_init_creds_opt_set_renew_life","appdev/refs/api/krb5_get_init_creds_opt_set_responder","appdev/refs/api/krb5_get_init_creds_opt_set_salt","appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life","appdev/refs/api/krb5_get_init_creds_password","appdev/refs/api/krb5_get_permitted_enctypes","appdev/refs/api/krb5_get_profile","appdev/refs/api/krb5_get_prompt_types","appdev/refs/api/krb5_get_renewed_creds","appdev/refs/api/krb5_get_server_rcache","appdev/refs/api/krb5_get_time_offsets","appdev/refs/api/krb5_get_validated_creds","appdev/refs/api/krb5_init_context","appdev/refs/api/krb5_init_context_profile","appdev/refs/api/krb5_init_creds_free","appdev/refs/api/krb5_init_creds_get","appdev/refs/api/krb5_init_creds_get_creds","appdev/refs/api/krb5_init_creds_get_error","appdev/refs/api/krb5_init_creds_get_times","appdev/refs/api/krb5_init_creds_init","appdev/refs/api/krb5_init_creds_set_keytab","appdev/refs/api/krb5_init_creds_set_password","appdev/refs/api/krb5_init_creds_set_service","appdev/refs/api/krb5_init_creds_step","appdev/refs/api/krb5_init_keyblock","appdev/refs/api/krb5_init_random_key","appdev/refs/api/krb5_init_secure_context","appdev/refs/api/krb5_is_config_principal","appdev/refs/api/krb5_is_referral_realm","appdev/refs/api/krb5_is_thread_safe","appdev/refs/api/krb5_k_create_key","appdev/refs/api/krb5_k_decrypt","appdev/refs/api/krb5_k_decrypt_iov","appdev/refs/api/krb5_k_encrypt","appdev/refs/api/krb5_k_encrypt_iov","appdev/refs/api/krb5_k_free_key","appdev/refs/api/krb5_k_key_enctype","appdev/refs/api/krb5_k_key_keyblock","appdev/refs/api/krb5_k_make_checksum","appdev/refs/api/krb5_k_make_checksum_iov","appdev/refs/api/krb5_k_prf","appdev/refs/api/krb5_k_reference_key","appdev/refs/api/krb5_k_verify_checksum","appdev/refs/api/krb5_k_verify_checksum_iov","appdev/refs/api/krb5_kdc_sign_ticket","appdev/refs/api/krb5_kdc_verify_ticket","appdev/refs/api/krb5_kt_add_entry","appdev/refs/api/krb5_kt_client_default","appdev/refs/api/krb5_kt_close","appdev/refs/api/krb5_kt_default","appdev/refs/api/krb5_kt_default_name","appdev/refs/api/krb5_kt_dup","appdev/refs/api/krb5_kt_end_seq_get","appdev/refs/api/krb5_kt_free_entry","appdev/refs/api/krb5_kt_get_entry","appdev/refs/api/krb5_kt_get_name","appdev/refs/api/krb5_kt_get_type","appdev/refs/api/krb5_kt_have_content","appdev/refs/api/krb5_kt_next_entry","appdev/refs/api/krb5_kt_read_service_key","appdev/refs/api/krb5_kt_remove_entry","appdev/refs/api/krb5_kt_resolve","appdev/refs/api/krb5_kt_start_seq_get","appdev/refs/api/krb5_kuserok","appdev/refs/api/krb5_make_authdata_kdc_issued","appdev/refs/api/krb5_marshal_credentials","appdev/refs/api/krb5_merge_authdata","appdev/refs/api/krb5_mk_1cred","appdev/refs/api/krb5_mk_error","appdev/refs/api/krb5_mk_ncred","appdev/refs/api/krb5_mk_priv","appdev/refs/api/krb5_mk_rep","appdev/refs/api/krb5_mk_rep_dce","appdev/refs/api/krb5_mk_req","appdev/refs/api/krb5_mk_req_extended","appdev/refs/api/krb5_mk_safe","appdev/refs/api/krb5_os_localaddr","appdev/refs/api/krb5_pac_add_buffer","appdev/refs/api/krb5_pac_free","appdev/refs/api/krb5_pac_get_buffer","appdev/refs/api/krb5_pac_get_client_info","appdev/refs/api/krb5_pac_get_types","appdev/refs/api/krb5_pac_init","appdev/refs/api/krb5_pac_parse","appdev/refs/api/krb5_pac_sign","appdev/refs/api/krb5_pac_sign_ext","appdev/refs/api/krb5_pac_verify","appdev/refs/api/krb5_pac_verify_ext","appdev/refs/api/krb5_parse_name","appdev/refs/api/krb5_parse_name_flags","appdev/refs/api/krb5_prepend_error_message","appdev/refs/api/krb5_principal2salt","appdev/refs/api/krb5_principal_compare","appdev/refs/api/krb5_principal_compare_any_realm","appdev/refs/api/krb5_principal_compare_flags","appdev/refs/api/krb5_process_key","appdev/refs/api/krb5_prompter_posix","appdev/refs/api/krb5_random_key","appdev/refs/api/krb5_rd_cred","appdev/refs/api/krb5_rd_error","appdev/refs/api/krb5_rd_priv","appdev/refs/api/krb5_rd_rep","appdev/refs/api/krb5_rd_rep_dce","appdev/refs/api/krb5_rd_req","appdev/refs/api/krb5_rd_safe","appdev/refs/api/krb5_read_password","appdev/refs/api/krb5_realm_compare","appdev/refs/api/krb5_recvauth","appdev/refs/api/krb5_recvauth_version","appdev/refs/api/krb5_responder_get_challenge","appdev/refs/api/krb5_responder_list_questions","appdev/refs/api/krb5_responder_otp_challenge_free","appdev/refs/api/krb5_responder_otp_get_challenge","appdev/refs/api/krb5_responder_otp_set_answer","appdev/refs/api/krb5_responder_pkinit_challenge_free","appdev/refs/api/krb5_responder_pkinit_get_challenge","appdev/refs/api/krb5_responder_pkinit_set_answer","appdev/refs/api/krb5_responder_set_answer","appdev/refs/api/krb5_salttype_to_string","appdev/refs/api/krb5_sendauth","appdev/refs/api/krb5_server_decrypt_ticket_keytab","appdev/refs/api/krb5_set_default_realm","appdev/refs/api/krb5_set_default_tgs_enctypes","appdev/refs/api/krb5_set_error_message","appdev/refs/api/krb5_set_kdc_recv_hook","appdev/refs/api/krb5_set_kdc_send_hook","appdev/refs/api/krb5_set_password","appdev/refs/api/krb5_set_password_using_ccache","appdev/refs/api/krb5_set_principal_realm","appdev/refs/api/krb5_set_real_time","appdev/refs/api/krb5_set_trace_callback","appdev/refs/api/krb5_set_trace_filename","appdev/refs/api/krb5_sname_match","appdev/refs/api/krb5_sname_to_principal","appdev/refs/api/krb5_string_to_cksumtype","appdev/refs/api/krb5_string_to_deltat","appdev/refs/api/krb5_string_to_enctype","appdev/refs/api/krb5_string_to_key","appdev/refs/api/krb5_string_to_salttype","appdev/refs/api/krb5_string_to_timestamp","appdev/refs/api/krb5_timeofday","appdev/refs/api/krb5_timestamp_to_sfstring","appdev/refs/api/krb5_timestamp_to_string","appdev/refs/api/krb5_tkt_creds_free","appdev/refs/api/krb5_tkt_creds_get","appdev/refs/api/krb5_tkt_creds_get_creds","appdev/refs/api/krb5_tkt_creds_get_times","appdev/refs/api/krb5_tkt_creds_init","appdev/refs/api/krb5_tkt_creds_step","appdev/refs/api/krb5_unmarshal_credentials","appdev/refs/api/krb5_unparse_name","appdev/refs/api/krb5_unparse_name_ext","appdev/refs/api/krb5_unparse_name_flags","appdev/refs/api/krb5_unparse_name_flags_ext","appdev/refs/api/krb5_us_timeofday","appdev/refs/api/krb5_use_enctype","appdev/refs/api/krb5_verify_authdata_kdc_issued","appdev/refs/api/krb5_verify_checksum","appdev/refs/api/krb5_verify_init_creds","appdev/refs/api/krb5_verify_init_creds_opt_init","appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail","appdev/refs/api/krb5_vprepend_error_message","appdev/refs/api/krb5_vset_error_message","appdev/refs/api/krb5_vwrap_error_message","appdev/refs/api/krb5_wrap_error_message","appdev/refs/index","appdev/refs/macros/ADDRTYPE_ADDRPORT","appdev/refs/macros/ADDRTYPE_CHAOS","appdev/refs/macros/ADDRTYPE_DDP","appdev/refs/macros/ADDRTYPE_INET","appdev/refs/macros/ADDRTYPE_INET6","appdev/refs/macros/ADDRTYPE_IPPORT","appdev/refs/macros/ADDRTYPE_ISO","appdev/refs/macros/ADDRTYPE_IS_LOCAL","appdev/refs/macros/ADDRTYPE_NETBIOS","appdev/refs/macros/ADDRTYPE_XNS","appdev/refs/macros/AD_TYPE_EXTERNAL","appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK","appdev/refs/macros/AD_TYPE_REGISTERED","appdev/refs/macros/AD_TYPE_RESERVED","appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION","appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED","appdev/refs/macros/AP_OPTS_RESERVED","appdev/refs/macros/AP_OPTS_USE_SESSION_KEY","appdev/refs/macros/AP_OPTS_USE_SUBKEY","appdev/refs/macros/AP_OPTS_WIRE_MASK","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256","appdev/refs/macros/CKSUMTYPE_CRC32","appdev/refs/macros/CKSUMTYPE_DESCBC","appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3","appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128","appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256","appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR","appdev/refs/macros/CKSUMTYPE_NIST_SHA","appdev/refs/macros/CKSUMTYPE_RSA_MD4","appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES","appdev/refs/macros/CKSUMTYPE_RSA_MD5","appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES","appdev/refs/macros/CKSUMTYPE_SHA1","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP","appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC","appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC","appdev/refs/macros/ENCTYPE_DES3_CBC_ENV","appdev/refs/macros/ENCTYPE_DES3_CBC_RAW","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1","appdev/refs/macros/ENCTYPE_DES_CBC_CRC","appdev/refs/macros/ENCTYPE_DES_CBC_MD4","appdev/refs/macros/ENCTYPE_DES_CBC_MD5","appdev/refs/macros/ENCTYPE_DES_CBC_RAW","appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1","appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS","appdev/refs/macros/ENCTYPE_MD5_RSA_CMS","appdev/refs/macros/ENCTYPE_NULL","appdev/refs/macros/ENCTYPE_RC2_CBC_ENV","appdev/refs/macros/ENCTYPE_RSA_ENV","appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV","appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS","appdev/refs/macros/ENCTYPE_UNKNOWN","appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE","appdev/refs/macros/KDC_OPT_CANONICALIZE","appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT","appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK","appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY","appdev/refs/macros/KDC_OPT_FORWARDABLE","appdev/refs/macros/KDC_OPT_FORWARDED","appdev/refs/macros/KDC_OPT_POSTDATED","appdev/refs/macros/KDC_OPT_PROXIABLE","appdev/refs/macros/KDC_OPT_PROXY","appdev/refs/macros/KDC_OPT_RENEW","appdev/refs/macros/KDC_OPT_RENEWABLE","appdev/refs/macros/KDC_OPT_RENEWABLE_OK","appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS","appdev/refs/macros/KDC_OPT_VALIDATE","appdev/refs/macros/KDC_TKT_COMMON_MASK","appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE","appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR","appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR","appdev/refs/macros/KRB5_AP_REP","appdev/refs/macros/KRB5_AP_REQ","appdev/refs/macros/KRB5_AS_REP","appdev/refs/macros/KRB5_AS_REQ","appdev/refs/macros/KRB5_AUTHDATA_AND_OR","appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS","appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR","appdev/refs/macros/KRB5_AUTHDATA_CAMMAC","appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION","appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR","appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT","appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS","appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED","appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC","appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE","appdev/refs/macros/KRB5_AUTHDATA_SESAME","appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET","appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR","appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME","appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY","appdev/refs/macros/KRB5_CRED","appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM","appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA","appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY","appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER","appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING","appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY","appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM","appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER","appdev/refs/macros/KRB5_CYBERSAFE_SECUREID","appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS","appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP","appdev/refs/macros/KRB5_ERROR","appdev/refs/macros/KRB5_FAST_REQUIRED","appdev/refs/macros/KRB5_GC_CACHED","appdev/refs/macros/KRB5_GC_CANONICALIZE","appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION","appdev/refs/macros/KRB5_GC_FORWARDABLE","appdev/refs/macros/KRB5_GC_NO_STORE","appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK","appdev/refs/macros/KRB5_GC_USER_USER","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE","appdev/refs/macros/KRB5_INIT_CONTEXT_KDC","appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE","appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE","appdev/refs/macros/KRB5_INT16_MAX","appdev/refs/macros/KRB5_INT16_MIN","appdev/refs/macros/KRB5_INT32_MAX","appdev/refs/macros/KRB5_INT32_MIN","appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE","appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE","appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT","appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS","appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC","appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC","appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV","appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED","appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET","appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART","appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS","appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE","appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST","appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE","appdev/refs/macros/KRB5_KEYUSAGE_SPAKE","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM","appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED","appdev/refs/macros/KRB5_KPASSWD_AUTHERROR","appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION","appdev/refs/macros/KRB5_KPASSWD_HARDERROR","appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED","appdev/refs/macros/KRB5_KPASSWD_MALFORMED","appdev/refs/macros/KRB5_KPASSWD_SOFTERROR","appdev/refs/macros/KRB5_KPASSWD_SUCCESS","appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME","appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL","appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL","appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED","appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME","appdev/refs/macros/KRB5_LRQ_NONE","appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME","appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL","appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL","appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED","appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME","appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL","appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID","appdev/refs/macros/KRB5_NT_PRINCIPAL","appdev/refs/macros/KRB5_NT_SMTP_NAME","appdev/refs/macros/KRB5_NT_SRV_HST","appdev/refs/macros/KRB5_NT_SRV_INST","appdev/refs/macros/KRB5_NT_SRV_XHST","appdev/refs/macros/KRB5_NT_UID","appdev/refs/macros/KRB5_NT_UNKNOWN","appdev/refs/macros/KRB5_NT_WELLKNOWN","appdev/refs/macros/KRB5_NT_X500_PRINCIPAL","appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO","appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS","appdev/refs/macros/KRB5_PAC_CLIENT_INFO","appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO","appdev/refs/macros/KRB5_PAC_DELEGATION_INFO","appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS","appdev/refs/macros/KRB5_PAC_DEVICE_INFO","appdev/refs/macros/KRB5_PAC_LOGON_INFO","appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM","appdev/refs/macros/KRB5_PAC_REQUESTOR","appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM","appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM","appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO","appdev/refs/macros/KRB5_PADATA_AFS3_SALT","appdev/refs/macros/KRB5_PADATA_AP_REQ","appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM","appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS","appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE","appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID","appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP","appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2","appdev/refs/macros/KRB5_PADATA_FOR_USER","appdev/refs/macros/KRB5_PADATA_FX_COOKIE","appdev/refs/macros/KRB5_PADATA_FX_ERROR","appdev/refs/macros/KRB5_PADATA_FX_FAST","appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA","appdev/refs/macros/KRB5_PADATA_NONE","appdev/refs/macros/KRB5_PADATA_OSF_DCE","appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE","appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE","appdev/refs/macros/KRB5_PADATA_OTP_REQUEST","appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS","appdev/refs/macros/KRB5_PADATA_PAC_REQUEST","appdev/refs/macros/KRB5_PADATA_PKINIT_KX","appdev/refs/macros/KRB5_PADATA_PK_AS_REP","appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD","appdev/refs/macros/KRB5_PADATA_PW_SALT","appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2","appdev/refs/macros/KRB5_PADATA_REFERRAL","appdev/refs/macros/KRB5_PADATA_S4U_X509_USER","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2","appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2","appdev/refs/macros/KRB5_PADATA_SESAME","appdev/refs/macros/KRB5_PADATA_SPAKE","appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO","appdev/refs/macros/KRB5_PADATA_TGS_REQ","appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT","appdev/refs/macros/KRB5_PRIV","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN","appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD","appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH","appdev/refs/macros/KRB5_PVNO","appdev/refs/macros/KRB5_REALM_BRANCH_CHAR","appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS","appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION","appdev/refs/macros/KRB5_REFERRAL_REALM","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED","appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT","appdev/refs/macros/KRB5_SAFE","appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD","appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD","appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY","appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT","appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA","appdev/refs/macros/KRB5_TC_MATCH_FLAGS","appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT","appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY","appdev/refs/macros/KRB5_TC_MATCH_KTYPE","appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY","appdev/refs/macros/KRB5_TC_MATCH_TIMES","appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT","appdev/refs/macros/KRB5_TC_NOTICKET","appdev/refs/macros/KRB5_TC_OPENCLOSE","appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES","appdev/refs/macros/KRB5_TGS_NAME","appdev/refs/macros/KRB5_TGS_NAME_SIZE","appdev/refs/macros/KRB5_TGS_REP","appdev/refs/macros/KRB5_TGS_REQ","appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE","appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL","appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR","appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK","appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY","appdev/refs/macros/MAX_KEYTAB_NAME_LEN","appdev/refs/macros/MSEC_DIRBIT","appdev/refs/macros/MSEC_VAL_MASK","appdev/refs/macros/SALT_TYPE_AFS_LENGTH","appdev/refs/macros/SALT_TYPE_NO_LENGTH","appdev/refs/macros/THREEPARAMOPEN","appdev/refs/macros/TKT_FLG_ANONYMOUS","appdev/refs/macros/TKT_FLG_ENC_PA_REP","appdev/refs/macros/TKT_FLG_FORWARDABLE","appdev/refs/macros/TKT_FLG_FORWARDED","appdev/refs/macros/TKT_FLG_HW_AUTH","appdev/refs/macros/TKT_FLG_INITIAL","appdev/refs/macros/TKT_FLG_INVALID","appdev/refs/macros/TKT_FLG_MAY_POSTDATE","appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE","appdev/refs/macros/TKT_FLG_POSTDATED","appdev/refs/macros/TKT_FLG_PRE_AUTH","appdev/refs/macros/TKT_FLG_PROXIABLE","appdev/refs/macros/TKT_FLG_PROXY","appdev/refs/macros/TKT_FLG_RENEWABLE","appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED","appdev/refs/macros/VALID_INT_BITS","appdev/refs/macros/VALID_UINT_BITS","appdev/refs/macros/index","appdev/refs/macros/krb524_convert_creds_kdc","appdev/refs/macros/krb524_init_ets","appdev/refs/macros/krb5_const","appdev/refs/macros/krb5_princ_component","appdev/refs/macros/krb5_princ_name","appdev/refs/macros/krb5_princ_realm","appdev/refs/macros/krb5_princ_set_realm","appdev/refs/macros/krb5_princ_set_realm_data","appdev/refs/macros/krb5_princ_set_realm_length","appdev/refs/macros/krb5_princ_size","appdev/refs/macros/krb5_princ_type","appdev/refs/macros/krb5_roundup","appdev/refs/macros/krb5_x","appdev/refs/macros/krb5_xc","appdev/refs/types/index","appdev/refs/types/krb5_address","appdev/refs/types/krb5_addrtype","appdev/refs/types/krb5_ap_rep","appdev/refs/types/krb5_ap_rep_enc_part","appdev/refs/types/krb5_ap_req","appdev/refs/types/krb5_auth_context","appdev/refs/types/krb5_authdata","appdev/refs/types/krb5_authdatatype","appdev/refs/types/krb5_authenticator","appdev/refs/types/krb5_boolean","appdev/refs/types/krb5_cc_cursor","appdev/refs/types/krb5_ccache","appdev/refs/types/krb5_cccol_cursor","appdev/refs/types/krb5_checksum","appdev/refs/types/krb5_cksumtype","appdev/refs/types/krb5_const_pointer","appdev/refs/types/krb5_const_principal","appdev/refs/types/krb5_context","appdev/refs/types/krb5_cred","appdev/refs/types/krb5_cred_enc_part","appdev/refs/types/krb5_cred_info","appdev/refs/types/krb5_creds","appdev/refs/types/krb5_crypto_iov","appdev/refs/types/krb5_cryptotype","appdev/refs/types/krb5_data","appdev/refs/types/krb5_deltat","appdev/refs/types/krb5_enc_data","appdev/refs/types/krb5_enc_kdc_rep_part","appdev/refs/types/krb5_enc_tkt_part","appdev/refs/types/krb5_encrypt_block","appdev/refs/types/krb5_enctype","appdev/refs/types/krb5_error","appdev/refs/types/krb5_error_code","appdev/refs/types/krb5_expire_callback_func","appdev/refs/types/krb5_flags","appdev/refs/types/krb5_get_init_creds_opt","appdev/refs/types/krb5_gic_opt_pa_data","appdev/refs/types/krb5_init_creds_context","appdev/refs/types/krb5_int16","appdev/refs/types/krb5_int32","appdev/refs/types/krb5_kdc_rep","appdev/refs/types/krb5_kdc_req","appdev/refs/types/krb5_key","appdev/refs/types/krb5_keyblock","appdev/refs/types/krb5_keytab","appdev/refs/types/krb5_keytab_entry","appdev/refs/types/krb5_keyusage","appdev/refs/types/krb5_kt_cursor","appdev/refs/types/krb5_kvno","appdev/refs/types/krb5_last_req_entry","appdev/refs/types/krb5_magic","appdev/refs/types/krb5_mk_req_checksum_func","appdev/refs/types/krb5_msgtype","appdev/refs/types/krb5_octet","appdev/refs/types/krb5_pa_data","appdev/refs/types/krb5_pa_pac_req","appdev/refs/types/krb5_pa_server_referral_data","appdev/refs/types/krb5_pa_svr_referral_data","appdev/refs/types/krb5_pac","appdev/refs/types/krb5_pointer","appdev/refs/types/krb5_post_recv_fn","appdev/refs/types/krb5_pre_send_fn","appdev/refs/types/krb5_preauthtype","appdev/refs/types/krb5_principal","appdev/refs/types/krb5_principal_data","appdev/refs/types/krb5_prompt","appdev/refs/types/krb5_prompt_type","appdev/refs/types/krb5_prompter_fct","appdev/refs/types/krb5_pwd_data","appdev/refs/types/krb5_rcache","appdev/refs/types/krb5_replay_data","appdev/refs/types/krb5_responder_context","appdev/refs/types/krb5_responder_fn","appdev/refs/types/krb5_responder_otp_challenge","appdev/refs/types/krb5_responder_otp_tokeninfo","appdev/refs/types/krb5_responder_pkinit_challenge","appdev/refs/types/krb5_responder_pkinit_identity","appdev/refs/types/krb5_response","appdev/refs/types/krb5_ticket","appdev/refs/types/krb5_ticket_times","appdev/refs/types/krb5_timestamp","appdev/refs/types/krb5_tkt_authent","appdev/refs/types/krb5_tkt_creds_context","appdev/refs/types/krb5_trace_callback","appdev/refs/types/krb5_trace_info","appdev/refs/types/krb5_transited","appdev/refs/types/krb5_typed_data","appdev/refs/types/krb5_ui_2","appdev/refs/types/krb5_ui_4","appdev/refs/types/krb5_verify_init_creds_opt","appdev/refs/types/passwd_phrase_element","appdev/y2038","basic/ccache_def","basic/date_format","basic/index","basic/keytab_def","basic/rcache_def","basic/stash_file_def","build/directory_org","build/doing_build","build/index","build/options2configure","build/osconf","build_this","copyright","formats/ccache_file_format","formats/cookie","formats/freshness_token","formats/index","formats/keytab_file_format","formats/rcache_file_format","index","mitK5defaults","mitK5features","mitK5license","plugindev/ccselect","plugindev/certauth","plugindev/clpreauth","plugindev/general","plugindev/gssapi","plugindev/hostrealm","plugindev/index","plugindev/internal","plugindev/kadm5_auth","plugindev/kadm5_hook","plugindev/kdcpolicy","plugindev/kdcpreauth","plugindev/localauth","plugindev/locate","plugindev/profile","plugindev/pwqual","resources","user/index","user/pwd_mgmt","user/tkt_mgmt","user/user_commands/index","user/user_commands/kdestroy","user/user_commands/kinit","user/user_commands/klist","user/user_commands/kpasswd","user/user_commands/krb5-config","user/user_commands/ksu","user/user_commands/kswitch","user/user_commands/kvno","user/user_commands/sclient","user/user_config/index","user/user_config/k5identity","user/user_config/k5login","user/user_config/kerberos",envversion:52,filenames:"about.rst","admin/admin_commands/index.rst","admin/admin_commands/k5srvutil.rst","admin/admin_commands/kadmin_local.rst","admin/admin_commands/kadmind.rst","admin/admin_commands/kdb5_ldap_util.rst","admin/admin_commands/kdb5_util.rst","admin/admin_commands/kprop.rst","admin/admin_commands/kpropd.rst","admin/admin_commands/kproplog.rst","admin/admin_commands/krb5kdc.rst","admin/admin_commands/ktutil.rst","admin/admin_commands/sserver.rst","admin/advanced/index.rst","admin/advanced/retiring-des.rst","admin/appl_servers.rst","admin/auth_indicator.rst","admin/backup_host.rst","admin/conf_files/index.rst","admin/conf_files/kadm5_acl.rst","admin/conf_files/kdc_conf.rst","admin/conf_files/krb5_conf.rst","admin/conf_ldap.rst","admin/database.rst","admin/dbtypes.rst","admin/dictionary.rst","admin/enctypes.rst","admin/env_variables.rst","admin/host_config.rst","admin/https.rst","admin/index.rst","admin/install.rst","admin/install_appl_srv.rst","admin/install_clients.rst","admin/install_kdc.rst","admin/lockout.rst","admin/otp.rst","admin/pkinit.rst","admin/princ_dns.rst","admin/realm_config.rst","admin/spake.rst","admin/troubleshoot.rst","admin/various_envs.rst","appdev/gssapi.rst","appdev/h5l_mit_apidiff.rst","appdev/index.rst","appdev/init_creds.rst","appdev/princ_handle.rst","appdev/refs/api/index.rst","appdev/refs/api/krb5_425_conv_principal.rst","appdev/refs/api/krb5_524_conv_principal.rst","appdev/refs/api/krb5_524_convert_creds.rst","appdev/refs/api/krb5_address_compare.rst","appdev/refs/api/krb5_address_order.rst","appdev/refs/api/krb5_address_search.rst","appdev/refs/api/krb5_allow_weak_crypto.rst","appdev/refs/api/krb5_aname_to_localname.rst","appdev/refs/api/krb5_anonymous_principal.rst","appdev/refs/api/krb5_anonymous_realm.rst","appdev/refs/api/krb5_appdefault_boolean.rst","appdev/refs/api/krb5_appdefault_string.rst","appdev/refs/api/krb5_auth_con_free.rst","appdev/refs/api/krb5_auth_con_genaddrs.rst","appdev/refs/api/krb5_auth_con_get_checksum_func.rst","appdev/refs/api/krb5_auth_con_getaddrs.rst","appdev/refs/api/krb5_auth_con_getauthenticator.rst","appdev/refs/api/krb5_auth_con_getflags.rst","appdev/refs/api/krb5_auth_con_getkey.rst","appdev/refs/api/krb5_auth_con_getkey_k.rst","appdev/refs/api/krb5_auth_con_getlocalseqnumber.rst","appdev/refs/api/krb5_auth_con_getlocalsubkey.rst","appdev/refs/api/krb5_auth_con_getrcache.rst","appdev/refs/api/krb5_auth_con_getrecvsubkey.rst","appdev/refs/api/krb5_auth_con_getrecvsubkey_k.rst","appdev/refs/api/krb5_auth_con_getremoteseqnumber.rst","appdev/refs/api/krb5_auth_con_getremotesubkey.rst","appdev/refs/api/krb5_auth_con_getsendsubkey.rst","appdev/refs/api/krb5_auth_con_getsendsubkey_k.rst","appdev/refs/api/krb5_auth_con_init.rst","appdev/refs/api/krb5_auth_con_initivector.rst","appdev/refs/api/krb5_auth_con_set_checksum_func.rst","appdev/refs/api/krb5_auth_con_set_req_cksumtype.rst","appdev/refs/api/krb5_auth_con_setaddrs.rst","appdev/refs/api/krb5_auth_con_setflags.rst","appdev/refs/api/krb5_auth_con_setports.rst","appdev/refs/api/krb5_auth_con_setrcache.rst","appdev/refs/api/krb5_auth_con_setrecvsubkey.rst","appdev/refs/api/krb5_auth_con_setrecvsubkey_k.rst","appdev/refs/api/krb5_auth_con_setsendsubkey.rst","appdev/refs/api/krb5_auth_con_setsendsubkey_k.rst","appdev/refs/api/krb5_auth_con_setuseruserkey.rst","appdev/refs/api/krb5_build_principal.rst","appdev/refs/api/krb5_build_principal_alloc_va.rst","appdev/refs/api/krb5_build_principal_ext.rst","appdev/refs/api/krb5_build_principal_va.rst","appdev/refs/api/krb5_c_block_size.rst","appdev/refs/api/krb5_c_checksum_length.rst","appdev/refs/api/krb5_c_crypto_length.rst","appdev/refs/api/krb5_c_crypto_length_iov.rst","appdev/refs/api/krb5_c_decrypt.rst","appdev/refs/api/krb5_c_decrypt_iov.rst","appdev/refs/api/krb5_c_derive_prfplus.rst","appdev/refs/api/krb5_c_encrypt.rst","appdev/refs/api/krb5_c_encrypt_iov.rst","appdev/refs/api/krb5_c_encrypt_length.rst","appdev/refs/api/krb5_c_enctype_compare.rst","appdev/refs/api/krb5_c_free_state.rst","appdev/refs/api/krb5_c_fx_cf2_simple.rst","appdev/refs/api/krb5_c_init_state.rst","appdev/refs/api/krb5_c_is_coll_proof_cksum.rst","appdev/refs/api/krb5_c_is_keyed_cksum.rst","appdev/refs/api/krb5_c_keyed_checksum_types.rst","appdev/refs/api/krb5_c_keylengths.rst","appdev/refs/api/krb5_c_make_checksum.rst","appdev/refs/api/krb5_c_make_checksum_iov.rst","appdev/refs/api/krb5_c_make_random_key.rst","appdev/refs/api/krb5_c_padding_length.rst","appdev/refs/api/krb5_c_prf.rst","appdev/refs/api/krb5_c_prf_length.rst","appdev/refs/api/krb5_c_prfplus.rst","appdev/refs/api/krb5_c_random_add_entropy.rst","appdev/refs/api/krb5_c_random_make_octets.rst","appdev/refs/api/krb5_c_random_os_entropy.rst","appdev/refs/api/krb5_c_random_seed.rst","appdev/refs/api/krb5_c_random_to_key.rst","appdev/refs/api/krb5_c_string_to_key.rst","appdev/refs/api/krb5_c_string_to_key_with_params.rst","appdev/refs/api/krb5_c_valid_cksumtype.rst","appdev/refs/api/krb5_c_valid_enctype.rst","appdev/refs/api/krb5_c_verify_checksum.rst","appdev/refs/api/krb5_c_verify_checksum_iov.rst","appdev/refs/api/krb5_calculate_checksum.rst","appdev/refs/api/krb5_cc_cache_match.rst","appdev/refs/api/krb5_cc_close.rst","appdev/refs/api/krb5_cc_copy_creds.rst","appdev/refs/api/krb5_cc_default.rst","appdev/refs/api/krb5_cc_default_name.rst","appdev/refs/api/krb5_cc_destroy.rst","appdev/refs/api/krb5_cc_dup.rst","appdev/refs/api/krb5_cc_end_seq_get.rst","appdev/refs/api/krb5_cc_gen_new.rst","appdev/refs/api/krb5_cc_get_config.rst","appdev/refs/api/krb5_cc_get_flags.rst","appdev/refs/api/krb5_cc_get_full_name.rst","appdev/refs/api/krb5_cc_get_name.rst","appdev/refs/api/krb5_cc_get_principal.rst","appdev/refs/api/krb5_cc_get_type.rst","appdev/refs/api/krb5_cc_initialize.rst","appdev/refs/api/krb5_cc_move.rst","appdev/refs/api/krb5_cc_new_unique.rst","appdev/refs/api/krb5_cc_next_cred.rst","appdev/refs/api/krb5_cc_remove_cred.rst","appdev/refs/api/krb5_cc_resolve.rst","appdev/refs/api/krb5_cc_retrieve_cred.rst","appdev/refs/api/krb5_cc_select.rst","appdev/refs/api/krb5_cc_set_config.rst","appdev/refs/api/krb5_cc_set_default_name.rst","appdev/refs/api/krb5_cc_set_flags.rst","appdev/refs/api/krb5_cc_start_seq_get.rst","appdev/refs/api/krb5_cc_store_cred.rst","appdev/refs/api/krb5_cc_support_switch.rst","appdev/refs/api/krb5_cc_switch.rst","appdev/refs/api/krb5_cccol_cursor_free.rst","appdev/refs/api/krb5_cccol_cursor_new.rst","appdev/refs/api/krb5_cccol_cursor_next.rst","appdev/refs/api/krb5_cccol_have_content.rst","appdev/refs/api/krb5_change_password.rst","appdev/refs/api/krb5_check_clockskew.rst","appdev/refs/api/krb5_checksum_size.rst","appdev/refs/api/krb5_chpw_message.rst","appdev/refs/api/krb5_cksumtype_to_string.rst","appdev/refs/api/krb5_clear_error_message.rst","appdev/refs/api/krb5_copy_addresses.rst","appdev/refs/api/krb5_copy_authdata.rst","appdev/refs/api/krb5_copy_authenticator.rst","appdev/refs/api/krb5_copy_checksum.rst","appdev/refs/api/krb5_copy_context.rst","appdev/refs/api/krb5_copy_creds.rst","appdev/refs/api/krb5_copy_data.rst","appdev/refs/api/krb5_copy_error_message.rst","appdev/refs/api/krb5_copy_keyblock.rst","appdev/refs/api/krb5_copy_keyblock_contents.rst","appdev/refs/api/krb5_copy_principal.rst","appdev/refs/api/krb5_copy_ticket.rst","appdev/refs/api/krb5_decode_authdata_container.rst","appdev/refs/api/krb5_decode_ticket.rst","appdev/refs/api/krb5_decrypt.rst","appdev/refs/api/krb5_deltat_to_string.rst","appdev/refs/api/krb5_eblock_enctype.rst","appdev/refs/api/krb5_encode_authdata_container.rst","appdev/refs/api/krb5_encrypt.rst","appdev/refs/api/krb5_encrypt_size.rst","appdev/refs/api/krb5_enctype_to_name.rst","appdev/refs/api/krb5_enctype_to_string.rst","appdev/refs/api/krb5_expand_hostname.rst","appdev/refs/api/krb5_find_authdata.rst","appdev/refs/api/krb5_finish_key.rst","appdev/refs/api/krb5_finish_random_key.rst","appdev/refs/api/krb5_free_addresses.rst","appdev/refs/api/krb5_free_ap_rep_enc_part.rst","appdev/refs/api/krb5_free_authdata.rst","appdev/refs/api/krb5_free_authenticator.rst","appdev/refs/api/krb5_free_checksum.rst","appdev/refs/api/krb5_free_checksum_contents.rst","appdev/refs/api/krb5_free_cksumtypes.rst","appdev/refs/api/krb5_free_context.rst","appdev/refs/api/krb5_free_cred_contents.rst","appdev/refs/api/krb5_free_creds.rst","appdev/refs/api/krb5_free_data.rst","appdev/refs/api/krb5_free_data_contents.rst","appdev/refs/api/krb5_free_default_realm.rst","appdev/refs/api/krb5_free_enctypes.rst","appdev/refs/api/krb5_free_error.rst","appdev/refs/api/krb5_free_error_message.rst","appdev/refs/api/krb5_free_host_realm.rst","appdev/refs/api/krb5_free_keyblock.rst","appdev/refs/api/krb5_free_keyblock_contents.rst","appdev/refs/api/krb5_free_keytab_entry_contents.rst","appdev/refs/api/krb5_free_principal.rst","appdev/refs/api/krb5_free_string.rst","appdev/refs/api/krb5_free_tgt_creds.rst","appdev/refs/api/krb5_free_ticket.rst","appdev/refs/api/krb5_free_unparsed_name.rst","appdev/refs/api/krb5_fwd_tgt_creds.rst","appdev/refs/api/krb5_get_credentials.rst","appdev/refs/api/krb5_get_credentials_renew.rst","appdev/refs/api/krb5_get_credentials_validate.rst","appdev/refs/api/krb5_get_default_realm.rst","appdev/refs/api/krb5_get_error_message.rst","appdev/refs/api/krb5_get_etype_info.rst","appdev/refs/api/krb5_get_fallback_host_realm.rst","appdev/refs/api/krb5_get_host_realm.rst","appdev/refs/api/krb5_get_in_tkt_with_keytab.rst","appdev/refs/api/krb5_get_in_tkt_with_password.rst","appdev/refs/api/krb5_get_in_tkt_with_skey.rst","appdev/refs/api/krb5_get_init_creds_keytab.rst","appdev/refs/api/krb5_get_init_creds_opt_alloc.rst","appdev/refs/api/krb5_get_init_creds_opt_free.rst","appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags.rst","appdev/refs/api/krb5_get_init_creds_opt_init.rst","appdev/refs/api/krb5_get_init_creds_opt_set_address_list.rst","appdev/refs/api/krb5_get_init_creds_opt_set_anonymous.rst","appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize.rst","appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt.rst","appdev/refs/api/krb5_get_init_creds_opt_set_etype_list.rst","appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback.rst","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache.rst","appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name.rst","appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags.rst","appdev/refs/api/krb5_get_init_creds_opt_set_forwardable.rst","appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache.rst","appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache.rst","appdev/refs/api/krb5_get_init_creds_opt_set_pa.rst","appdev/refs/api/krb5_get_init_creds_opt_set_pac_request.rst","appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list.rst","appdev/refs/api/krb5_get_init_creds_opt_set_proxiable.rst","appdev/refs/api/krb5_get_init_creds_opt_set_renew_life.rst","appdev/refs/api/krb5_get_init_creds_opt_set_responder.rst","appdev/refs/api/krb5_get_init_creds_opt_set_salt.rst","appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life.rst","appdev/refs/api/krb5_get_init_creds_password.rst","appdev/refs/api/krb5_get_permitted_enctypes.rst","appdev/refs/api/krb5_get_profile.rst","appdev/refs/api/krb5_get_prompt_types.rst","appdev/refs/api/krb5_get_renewed_creds.rst","appdev/refs/api/krb5_get_server_rcache.rst","appdev/refs/api/krb5_get_time_offsets.rst","appdev/refs/api/krb5_get_validated_creds.rst","appdev/refs/api/krb5_init_context.rst","appdev/refs/api/krb5_init_context_profile.rst","appdev/refs/api/krb5_init_creds_free.rst","appdev/refs/api/krb5_init_creds_get.rst","appdev/refs/api/krb5_init_creds_get_creds.rst","appdev/refs/api/krb5_init_creds_get_error.rst","appdev/refs/api/krb5_init_creds_get_times.rst","appdev/refs/api/krb5_init_creds_init.rst","appdev/refs/api/krb5_init_creds_set_keytab.rst","appdev/refs/api/krb5_init_creds_set_password.rst","appdev/refs/api/krb5_init_creds_set_service.rst","appdev/refs/api/krb5_init_creds_step.rst","appdev/refs/api/krb5_init_keyblock.rst","appdev/refs/api/krb5_init_random_key.rst","appdev/refs/api/krb5_init_secure_context.rst","appdev/refs/api/krb5_is_config_principal.rst","appdev/refs/api/krb5_is_referral_realm.rst","appdev/refs/api/krb5_is_thread_safe.rst","appdev/refs/api/krb5_k_create_key.rst","appdev/refs/api/krb5_k_decrypt.rst","appdev/refs/api/krb5_k_decrypt_iov.rst","appdev/refs/api/krb5_k_encrypt.rst","appdev/refs/api/krb5_k_encrypt_iov.rst","appdev/refs/api/krb5_k_free_key.rst","appdev/refs/api/krb5_k_key_enctype.rst","appdev/refs/api/krb5_k_key_keyblock.rst","appdev/refs/api/krb5_k_make_checksum.rst","appdev/refs/api/krb5_k_make_checksum_iov.rst","appdev/refs/api/krb5_k_prf.rst","appdev/refs/api/krb5_k_reference_key.rst","appdev/refs/api/krb5_k_verify_checksum.rst","appdev/refs/api/krb5_k_verify_checksum_iov.rst","appdev/refs/api/krb5_kdc_sign_ticket.rst","appdev/refs/api/krb5_kdc_verify_ticket.rst","appdev/refs/api/krb5_kt_add_entry.rst","appdev/refs/api/krb5_kt_client_default.rst","appdev/refs/api/krb5_kt_close.rst","appdev/refs/api/krb5_kt_default.rst","appdev/refs/api/krb5_kt_default_name.rst","appdev/refs/api/krb5_kt_dup.rst","appdev/refs/api/krb5_kt_end_seq_get.rst","appdev/refs/api/krb5_kt_free_entry.rst","appdev/refs/api/krb5_kt_get_entry.rst","appdev/refs/api/krb5_kt_get_name.rst","appdev/refs/api/krb5_kt_get_type.rst","appdev/refs/api/krb5_kt_have_content.rst","appdev/refs/api/krb5_kt_next_entry.rst","appdev/refs/api/krb5_kt_read_service_key.rst","appdev/refs/api/krb5_kt_remove_entry.rst","appdev/refs/api/krb5_kt_resolve.rst","appdev/refs/api/krb5_kt_start_seq_get.rst","appdev/refs/api/krb5_kuserok.rst","appdev/refs/api/krb5_make_authdata_kdc_issued.rst","appdev/refs/api/krb5_marshal_credentials.rst","appdev/refs/api/krb5_merge_authdata.rst","appdev/refs/api/krb5_mk_1cred.rst","appdev/refs/api/krb5_mk_error.rst","appdev/refs/api/krb5_mk_ncred.rst","appdev/refs/api/krb5_mk_priv.rst","appdev/refs/api/krb5_mk_rep.rst","appdev/refs/api/krb5_mk_rep_dce.rst","appdev/refs/api/krb5_mk_req.rst","appdev/refs/api/krb5_mk_req_extended.rst","appdev/refs/api/krb5_mk_safe.rst","appdev/refs/api/krb5_os_localaddr.rst","appdev/refs/api/krb5_pac_add_buffer.rst","appdev/refs/api/krb5_pac_free.rst","appdev/refs/api/krb5_pac_get_buffer.rst","appdev/refs/api/krb5_pac_get_client_info.rst","appdev/refs/api/krb5_pac_get_types.rst","appdev/refs/api/krb5_pac_init.rst","appdev/refs/api/krb5_pac_parse.rst","appdev/refs/api/krb5_pac_sign.rst","appdev/refs/api/krb5_pac_sign_ext.rst","appdev/refs/api/krb5_pac_verify.rst","appdev/refs/api/krb5_pac_verify_ext.rst","appdev/refs/api/krb5_parse_name.rst","appdev/refs/api/krb5_parse_name_flags.rst","appdev/refs/api/krb5_prepend_error_message.rst","appdev/refs/api/krb5_principal2salt.rst","appdev/refs/api/krb5_principal_compare.rst","appdev/refs/api/krb5_principal_compare_any_realm.rst","appdev/refs/api/krb5_principal_compare_flags.rst","appdev/refs/api/krb5_process_key.rst","appdev/refs/api/krb5_prompter_posix.rst","appdev/refs/api/krb5_random_key.rst","appdev/refs/api/krb5_rd_cred.rst","appdev/refs/api/krb5_rd_error.rst","appdev/refs/api/krb5_rd_priv.rst","appdev/refs/api/krb5_rd_rep.rst","appdev/refs/api/krb5_rd_rep_dce.rst","appdev/refs/api/krb5_rd_req.rst","appdev/refs/api/krb5_rd_safe.rst","appdev/refs/api/krb5_read_password.rst","appdev/refs/api/krb5_realm_compare.rst","appdev/refs/api/krb5_recvauth.rst","appdev/refs/api/krb5_recvauth_version.rst","appdev/refs/api/krb5_responder_get_challenge.rst","appdev/refs/api/krb5_responder_list_questions.rst","appdev/refs/api/krb5_responder_otp_challenge_free.rst","appdev/refs/api/krb5_responder_otp_get_challenge.rst","appdev/refs/api/krb5_responder_otp_set_answer.rst","appdev/refs/api/krb5_responder_pkinit_challenge_free.rst","appdev/refs/api/krb5_responder_pkinit_get_challenge.rst","appdev/refs/api/krb5_responder_pkinit_set_answer.rst","appdev/refs/api/krb5_responder_set_answer.rst","appdev/refs/api/krb5_salttype_to_string.rst","appdev/refs/api/krb5_sendauth.rst","appdev/refs/api/krb5_server_decrypt_ticket_keytab.rst","appdev/refs/api/krb5_set_default_realm.rst","appdev/refs/api/krb5_set_default_tgs_enctypes.rst","appdev/refs/api/krb5_set_error_message.rst","appdev/refs/api/krb5_set_kdc_recv_hook.rst","appdev/refs/api/krb5_set_kdc_send_hook.rst","appdev/refs/api/krb5_set_password.rst","appdev/refs/api/krb5_set_password_using_ccache.rst","appdev/refs/api/krb5_set_principal_realm.rst","appdev/refs/api/krb5_set_real_time.rst","appdev/refs/api/krb5_set_trace_callback.rst","appdev/refs/api/krb5_set_trace_filename.rst","appdev/refs/api/krb5_sname_match.rst","appdev/refs/api/krb5_sname_to_principal.rst","appdev/refs/api/krb5_string_to_cksumtype.rst","appdev/refs/api/krb5_string_to_deltat.rst","appdev/refs/api/krb5_string_to_enctype.rst","appdev/refs/api/krb5_string_to_key.rst","appdev/refs/api/krb5_string_to_salttype.rst","appdev/refs/api/krb5_string_to_timestamp.rst","appdev/refs/api/krb5_timeofday.rst","appdev/refs/api/krb5_timestamp_to_sfstring.rst","appdev/refs/api/krb5_timestamp_to_string.rst","appdev/refs/api/krb5_tkt_creds_free.rst","appdev/refs/api/krb5_tkt_creds_get.rst","appdev/refs/api/krb5_tkt_creds_get_creds.rst","appdev/refs/api/krb5_tkt_creds_get_times.rst","appdev/refs/api/krb5_tkt_creds_init.rst","appdev/refs/api/krb5_tkt_creds_step.rst","appdev/refs/api/krb5_unmarshal_credentials.rst","appdev/refs/api/krb5_unparse_name.rst","appdev/refs/api/krb5_unparse_name_ext.rst","appdev/refs/api/krb5_unparse_name_flags.rst","appdev/refs/api/krb5_unparse_name_flags_ext.rst","appdev/refs/api/krb5_us_timeofday.rst","appdev/refs/api/krb5_use_enctype.rst","appdev/refs/api/krb5_verify_authdata_kdc_issued.rst","appdev/refs/api/krb5_verify_checksum.rst","appdev/refs/api/krb5_verify_init_creds.rst","appdev/refs/api/krb5_verify_init_creds_opt_init.rst","appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail.rst","appdev/refs/api/krb5_vprepend_error_message.rst","appdev/refs/api/krb5_vset_error_message.rst","appdev/refs/api/krb5_vwrap_error_message.rst","appdev/refs/api/krb5_wrap_error_message.rst","appdev/refs/index.rst","appdev/refs/macros/ADDRTYPE_ADDRPORT.rst","appdev/refs/macros/ADDRTYPE_CHAOS.rst","appdev/refs/macros/ADDRTYPE_DDP.rst","appdev/refs/macros/ADDRTYPE_INET.rst","appdev/refs/macros/ADDRTYPE_INET6.rst","appdev/refs/macros/ADDRTYPE_IPPORT.rst","appdev/refs/macros/ADDRTYPE_ISO.rst","appdev/refs/macros/ADDRTYPE_IS_LOCAL.rst","appdev/refs/macros/ADDRTYPE_NETBIOS.rst","appdev/refs/macros/ADDRTYPE_XNS.rst","appdev/refs/macros/AD_TYPE_EXTERNAL.rst","appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK.rst","appdev/refs/macros/AD_TYPE_REGISTERED.rst","appdev/refs/macros/AD_TYPE_RESERVED.rst","appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION.rst","appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED.rst","appdev/refs/macros/AP_OPTS_RESERVED.rst","appdev/refs/macros/AP_OPTS_USE_SESSION_KEY.rst","appdev/refs/macros/AP_OPTS_USE_SUBKEY.rst","appdev/refs/macros/AP_OPTS_WIRE_MASK.rst","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128.rst","appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256.rst","appdev/refs/macros/CKSUMTYPE_CRC32.rst","appdev/refs/macros/CKSUMTYPE_DESCBC.rst","appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128.rst","appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256.rst","appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR.rst","appdev/refs/macros/CKSUMTYPE_NIST_SHA.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD4.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD5.rst","appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES.rst","appdev/refs/macros/CKSUMTYPE_SHA1.rst","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96.rst","appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128.rst","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96.rst","appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192.rst","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC.rst","appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP.rst","appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC.rst","appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_ENV.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_RAW.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA.rst","appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1.rst","appdev/refs/macros/ENCTYPE_DES_CBC_CRC.rst","appdev/refs/macros/ENCTYPE_DES_CBC_MD4.rst","appdev/refs/macros/ENCTYPE_DES_CBC_MD5.rst","appdev/refs/macros/ENCTYPE_DES_CBC_RAW.rst","appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1.rst","appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS.rst","appdev/refs/macros/ENCTYPE_MD5_RSA_CMS.rst","appdev/refs/macros/ENCTYPE_NULL.rst","appdev/refs/macros/ENCTYPE_RC2_CBC_ENV.rst","appdev/refs/macros/ENCTYPE_RSA_ENV.rst","appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV.rst","appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS.rst","appdev/refs/macros/ENCTYPE_UNKNOWN.rst","appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE.rst","appdev/refs/macros/KDC_OPT_CANONICALIZE.rst","appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT.rst","appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK.rst","appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY.rst","appdev/refs/macros/KDC_OPT_FORWARDABLE.rst","appdev/refs/macros/KDC_OPT_FORWARDED.rst","appdev/refs/macros/KDC_OPT_POSTDATED.rst","appdev/refs/macros/KDC_OPT_PROXIABLE.rst","appdev/refs/macros/KDC_OPT_PROXY.rst","appdev/refs/macros/KDC_OPT_RENEW.rst","appdev/refs/macros/KDC_OPT_RENEWABLE.rst","appdev/refs/macros/KDC_OPT_RENEWABLE_OK.rst","appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS.rst","appdev/refs/macros/KDC_OPT_VALIDATE.rst","appdev/refs/macros/KDC_TKT_COMMON_MASK.rst","appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE.rst","appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR.rst","appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR.rst","appdev/refs/macros/KRB5_AP_REP.rst","appdev/refs/macros/KRB5_AP_REQ.rst","appdev/refs/macros/KRB5_AS_REP.rst","appdev/refs/macros/KRB5_AS_REQ.rst","appdev/refs/macros/KRB5_AUTHDATA_AND_OR.rst","appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS.rst","appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR.rst","appdev/refs/macros/KRB5_AUTHDATA_CAMMAC.rst","appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION.rst","appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR.rst","appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT.rst","appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS.rst","appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED.rst","appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC.rst","appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE.rst","appdev/refs/macros/KRB5_AUTHDATA_SESAME.rst","appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET.rst","appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME.rst","appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY.rst","appdev/refs/macros/KRB5_CRED.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM.rst","appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER.rst","appdev/refs/macros/KRB5_CYBERSAFE_SECUREID.rst","appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS.rst","appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP.rst","appdev/refs/macros/KRB5_ERROR.rst","appdev/refs/macros/KRB5_FAST_REQUIRED.rst","appdev/refs/macros/KRB5_GC_CACHED.rst","appdev/refs/macros/KRB5_GC_CANONICALIZE.rst","appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION.rst","appdev/refs/macros/KRB5_GC_FORWARDABLE.rst","appdev/refs/macros/KRB5_GC_NO_STORE.rst","appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK.rst","appdev/refs/macros/KRB5_GC_USER_USER.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT.rst","appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE.rst","appdev/refs/macros/KRB5_INIT_CONTEXT_KDC.rst","appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE.rst","appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE.rst","appdev/refs/macros/KRB5_INT16_MAX.rst","appdev/refs/macros/KRB5_INT16_MIN.rst","appdev/refs/macros/KRB5_INT32_MAX.rst","appdev/refs/macros/KRB5_INT32_MIN.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE.rst","appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH.rst","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT.rst","appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH.rst","appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ.rst","appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS.rst","appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC.rst","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT.rst","appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP.rst","appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC.rst","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG.rst","appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV.rst","appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED.rst","appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART.rst","appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID.rst","appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE.rst","appdev/refs/macros/KRB5_KEYUSAGE_SPAKE.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH.rst","appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM.rst","appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED.rst","appdev/refs/macros/KRB5_KPASSWD_AUTHERROR.rst","appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION.rst","appdev/refs/macros/KRB5_KPASSWD_HARDERROR.rst","appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED.rst","appdev/refs/macros/KRB5_KPASSWD_MALFORMED.rst","appdev/refs/macros/KRB5_KPASSWD_SOFTERROR.rst","appdev/refs/macros/KRB5_KPASSWD_SUCCESS.rst","appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT.rst","appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED.rst","appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME.rst","appdev/refs/macros/KRB5_LRQ_NONE.rst","appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT.rst","appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED.rst","appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME.rst","appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL.rst","appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID.rst","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL.rst","appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID.rst","appdev/refs/macros/KRB5_NT_PRINCIPAL.rst","appdev/refs/macros/KRB5_NT_SMTP_NAME.rst","appdev/refs/macros/KRB5_NT_SRV_HST.rst","appdev/refs/macros/KRB5_NT_SRV_INST.rst","appdev/refs/macros/KRB5_NT_SRV_XHST.rst","appdev/refs/macros/KRB5_NT_UID.rst","appdev/refs/macros/KRB5_NT_UNKNOWN.rst","appdev/refs/macros/KRB5_NT_WELLKNOWN.rst","appdev/refs/macros/KRB5_NT_X500_PRINCIPAL.rst","appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO.rst","appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS.rst","appdev/refs/macros/KRB5_PAC_CLIENT_INFO.rst","appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO.rst","appdev/refs/macros/KRB5_PAC_DELEGATION_INFO.rst","appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS.rst","appdev/refs/macros/KRB5_PAC_DEVICE_INFO.rst","appdev/refs/macros/KRB5_PAC_LOGON_INFO.rst","appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM.rst","appdev/refs/macros/KRB5_PAC_REQUESTOR.rst","appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM.rst","appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM.rst","appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO.rst","appdev/refs/macros/KRB5_PADATA_AFS3_SALT.rst","appdev/refs/macros/KRB5_PADATA_AP_REQ.rst","appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM.rst","appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS.rst","appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE.rst","appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID.rst","appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP.rst","appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME.rst","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO.rst","appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2.rst","appdev/refs/macros/KRB5_PADATA_FOR_USER.rst","appdev/refs/macros/KRB5_PADATA_FX_COOKIE.rst","appdev/refs/macros/KRB5_PADATA_FX_ERROR.rst","appdev/refs/macros/KRB5_PADATA_FX_FAST.rst","appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA.rst","appdev/refs/macros/KRB5_PADATA_NONE.rst","appdev/refs/macros/KRB5_PADATA_OSF_DCE.rst","appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE.rst","appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE.rst","appdev/refs/macros/KRB5_PADATA_OTP_REQUEST.rst","appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS.rst","appdev/refs/macros/KRB5_PADATA_PAC_REQUEST.rst","appdev/refs/macros/KRB5_PADATA_PKINIT_KX.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REP.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ.rst","appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD.rst","appdev/refs/macros/KRB5_PADATA_PW_SALT.rst","appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2.rst","appdev/refs/macros/KRB5_PADATA_REFERRAL.rst","appdev/refs/macros/KRB5_PADATA_S4U_X509_USER.rst","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE.rst","appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2.rst","appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT.rst","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE.rst","appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2.rst","appdev/refs/macros/KRB5_PADATA_SESAME.rst","appdev/refs/macros/KRB5_PADATA_SPAKE.rst","appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO.rst","appdev/refs/macros/KRB5_PADATA_TGS_REQ.rst","appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY.rst","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM.rst","appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT.rst","appdev/refs/macros/KRB5_PRIV.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD.rst","appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH.rst","appdev/refs/macros/KRB5_PVNO.rst","appdev/refs/macros/KRB5_REALM_BRANCH_CHAR.rst","appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS.rst","appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION.rst","appdev/refs/macros/KRB5_REFERRAL_REALM.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL.rst","appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL.rst","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW.rst","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY.rst","appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED.rst","appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP.rst","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD.rst","appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT.rst","appdev/refs/macros/KRB5_SAFE.rst","appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD.rst","appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD.rst","appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY.rst","appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT.rst","appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA.rst","appdev/refs/macros/KRB5_TC_MATCH_FLAGS.rst","appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT.rst","appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY.rst","appdev/refs/macros/KRB5_TC_MATCH_KTYPE.rst","appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY.rst","appdev/refs/macros/KRB5_TC_MATCH_TIMES.rst","appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT.rst","appdev/refs/macros/KRB5_TC_NOTICKET.rst","appdev/refs/macros/KRB5_TC_OPENCLOSE.rst","appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES.rst","appdev/refs/macros/KRB5_TGS_NAME.rst","appdev/refs/macros/KRB5_TGS_NAME_SIZE.rst","appdev/refs/macros/KRB5_TGS_REP.rst","appdev/refs/macros/KRB5_TGS_REQ.rst","appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE.rst","appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL.rst","appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR.rst","appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK.rst","appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY.rst","appdev/refs/macros/MAX_KEYTAB_NAME_LEN.rst","appdev/refs/macros/MSEC_DIRBIT.rst","appdev/refs/macros/MSEC_VAL_MASK.rst","appdev/refs/macros/SALT_TYPE_AFS_LENGTH.rst","appdev/refs/macros/SALT_TYPE_NO_LENGTH.rst","appdev/refs/macros/THREEPARAMOPEN.rst","appdev/refs/macros/TKT_FLG_ANONYMOUS.rst","appdev/refs/macros/TKT_FLG_ENC_PA_REP.rst","appdev/refs/macros/TKT_FLG_FORWARDABLE.rst","appdev/refs/macros/TKT_FLG_FORWARDED.rst","appdev/refs/macros/TKT_FLG_HW_AUTH.rst","appdev/refs/macros/TKT_FLG_INITIAL.rst","appdev/refs/macros/TKT_FLG_INVALID.rst","appdev/refs/macros/TKT_FLG_MAY_POSTDATE.rst","appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE.rst","appdev/refs/macros/TKT_FLG_POSTDATED.rst","appdev/refs/macros/TKT_FLG_PRE_AUTH.rst","appdev/refs/macros/TKT_FLG_PROXIABLE.rst","appdev/refs/macros/TKT_FLG_PROXY.rst","appdev/refs/macros/TKT_FLG_RENEWABLE.rst","appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED.rst","appdev/refs/macros/VALID_INT_BITS.rst","appdev/refs/macros/VALID_UINT_BITS.rst","appdev/refs/macros/index.rst","appdev/refs/macros/krb524_convert_creds_kdc.rst","appdev/refs/macros/krb524_init_ets.rst","appdev/refs/macros/krb5_const.rst","appdev/refs/macros/krb5_princ_component.rst","appdev/refs/macros/krb5_princ_name.rst","appdev/refs/macros/krb5_princ_realm.rst","appdev/refs/macros/krb5_princ_set_realm.rst","appdev/refs/macros/krb5_princ_set_realm_data.rst","appdev/refs/macros/krb5_princ_set_realm_length.rst","appdev/refs/macros/krb5_princ_size.rst","appdev/refs/macros/krb5_princ_type.rst","appdev/refs/macros/krb5_roundup.rst","appdev/refs/macros/krb5_x.rst","appdev/refs/macros/krb5_xc.rst","appdev/refs/types/index.rst","appdev/refs/types/krb5_address.rst","appdev/refs/types/krb5_addrtype.rst","appdev/refs/types/krb5_ap_rep.rst","appdev/refs/types/krb5_ap_rep_enc_part.rst","appdev/refs/types/krb5_ap_req.rst","appdev/refs/types/krb5_auth_context.rst","appdev/refs/types/krb5_authdata.rst","appdev/refs/types/krb5_authdatatype.rst","appdev/refs/types/krb5_authenticator.rst","appdev/refs/types/krb5_boolean.rst","appdev/refs/types/krb5_cc_cursor.rst","appdev/refs/types/krb5_ccache.rst","appdev/refs/types/krb5_cccol_cursor.rst","appdev/refs/types/krb5_checksum.rst","appdev/refs/types/krb5_cksumtype.rst","appdev/refs/types/krb5_const_pointer.rst","appdev/refs/types/krb5_const_principal.rst","appdev/refs/types/krb5_context.rst","appdev/refs/types/krb5_cred.rst","appdev/refs/types/krb5_cred_enc_part.rst","appdev/refs/types/krb5_cred_info.rst","appdev/refs/types/krb5_creds.rst","appdev/refs/types/krb5_crypto_iov.rst","appdev/refs/types/krb5_cryptotype.rst","appdev/refs/types/krb5_data.rst","appdev/refs/types/krb5_deltat.rst","appdev/refs/types/krb5_enc_data.rst","appdev/refs/types/krb5_enc_kdc_rep_part.rst","appdev/refs/types/krb5_enc_tkt_part.rst","appdev/refs/types/krb5_encrypt_block.rst","appdev/refs/types/krb5_enctype.rst","appdev/refs/types/krb5_error.rst","appdev/refs/types/krb5_error_code.rst","appdev/refs/types/krb5_expire_callback_func.rst","appdev/refs/types/krb5_flags.rst","appdev/refs/types/krb5_get_init_creds_opt.rst","appdev/refs/types/krb5_gic_opt_pa_data.rst","appdev/refs/types/krb5_init_creds_context.rst","appdev/refs/types/krb5_int16.rst","appdev/refs/types/krb5_int32.rst","appdev/refs/types/krb5_kdc_rep.rst","appdev/refs/types/krb5_kdc_req.rst","appdev/refs/types/krb5_key.rst","appdev/refs/types/krb5_keyblock.rst","appdev/refs/types/krb5_keytab.rst","appdev/refs/types/krb5_keytab_entry.rst","appdev/refs/types/krb5_keyusage.rst","appdev/refs/types/krb5_kt_cursor.rst","appdev/refs/types/krb5_kvno.rst","appdev/refs/types/krb5_last_req_entry.rst","appdev/refs/types/krb5_magic.rst","appdev/refs/types/krb5_mk_req_checksum_func.rst","appdev/refs/types/krb5_msgtype.rst","appdev/refs/types/krb5_octet.rst","appdev/refs/types/krb5_pa_data.rst","appdev/refs/types/krb5_pa_pac_req.rst","appdev/refs/types/krb5_pa_server_referral_data.rst","appdev/refs/types/krb5_pa_svr_referral_data.rst","appdev/refs/types/krb5_pac.rst","appdev/refs/types/krb5_pointer.rst","appdev/refs/types/krb5_post_recv_fn.rst","appdev/refs/types/krb5_pre_send_fn.rst","appdev/refs/types/krb5_preauthtype.rst","appdev/refs/types/krb5_principal.rst","appdev/refs/types/krb5_principal_data.rst","appdev/refs/types/krb5_prompt.rst","appdev/refs/types/krb5_prompt_type.rst","appdev/refs/types/krb5_prompter_fct.rst","appdev/refs/types/krb5_pwd_data.rst","appdev/refs/types/krb5_rcache.rst","appdev/refs/types/krb5_replay_data.rst","appdev/refs/types/krb5_responder_context.rst","appdev/refs/types/krb5_responder_fn.rst","appdev/refs/types/krb5_responder_otp_challenge.rst","appdev/refs/types/krb5_responder_otp_tokeninfo.rst","appdev/refs/types/krb5_responder_pkinit_challenge.rst","appdev/refs/types/krb5_responder_pkinit_identity.rst","appdev/refs/types/krb5_response.rst","appdev/refs/types/krb5_ticket.rst","appdev/refs/types/krb5_ticket_times.rst","appdev/refs/types/krb5_timestamp.rst","appdev/refs/types/krb5_tkt_authent.rst","appdev/refs/types/krb5_tkt_creds_context.rst","appdev/refs/types/krb5_trace_callback.rst","appdev/refs/types/krb5_trace_info.rst","appdev/refs/types/krb5_transited.rst","appdev/refs/types/krb5_typed_data.rst","appdev/refs/types/krb5_ui_2.rst","appdev/refs/types/krb5_ui_4.rst","appdev/refs/types/krb5_verify_init_creds_opt.rst","appdev/refs/types/passwd_phrase_element.rst","appdev/y2038.rst","basic/ccache_def.rst","basic/date_format.rst","basic/index.rst","basic/keytab_def.rst","basic/rcache_def.rst","basic/stash_file_def.rst","build/directory_org.rst","build/doing_build.rst","build/index.rst","build/options2configure.rst","build/osconf.rst","build_this.rst","copyright.rst","formats/ccache_file_format.rst","formats/cookie.rst","formats/freshness_token.rst","formats/index.rst","formats/keytab_file_format.rst","formats/rcache_file_format.rst","index.rst","mitK5defaults.rst","mitK5features.rst","mitK5license.rst","plugindev/ccselect.rst","plugindev/certauth.rst","plugindev/clpreauth.rst","plugindev/general.rst","plugindev/gssapi.rst","plugindev/hostrealm.rst","plugindev/index.rst","plugindev/internal.rst","plugindev/kadm5_auth.rst","plugindev/kadm5_hook.rst","plugindev/kdcpolicy.rst","plugindev/kdcpreauth.rst","plugindev/localauth.rst","plugindev/locate.rst","plugindev/profile.rst","plugindev/pwqual.rst","resources.rst","user/index.rst","user/pwd_mgmt.rst","user/tkt_mgmt.rst","user/user_commands/index.rst","user/user_commands/kdestroy.rst","user/user_commands/kinit.rst","user/user_commands/klist.rst","user/user_commands/kpasswd.rst","user/user_commands/krb5-config.rst","user/user_commands/ksu.rst","user/user_commands/kswitch.rst","user/user_commands/kvno.rst","user/user_commands/sclient.rst","user/user_config/index.rst","user/user_config/k5identity.rst","user/user_config/k5login.rst","user/user_config/kerberos.rst",objects:{"":{ADDRTYPE_ADDRPORT:422,3,1,"",ADDRTYPE_CHAOS:423,3,1,"",ADDRTYPE_DDP:424,3,1,"",ADDRTYPE_INET6:426,3,1,"",ADDRTYPE_INET:425,3,1,"",ADDRTYPE_IPPORT:427,3,1,"",ADDRTYPE_ISO:428,3,1,"",ADDRTYPE_IS_LOCAL:429,3,1,"",ADDRTYPE_NETBIOS:430,3,1,"",ADDRTYPE_XNS:431,3,1,"",AD_TYPE_EXTERNAL:432,3,1,"",AD_TYPE_FIELD_TYPE_MASK:433,3,1,"",AD_TYPE_REGISTERED:434,3,1,"",AD_TYPE_RESERVED:435,3,1,"",AP_OPTS_ETYPE_NEGOTIATION:436,3,1,"",AP_OPTS_MUTUAL_REQUIRED:437,3,1,"",AP_OPTS_RESERVED:438,3,1,"",AP_OPTS_USE_SESSION_KEY:439,3,1,"",AP_OPTS_USE_SUBKEY:440,3,1,"",AP_OPTS_WIRE_MASK:441,3,1,"",CKSUMTYPE_CMAC_CAMELLIA128:442,3,1,"",CKSUMTYPE_CMAC_CAMELLIA256:443,3,1,"",CKSUMTYPE_CRC32:444,3,1,"",CKSUMTYPE_DESCBC:445,3,1,"",CKSUMTYPE_HMAC_MD5_ARCFOUR:446,3,1,"",CKSUMTYPE_HMAC_SHA1_96_AES128:447,3,1,"",CKSUMTYPE_HMAC_SHA1_96_AES256:448,3,1,"",CKSUMTYPE_HMAC_SHA1_DES3:449,3,1,"",CKSUMTYPE_HMAC_SHA256_128_AES128:450,3,1,"",CKSUMTYPE_HMAC_SHA384_192_AES256:451,3,1,"",CKSUMTYPE_MD5_HMAC_ARCFOUR:452,3,1,"",CKSUMTYPE_NIST_SHA:453,3,1,"",CKSUMTYPE_RSA_MD4:454,3,1,"",CKSUMTYPE_RSA_MD4_DES:455,3,1,"",CKSUMTYPE_RSA_MD5:456,3,1,"",CKSUMTYPE_RSA_MD5_DES:457,3,1,"",CKSUMTYPE_SHA1:458,3,1,"",ENCTYPE_AES128_CTS_HMAC_SHA1_96:459,3,1,"",ENCTYPE_AES128_CTS_HMAC_SHA256_128:460,3,1,"",ENCTYPE_AES256_CTS_HMAC_SHA1_96:461,3,1,"",ENCTYPE_AES256_CTS_HMAC_SHA384_192:462,3,1,"",ENCTYPE_ARCFOUR_HMAC:463,3,1,"",ENCTYPE_ARCFOUR_HMAC_EXP:464,3,1,"",ENCTYPE_CAMELLIA128_CTS_CMAC:465,3,1,"",ENCTYPE_CAMELLIA256_CTS_CMAC:466,3,1,"",ENCTYPE_DES3_CBC_ENV:467,3,1,"",ENCTYPE_DES3_CBC_RAW:468,3,1,"",ENCTYPE_DES3_CBC_SHA1:470,3,1,"",ENCTYPE_DES3_CBC_SHA:469,3,1,"",ENCTYPE_DES_CBC_CRC:471,3,1,"",ENCTYPE_DES_CBC_MD4:472,3,1,"",ENCTYPE_DES_CBC_MD5:473,3,1,"",ENCTYPE_DES_CBC_RAW:474,3,1,"",ENCTYPE_DES_HMAC_SHA1:475,3,1,"",ENCTYPE_DSA_SHA1_CMS:476,3,1,"",ENCTYPE_MD5_RSA_CMS:477,3,1,"",ENCTYPE_NULL:478,3,1,"",ENCTYPE_RC2_CBC_ENV:479,3,1,"",ENCTYPE_RSA_ENV:480,3,1,"",ENCTYPE_RSA_ES_OAEP_ENV:481,3,1,"",ENCTYPE_SHA1_RSA_CMS:482,3,1,"",ENCTYPE_UNKNOWN:483,3,1,"",KDC_OPT_ALLOW_POSTDATE:484,3,1,"",KDC_OPT_CANONICALIZE:485,3,1,"",KDC_OPT_CNAME_IN_ADDL_TKT:486,3,1,"",KDC_OPT_DISABLE_TRANSITED_CHECK:487,3,1,"",KDC_OPT_ENC_TKT_IN_SKEY:488,3,1,"",KDC_OPT_FORWARDABLE:489,3,1,"",KDC_OPT_FORWARDED:490,3,1,"",KDC_OPT_POSTDATED:491,3,1,"",KDC_OPT_PROXIABLE:492,3,1,"",KDC_OPT_PROXY:493,3,1,"",KDC_OPT_RENEW:494,3,1,"",KDC_OPT_RENEWABLE:495,3,1,"",KDC_OPT_RENEWABLE_OK:496,3,1,"",KDC_OPT_REQUEST_ANONYMOUS:497,3,1,"",KDC_OPT_VALIDATE:498,3,1,"",KDC_TKT_COMMON_MASK:499,3,1,"",KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE:500,3,1,"",KRB5_ANONYMOUS_PRINCSTR:501,3,1,"",KRB5_ANONYMOUS_REALMSTR:502,3,1,"",KRB5_AP_REP:503,3,1,"",KRB5_AP_REQ:504,3,1,"",KRB5_AS_REP:505,3,1,"",KRB5_AS_REQ:506,3,1,"",KRB5_AUTHDATA_AND_OR:507,3,1,"",KRB5_AUTHDATA_AP_OPTIONS:508,3,1,"",KRB5_AUTHDATA_AUTH_INDICATOR:509,3,1,"",KRB5_AUTHDATA_CAMMAC:510,3,1,"",KRB5_AUTHDATA_ETYPE_NEGOTIATION:511,3,1,"",KRB5_AUTHDATA_FX_ARMOR:512,3,1,"",KRB5_AUTHDATA_IF_RELEVANT:513,3,1,"",KRB5_AUTHDATA_INITIAL_VERIFIED_CAS:514,3,1,"",KRB5_AUTHDATA_KDC_ISSUED:515,3,1,"",KRB5_AUTHDATA_MANDATORY_FOR_KDC:516,3,1,"",KRB5_AUTHDATA_OSF_DCE:517,3,1,"",KRB5_AUTHDATA_SESAME:518,3,1,"",KRB5_AUTHDATA_SIGNTICKET:519,3,1,"",KRB5_AUTHDATA_WIN2K_PAC:520,3,1,"",KRB5_AUTH_CONTEXT_DO_SEQUENCE:521,3,1,"",KRB5_AUTH_CONTEXT_DO_TIME:522,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR:523,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR:524,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR:525,3,1,"",KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR:526,3,1,"",KRB5_AUTH_CONTEXT_PERMIT_ALL:527,3,1,"",KRB5_AUTH_CONTEXT_RET_SEQUENCE:528,3,1,"",KRB5_AUTH_CONTEXT_RET_TIME:529,3,1,"",KRB5_AUTH_CONTEXT_USE_SUBKEY:530,3,1,"",KRB5_CRED:531,3,1,"",KRB5_CRYPTO_TYPE_CHECKSUM:532,3,1,"",KRB5_CRYPTO_TYPE_DATA:533,3,1,"",KRB5_CRYPTO_TYPE_EMPTY:534,3,1,"",KRB5_CRYPTO_TYPE_HEADER:535,3,1,"",KRB5_CRYPTO_TYPE_PADDING:536,3,1,"",KRB5_CRYPTO_TYPE_SIGN_ONLY:537,3,1,"",KRB5_CRYPTO_TYPE_STREAM:538,3,1,"",KRB5_CRYPTO_TYPE_TRAILER:539,3,1,"",KRB5_CYBERSAFE_SECUREID:540,3,1,"",KRB5_DOMAIN_X500_COMPRESS:541,3,1,"",KRB5_ENCPADATA_REQ_ENC_PA_REP:542,3,1,"",KRB5_ERROR:543,3,1,"",KRB5_FAST_REQUIRED:544,3,1,"",KRB5_GC_CACHED:545,3,1,"",KRB5_GC_CANONICALIZE:546,3,1,"",KRB5_GC_CONSTRAINED_DELEGATION:547,3,1,"",KRB5_GC_FORWARDABLE:548,3,1,"",KRB5_GC_NO_STORE:549,3,1,"",KRB5_GC_NO_TRANSIT_CHECK:550,3,1,"",KRB5_GC_USER_USER:551,3,1,"",KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST:552,3,1,"",KRB5_GET_INIT_CREDS_OPT_ANONYMOUS:553,3,1,"",KRB5_GET_INIT_CREDS_OPT_CANONICALIZE:554,3,1,"",KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT:555,3,1,"",KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST:556,3,1,"",KRB5_GET_INIT_CREDS_OPT_FORWARDABLE:557,3,1,"",KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST:558,3,1,"",KRB5_GET_INIT_CREDS_OPT_PROXIABLE:559,3,1,"",KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE:560,3,1,"",KRB5_GET_INIT_CREDS_OPT_SALT:561,3,1,"",KRB5_GET_INIT_CREDS_OPT_TKT_LIFE:562,3,1,"",KRB5_INIT_CONTEXT_KDC:563,3,1,"",KRB5_INIT_CONTEXT_SECURE:564,3,1,"",KRB5_INIT_CREDS_STEP_FLAG_CONTINUE:565,3,1,"",KRB5_INT16_MAX:566,3,1,"",KRB5_INT16_MIN:567,3,1,"",KRB5_INT32_MAX:568,3,1,"",KRB5_INT32_MIN:569,3,1,"",KRB5_KEYUSAGE_AD_ITE:570,3,1,"",KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM:571,3,1,"",KRB5_KEYUSAGE_AD_MTE:572,3,1,"",KRB5_KEYUSAGE_AD_SIGNEDPATH:573,3,1,"",KRB5_KEYUSAGE_APP_DATA_CKSUM:574,3,1,"",KRB5_KEYUSAGE_APP_DATA_ENCRYPT:575,3,1,"",KRB5_KEYUSAGE_AP_REP_ENCPART:576,3,1,"",KRB5_KEYUSAGE_AP_REQ_AUTH:577,3,1,"",KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM:578,3,1,"",KRB5_KEYUSAGE_AS_REP_ENCPART:579,3,1,"",KRB5_KEYUSAGE_AS_REQ:580,3,1,"",KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS:581,3,1,"",KRB5_KEYUSAGE_CAMMAC:582,3,1,"",KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT:583,3,1,"",KRB5_KEYUSAGE_ENC_CHALLENGE_KDC:584,3,1,"",KRB5_KEYUSAGE_FAST_ENC:585,3,1,"",KRB5_KEYUSAGE_FAST_FINISHED:586,3,1,"",KRB5_KEYUSAGE_FAST_REP:587,3,1,"",KRB5_KEYUSAGE_FAST_REQ_CHKSUM:588,3,1,"",KRB5_KEYUSAGE_GSS_TOK_MIC:589,3,1,"",KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG:590,3,1,"",KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV:591,3,1,"",KRB5_KEYUSAGE_IAKERB_FINISHED:592,3,1,"",KRB5_KEYUSAGE_KDC_REP_TICKET:593,3,1,"",KRB5_KEYUSAGE_KRB_CRED_ENCPART:594,3,1,"",KRB5_KEYUSAGE_KRB_ERROR_CKSUM:595,3,1,"",KRB5_KEYUSAGE_KRB_PRIV_ENCPART:596,3,1,"",KRB5_KEYUSAGE_KRB_SAFE_CKSUM:597,3,1,"",KRB5_KEYUSAGE_PA_AS_FRESHNESS:598,3,1,"",KRB5_KEYUSAGE_PA_FX_COOKIE:599,3,1,"",KRB5_KEYUSAGE_PA_OTP_REQUEST:600,3,1,"",KRB5_KEYUSAGE_PA_PKINIT_KX:601,3,1,"",KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY:602,3,1,"",KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST:603,3,1,"",KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM:604,3,1,"",KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID:605,3,1,"",KRB5_KEYUSAGE_PA_SAM_RESPONSE:606,3,1,"",KRB5_KEYUSAGE_SPAKE:607,3,1,"",KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY:608,3,1,"",KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY:609,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY:610,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY:611,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AUTH:612,3,1,"",KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM:613,3,1,"",KRB5_KPASSWD_ACCESSDENIED:614,3,1,"",KRB5_KPASSWD_AUTHERROR:615,3,1,"",KRB5_KPASSWD_BAD_VERSION:616,3,1,"",KRB5_KPASSWD_HARDERROR:617,3,1,"",KRB5_KPASSWD_INITIAL_FLAG_NEEDED:618,3,1,"",KRB5_KPASSWD_MALFORMED:619,3,1,"",KRB5_KPASSWD_SOFTERROR:620,3,1,"",KRB5_KPASSWD_SUCCESS:621,3,1,"",KRB5_LRQ_ALL_ACCT_EXPTIME:622,3,1,"",KRB5_LRQ_ALL_LAST_INITIAL:623,3,1,"",KRB5_LRQ_ALL_LAST_RENEWAL:624,3,1,"",KRB5_LRQ_ALL_LAST_REQ:625,3,1,"",KRB5_LRQ_ALL_LAST_TGT:626,3,1,"",KRB5_LRQ_ALL_LAST_TGT_ISSUED:627,3,1,"",KRB5_LRQ_ALL_PW_EXPTIME:628,3,1,"",KRB5_LRQ_NONE:629,3,1,"",KRB5_LRQ_ONE_ACCT_EXPTIME:630,3,1,"",KRB5_LRQ_ONE_LAST_INITIAL:631,3,1,"",KRB5_LRQ_ONE_LAST_RENEWAL:632,3,1,"",KRB5_LRQ_ONE_LAST_REQ:633,3,1,"",KRB5_LRQ_ONE_LAST_TGT:634,3,1,"",KRB5_LRQ_ONE_LAST_TGT_ISSUED:635,3,1,"",KRB5_LRQ_ONE_PW_EXPTIME:636,3,1,"",KRB5_NT_ENTERPRISE_PRINCIPAL:637,3,1,"",KRB5_NT_ENT_PRINCIPAL_AND_ID:638,3,1,"",KRB5_NT_MS_PRINCIPAL:639,3,1,"",KRB5_NT_MS_PRINCIPAL_AND_ID:640,3,1,"",KRB5_NT_PRINCIPAL:641,3,1,"",KRB5_NT_SMTP_NAME:642,3,1,"",KRB5_NT_SRV_HST:643,3,1,"",KRB5_NT_SRV_INST:644,3,1,"",KRB5_NT_SRV_XHST:645,3,1,"",KRB5_NT_UID:646,3,1,"",KRB5_NT_UNKNOWN:647,3,1,"",KRB5_NT_WELLKNOWN:648,3,1,"",KRB5_NT_X500_PRINCIPAL:649,3,1,"",KRB5_PAC_ATTRIBUTES_INFO:650,3,1,"",KRB5_PAC_CLIENT_CLAIMS:651,3,1,"",KRB5_PAC_CLIENT_INFO:652,3,1,"",KRB5_PAC_CREDENTIALS_INFO:653,3,1,"",KRB5_PAC_DELEGATION_INFO:654,3,1,"",KRB5_PAC_DEVICE_CLAIMS:655,3,1,"",KRB5_PAC_DEVICE_INFO:656,3,1,"",KRB5_PAC_LOGON_INFO:657,3,1,"",KRB5_PAC_PRIVSVR_CHECKSUM:658,3,1,"",KRB5_PAC_REQUESTOR:659,3,1,"",KRB5_PAC_SERVER_CHECKSUM:660,3,1,"",KRB5_PAC_TICKET_CHECKSUM:661,3,1,"",KRB5_PAC_UPN_DNS_INFO:662,3,1,"",KRB5_PADATA_AFS3_SALT:663,3,1,"",KRB5_PADATA_AP_REQ:664,3,1,"",KRB5_PADATA_AS_CHECKSUM:665,3,1,"",KRB5_PADATA_AS_FRESHNESS:666,3,1,"",KRB5_PADATA_ENCRYPTED_CHALLENGE:667,3,1,"",KRB5_PADATA_ENC_SANDIA_SECURID:668,3,1,"",KRB5_PADATA_ENC_TIMESTAMP:669,3,1,"",KRB5_PADATA_ENC_UNIX_TIME:670,3,1,"",KRB5_PADATA_ETYPE_INFO2:672,3,1,"",KRB5_PADATA_ETYPE_INFO:671,3,1,"",KRB5_PADATA_FOR_USER:673,3,1,"",KRB5_PADATA_FX_COOKIE:674,3,1,"",KRB5_PADATA_FX_ERROR:675,3,1,"",KRB5_PADATA_FX_FAST:676,3,1,"",KRB5_PADATA_GET_FROM_TYPED_DATA:677,3,1,"",KRB5_PADATA_NONE:678,3,1,"",KRB5_PADATA_OSF_DCE:679,3,1,"",KRB5_PADATA_OTP_CHALLENGE:680,3,1,"",KRB5_PADATA_OTP_PIN_CHANGE:681,3,1,"",KRB5_PADATA_OTP_REQUEST:682,3,1,"",KRB5_PADATA_PAC_OPTIONS:683,3,1,"",KRB5_PADATA_PAC_REQUEST:684,3,1,"",KRB5_PADATA_PKINIT_KX:685,3,1,"",KRB5_PADATA_PK_AS_REP:686,3,1,"",KRB5_PADATA_PK_AS_REP_OLD:687,3,1,"",KRB5_PADATA_PK_AS_REQ:688,3,1,"",KRB5_PADATA_PK_AS_REQ_OLD:689,3,1,"",KRB5_PADATA_PW_SALT:690,3,1,"",KRB5_PADATA_REDHAT_IDP_OAUTH2:691,3,1,"",KRB5_PADATA_REFERRAL:692,3,1,"",KRB5_PADATA_S4U_X509_USER:693,3,1,"",KRB5_PADATA_SAM_CHALLENGE:694,3,1,"",KRB5_PADATA_SAM_CHALLENGE_2:695,3,1,"",KRB5_PADATA_SAM_REDIRECT:696,3,1,"",KRB5_PADATA_SAM_RESPONSE:697,3,1,"",KRB5_PADATA_SAM_RESPONSE_2:698,3,1,"",KRB5_PADATA_SESAME:699,3,1,"",KRB5_PADATA_SPAKE:700,3,1,"",KRB5_PADATA_SVR_REFERRAL_INFO:701,3,1,"",KRB5_PADATA_TGS_REQ:702,3,1,"",KRB5_PADATA_USE_SPECIFIED_KVNO:703,3,1,"",KRB5_PRINCIPAL_COMPARE_CASEFOLD:704,3,1,"",KRB5_PRINCIPAL_COMPARE_ENTERPRISE:705,3,1,"",KRB5_PRINCIPAL_COMPARE_IGNORE_REALM:706,3,1,"",KRB5_PRINCIPAL_COMPARE_UTF8:707,3,1,"",KRB5_PRINCIPAL_PARSE_ENTERPRISE:708,3,1,"",KRB5_PRINCIPAL_PARSE_IGNORE_REALM:709,3,1,"",KRB5_PRINCIPAL_PARSE_NO_DEF_REALM:710,3,1,"",KRB5_PRINCIPAL_PARSE_NO_REALM:711,3,1,"",KRB5_PRINCIPAL_PARSE_REQUIRE_REALM:712,3,1,"",KRB5_PRINCIPAL_UNPARSE_DISPLAY:713,3,1,"",KRB5_PRINCIPAL_UNPARSE_NO_REALM:714,3,1,"",KRB5_PRINCIPAL_UNPARSE_SHORT:715,3,1,"",KRB5_PRIV:716,3,1,"",KRB5_PROMPT_TYPE_NEW_PASSWORD:717,3,1,"",KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN:718,3,1,"",KRB5_PROMPT_TYPE_PASSWORD:719,3,1,"",KRB5_PROMPT_TYPE_PREAUTH:720,3,1,"",KRB5_PVNO:721,3,1,"",KRB5_REALM_BRANCH_CHAR:722,3,1,"",KRB5_RECVAUTH_BADAUTHVERS:723,3,1,"",KRB5_RECVAUTH_SKIP_VERSION:724,3,1,"",KRB5_REFERRAL_REALM:725,3,1,"",KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN:726,3,1,"",KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN:727,3,1,"",KRB5_RESPONDER_OTP_FLAGS_NEXTOTP:728,3,1,"",KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN:729,3,1,"",KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC:730,3,1,"",KRB5_RESPONDER_OTP_FORMAT_DECIMAL:731,3,1,"",KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL:732,3,1,"",KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW:733,3,1,"",KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY:734,3,1,"",KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED:735,3,1,"",KRB5_RESPONDER_QUESTION_OTP:736,3,1,"",KRB5_RESPONDER_QUESTION_PASSWORD:737,3,1,"",KRB5_RESPONDER_QUESTION_PKINIT:738,3,1,"",KRB5_SAFE:739,3,1,"",KRB5_SAM_MUST_PK_ENCRYPT_SAD:740,3,1,"",KRB5_SAM_SEND_ENCRYPTED_SAD:741,3,1,"",KRB5_SAM_USE_SAD_AS_KEY:742,3,1,"",KRB5_TC_MATCH_2ND_TKT:743,3,1,"",KRB5_TC_MATCH_AUTHDATA:744,3,1,"",KRB5_TC_MATCH_FLAGS:745,3,1,"",KRB5_TC_MATCH_FLAGS_EXACT:746,3,1,"",KRB5_TC_MATCH_IS_SKEY:747,3,1,"",KRB5_TC_MATCH_KTYPE:748,3,1,"",KRB5_TC_MATCH_SRV_NAMEONLY:749,3,1,"",KRB5_TC_MATCH_TIMES:750,3,1,"",KRB5_TC_MATCH_TIMES_EXACT:751,3,1,"",KRB5_TC_NOTICKET:752,3,1,"",KRB5_TC_OPENCLOSE:753,3,1,"",KRB5_TC_SUPPORTED_KTYPES:754,3,1,"",KRB5_TGS_NAME:755,3,1,"",KRB5_TGS_NAME_SIZE:756,3,1,"",KRB5_TGS_REP:757,3,1,"",KRB5_TGS_REQ:758,3,1,"",KRB5_TKT_CREDS_STEP_FLAG_CONTINUE:759,3,1,"",KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL:760,3,1,"",KRB5_WELLKNOWN_NAMESTR:761,3,1,"",LR_TYPE_INTERPRETATION_MASK:762,3,1,"",LR_TYPE_THIS_SERVER_ONLY:763,3,1,"",MAX_KEYTAB_NAME_LEN:764,3,1,"",MSEC_DIRBIT:765,3,1,"",MSEC_VAL_MASK:766,3,1,"",SALT_TYPE_AFS_LENGTH:767,3,1,"",SALT_TYPE_NO_LENGTH:768,3,1,"",THREEPARAMOPEN:769,3,1,"",TKT_FLG_ANONYMOUS:770,3,1,"",TKT_FLG_ENC_PA_REP:771,3,1,"",TKT_FLG_FORWARDABLE:772,3,1,"",TKT_FLG_FORWARDED:773,3,1,"",TKT_FLG_HW_AUTH:774,3,1,"",TKT_FLG_INITIAL:775,3,1,"",TKT_FLG_INVALID:776,3,1,"",TKT_FLG_MAY_POSTDATE:777,3,1,"",TKT_FLG_OK_AS_DELEGATE:778,3,1,"",TKT_FLG_POSTDATED:779,3,1,"",TKT_FLG_PRE_AUTH:780,3,1,"",TKT_FLG_PROXIABLE:781,3,1,"",TKT_FLG_PROXY:782,3,1,"",TKT_FLG_RENEWABLE:783,3,1,"",TKT_FLG_TRANSIT_POLICY_CHECKED:784,3,1,"",VALID_INT_BITS:785,3,1,"",VALID_UINT_BITS:786,3,1,"",krb524_convert_creds_kdc:788,3,1,"",krb524_init_ets:789,3,1,"",krb5_425_conv_principal:49,0,1,"c.krb5_425_conv_principal",krb5_524_conv_principal:50,0,1,"c.krb5_524_conv_principal",krb5_524_convert_creds:51,0,1,"c.krb5_524_convert_creds",krb5_address:803,1,1,"c.krb5_address",krb5_address_compare:52,0,1,"c.krb5_address_compare",krb5_address_order:53,0,1,"c.krb5_address_order",krb5_address_search:54,0,1,"c.krb5_address_search",krb5_addrtype:804,1,1,"c.krb5_addrtype",krb5_allow_weak_crypto:55,0,1,"c.krb5_allow_weak_crypto",krb5_aname_to_localname:56,0,1,"c.krb5_aname_to_localname",krb5_anonymous_principal:57,0,1,"c.krb5_anonymous_principal",krb5_anonymous_realm:58,0,1,"c.krb5_anonymous_realm",krb5_ap_rep:805,1,1,"c.krb5_ap_rep",krb5_ap_rep_enc_part:806,1,1,"c.krb5_ap_rep_enc_part",krb5_ap_req:807,1,1,"c.krb5_ap_req",krb5_appdefault_boolean:59,0,1,"c.krb5_appdefault_boolean",krb5_appdefault_string:60,0,1,"c.krb5_appdefault_string",krb5_auth_con_free:61,0,1,"c.krb5_auth_con_free",krb5_auth_con_genaddrs:62,0,1,"c.krb5_auth_con_genaddrs",krb5_auth_con_get_checksum_func:63,0,1,"c.krb5_auth_con_get_checksum_func",krb5_auth_con_getaddrs:64,0,1,"c.krb5_auth_con_getaddrs",krb5_auth_con_getauthenticator:65,0,1,"c.krb5_auth_con_getauthenticator",krb5_auth_con_getflags:66,0,1,"c.krb5_auth_con_getflags",krb5_auth_con_getkey:67,0,1,"c.krb5_auth_con_getkey",krb5_auth_con_getkey_k:68,0,1,"c.krb5_auth_con_getkey_k",krb5_auth_con_getlocalseqnumber:69,0,1,"c.krb5_auth_con_getlocalseqnumber",krb5_auth_con_getlocalsubkey:70,0,1,"c.krb5_auth_con_getlocalsubkey",krb5_auth_con_getrcache:71,0,1,"c.krb5_auth_con_getrcache",krb5_auth_con_getrecvsubkey:72,0,1,"c.krb5_auth_con_getrecvsubkey",krb5_auth_con_getrecvsubkey_k:73,0,1,"c.krb5_auth_con_getrecvsubkey_k",krb5_auth_con_getremoteseqnumber:74,0,1,"c.krb5_auth_con_getremoteseqnumber",krb5_auth_con_getremotesubkey:75,0,1,"c.krb5_auth_con_getremotesubkey",krb5_auth_con_getsendsubkey:76,0,1,"c.krb5_auth_con_getsendsubkey",krb5_auth_con_getsendsubkey_k:77,0,1,"c.krb5_auth_con_getsendsubkey_k",krb5_auth_con_init:78,0,1,"c.krb5_auth_con_init",krb5_auth_con_initivector:79,0,1,"c.krb5_auth_con_initivector",krb5_auth_con_set_checksum_func:80,0,1,"c.krb5_auth_con_set_checksum_func",krb5_auth_con_set_req_cksumtype:81,0,1,"c.krb5_auth_con_set_req_cksumtype",krb5_auth_con_setaddrs:82,0,1,"c.krb5_auth_con_setaddrs",krb5_auth_con_setflags:83,0,1,"c.krb5_auth_con_setflags",krb5_auth_con_setports:84,0,1,"c.krb5_auth_con_setports",krb5_auth_con_setrcache:85,0,1,"c.krb5_auth_con_setrcache",krb5_auth_con_setrecvsubkey:86,0,1,"c.krb5_auth_con_setrecvsubkey",krb5_auth_con_setrecvsubkey_k:87,0,1,"c.krb5_auth_con_setrecvsubkey_k",krb5_auth_con_setsendsubkey:88,0,1,"c.krb5_auth_con_setsendsubkey",krb5_auth_con_setsendsubkey_k:89,0,1,"c.krb5_auth_con_setsendsubkey_k",krb5_auth_con_setuseruserkey:90,0,1,"c.krb5_auth_con_setuseruserkey",krb5_auth_context:808,1,1,"c.krb5_auth_context",krb5_authdata:809,1,1,"c.krb5_authdata",krb5_authdatatype:810,1,1,"c.krb5_authdatatype",krb5_authenticator:811,1,1,"c.krb5_authenticator",krb5_boolean:812,1,1,"c.krb5_boolean",krb5_build_principal:91,0,1,"c.krb5_build_principal",krb5_build_principal_alloc_va:92,0,1,"c.krb5_build_principal_alloc_va",krb5_build_principal_ext:93,0,1,"c.krb5_build_principal_ext",krb5_build_principal_va:94,0,1,"c.krb5_build_principal_va",krb5_c_block_size:95,0,1,"c.krb5_c_block_size",krb5_c_checksum_length:96,0,1,"c.krb5_c_checksum_length",krb5_c_crypto_length:97,0,1,"c.krb5_c_crypto_length",krb5_c_crypto_length_iov:98,0,1,"c.krb5_c_crypto_length_iov",krb5_c_decrypt:99,0,1,"c.krb5_c_decrypt",krb5_c_decrypt_iov:100,0,1,"c.krb5_c_decrypt_iov",krb5_c_derive_prfplus:101,0,1,"c.krb5_c_derive_prfplus",krb5_c_encrypt:102,0,1,"c.krb5_c_encrypt",krb5_c_encrypt_iov:103,0,1,"c.krb5_c_encrypt_iov",krb5_c_encrypt_length:104,0,1,"c.krb5_c_encrypt_length",krb5_c_enctype_compare:105,0,1,"c.krb5_c_enctype_compare",krb5_c_free_state:106,0,1,"c.krb5_c_free_state",krb5_c_fx_cf2_simple:107,0,1,"c.krb5_c_fx_cf2_simple",krb5_c_init_state:108,0,1,"c.krb5_c_init_state",krb5_c_is_coll_proof_cksum:109,0,1,"c.krb5_c_is_coll_proof_cksum",krb5_c_is_keyed_cksum:110,0,1,"c.krb5_c_is_keyed_cksum",krb5_c_keyed_checksum_types:111,0,1,"c.krb5_c_keyed_checksum_types",krb5_c_keylengths:112,0,1,"c.krb5_c_keylengths",krb5_c_make_checksum:113,0,1,"c.krb5_c_make_checksum",krb5_c_make_checksum_iov:114,0,1,"c.krb5_c_make_checksum_iov",krb5_c_make_random_key:115,0,1,"c.krb5_c_make_random_key",krb5_c_padding_length:116,0,1,"c.krb5_c_padding_length",krb5_c_prf:117,0,1,"c.krb5_c_prf",krb5_c_prf_length:118,0,1,"c.krb5_c_prf_length",krb5_c_prfplus:119,0,1,"c.krb5_c_prfplus",krb5_c_random_add_entropy:120,0,1,"c.krb5_c_random_add_entropy",krb5_c_random_make_octets:121,0,1,"c.krb5_c_random_make_octets",krb5_c_random_os_entropy:122,0,1,"c.krb5_c_random_os_entropy",krb5_c_random_seed:123,0,1,"c.krb5_c_random_seed",krb5_c_random_to_key:124,0,1,"c.krb5_c_random_to_key",krb5_c_string_to_key:125,0,1,"c.krb5_c_string_to_key",krb5_c_string_to_key_with_params:126,0,1,"c.krb5_c_string_to_key_with_params",krb5_c_valid_cksumtype:127,0,1,"c.krb5_c_valid_cksumtype",krb5_c_valid_enctype:128,0,1,"c.krb5_c_valid_enctype",krb5_c_verify_checksum:129,0,1,"c.krb5_c_verify_checksum",krb5_c_verify_checksum_iov:130,0,1,"c.krb5_c_verify_checksum_iov",krb5_calculate_checksum:131,0,1,"c.krb5_calculate_checksum",krb5_cc_cache_match:132,0,1,"c.krb5_cc_cache_match",krb5_cc_close:133,0,1,"c.krb5_cc_close",krb5_cc_copy_creds:134,0,1,"c.krb5_cc_copy_creds",krb5_cc_cursor:813,1,1,"c.krb5_cc_cursor",krb5_cc_default:135,0,1,"c.krb5_cc_default",krb5_cc_default_name:136,0,1,"c.krb5_cc_default_name",krb5_cc_destroy:137,0,1,"c.krb5_cc_destroy",krb5_cc_dup:138,0,1,"c.krb5_cc_dup",krb5_cc_end_seq_get:139,0,1,"c.krb5_cc_end_seq_get",krb5_cc_gen_new:140,0,1,"c.krb5_cc_gen_new",krb5_cc_get_config:141,0,1,"c.krb5_cc_get_config",krb5_cc_get_flags:142,0,1,"c.krb5_cc_get_flags",krb5_cc_get_full_name:143,0,1,"c.krb5_cc_get_full_name",krb5_cc_get_name:144,0,1,"c.krb5_cc_get_name",krb5_cc_get_principal:145,0,1,"c.krb5_cc_get_principal",krb5_cc_get_type:146,0,1,"c.krb5_cc_get_type",krb5_cc_initialize:147,0,1,"c.krb5_cc_initialize",krb5_cc_move:148,0,1,"c.krb5_cc_move",krb5_cc_new_unique:149,0,1,"c.krb5_cc_new_unique",krb5_cc_next_cred:150,0,1,"c.krb5_cc_next_cred",krb5_cc_remove_cred:151,0,1,"c.krb5_cc_remove_cred",krb5_cc_resolve:152,0,1,"c.krb5_cc_resolve",krb5_cc_retrieve_cred:153,0,1,"c.krb5_cc_retrieve_cred",krb5_cc_select:154,0,1,"c.krb5_cc_select",krb5_cc_set_config:155,0,1,"c.krb5_cc_set_config",krb5_cc_set_default_name:156,0,1,"c.krb5_cc_set_default_name",krb5_cc_set_flags:157,0,1,"c.krb5_cc_set_flags",krb5_cc_start_seq_get:158,0,1,"c.krb5_cc_start_seq_get",krb5_cc_store_cred:159,0,1,"c.krb5_cc_store_cred",krb5_cc_support_switch:160,0,1,"c.krb5_cc_support_switch",krb5_cc_switch:161,0,1,"c.krb5_cc_switch",krb5_ccache:814,1,1,"c.krb5_ccache",krb5_cccol_cursor:815,1,1,"c.krb5_cccol_cursor",krb5_cccol_cursor_free:162,0,1,"c.krb5_cccol_cursor_free",krb5_cccol_cursor_new:163,0,1,"c.krb5_cccol_cursor_new",krb5_cccol_cursor_next:164,0,1,"c.krb5_cccol_cursor_next",krb5_cccol_have_content:165,0,1,"c.krb5_cccol_have_content",krb5_change_password:166,0,1,"c.krb5_change_password",krb5_check_clockskew:167,0,1,"c.krb5_check_clockskew",krb5_checksum:816,1,1,"c.krb5_checksum",krb5_checksum_size:168,0,1,"c.krb5_checksum_size",krb5_chpw_message:169,0,1,"c.krb5_chpw_message",krb5_cksumtype:817,1,1,"c.krb5_cksumtype",krb5_cksumtype_to_string:170,0,1,"c.krb5_cksumtype_to_string",krb5_clear_error_message:171,0,1,"c.krb5_clear_error_message",krb5_const:790,3,1,"",krb5_const_pointer:818,1,1,"c.krb5_const_pointer",krb5_const_principal:819,1,1,"c.krb5_const_principal",krb5_context:820,1,1,"c.krb5_context",krb5_copy_addresses:172,0,1,"c.krb5_copy_addresses",krb5_copy_authdata:173,0,1,"c.krb5_copy_authdata",krb5_copy_authenticator:174,0,1,"c.krb5_copy_authenticator",krb5_copy_checksum:175,0,1,"c.krb5_copy_checksum",krb5_copy_context:176,0,1,"c.krb5_copy_context",krb5_copy_creds:177,0,1,"c.krb5_copy_creds",krb5_copy_data:178,0,1,"c.krb5_copy_data",krb5_copy_error_message:179,0,1,"c.krb5_copy_error_message",krb5_copy_keyblock:180,0,1,"c.krb5_copy_keyblock",krb5_copy_keyblock_contents:181,0,1,"c.krb5_copy_keyblock_contents",krb5_copy_principal:182,0,1,"c.krb5_copy_principal",krb5_copy_ticket:183,0,1,"c.krb5_copy_ticket",krb5_cred:821,1,1,"c.krb5_cred",krb5_cred_enc_part:822,1,1,"c.krb5_cred_enc_part",krb5_cred_info:823,1,1,"c.krb5_cred_info",krb5_creds:824,1,1,"c.krb5_creds",krb5_crypto_iov:825,1,1,"c.krb5_crypto_iov",krb5_cryptotype:826,1,1,"c.krb5_cryptotype",krb5_data:827,1,1,"c.krb5_data",krb5_decode_authdata_container:184,0,1,"c.krb5_decode_authdata_container",krb5_decode_ticket:185,0,1,"c.krb5_decode_ticket",krb5_decrypt:186,0,1,"c.krb5_decrypt",krb5_deltat:828,1,1,"c.krb5_deltat",krb5_deltat_to_string:187,0,1,"c.krb5_deltat_to_string",krb5_eblock_enctype:188,0,1,"c.krb5_eblock_enctype",krb5_enc_data:829,1,1,"c.krb5_enc_data",krb5_enc_kdc_rep_part:830,1,1,"c.krb5_enc_kdc_rep_part",krb5_enc_tkt_part:831,1,1,"c.krb5_enc_tkt_part",krb5_encode_authdata_container:189,0,1,"c.krb5_encode_authdata_container",krb5_encrypt:190,0,1,"c.krb5_encrypt",krb5_encrypt_block:832,1,1,"c.krb5_encrypt_block",krb5_encrypt_size:191,0,1,"c.krb5_encrypt_size",krb5_enctype:833,1,1,"c.krb5_enctype",krb5_enctype_to_name:192,0,1,"c.krb5_enctype_to_name",krb5_enctype_to_string:193,0,1,"c.krb5_enctype_to_string",krb5_error:834,1,1,"c.krb5_error",krb5_error_code:835,1,1,"c.krb5_error_code",krb5_expand_hostname:194,0,1,"c.krb5_expand_hostname",krb5_expire_callback_func:836,1,1,"c.krb5_expire_callback_func",krb5_find_authdata:195,0,1,"c.krb5_find_authdata",krb5_finish_key:196,0,1,"c.krb5_finish_key",krb5_finish_random_key:197,0,1,"c.krb5_finish_random_key",krb5_flags:837,1,1,"c.krb5_flags",krb5_free_addresses:198,0,1,"c.krb5_free_addresses",krb5_free_ap_rep_enc_part:199,0,1,"c.krb5_free_ap_rep_enc_part",krb5_free_authdata:200,0,1,"c.krb5_free_authdata",krb5_free_authenticator:201,0,1,"c.krb5_free_authenticator",krb5_free_checksum:202,0,1,"c.krb5_free_checksum",krb5_free_checksum_contents:203,0,1,"c.krb5_free_checksum_contents",krb5_free_cksumtypes:204,0,1,"c.krb5_free_cksumtypes",krb5_free_context:205,0,1,"c.krb5_free_context",krb5_free_cred_contents:206,0,1,"c.krb5_free_cred_contents",krb5_free_creds:207,0,1,"c.krb5_free_creds",krb5_free_data:208,0,1,"c.krb5_free_data",krb5_free_data_contents:209,0,1,"c.krb5_free_data_contents",krb5_free_default_realm:210,0,1,"c.krb5_free_default_realm",krb5_free_enctypes:211,0,1,"c.krb5_free_enctypes",krb5_free_error:212,0,1,"c.krb5_free_error",krb5_free_error_message:213,0,1,"c.krb5_free_error_message",krb5_free_host_realm:214,0,1,"c.krb5_free_host_realm",krb5_free_keyblock:215,0,1,"c.krb5_free_keyblock",krb5_free_keyblock_contents:216,0,1,"c.krb5_free_keyblock_contents",krb5_free_keytab_entry_contents:217,0,1,"c.krb5_free_keytab_entry_contents",krb5_free_principal:218,0,1,"c.krb5_free_principal",krb5_free_string:219,0,1,"c.krb5_free_string",krb5_free_tgt_creds:220,0,1,"c.krb5_free_tgt_creds",krb5_free_ticket:221,0,1,"c.krb5_free_ticket",krb5_free_unparsed_name:222,0,1,"c.krb5_free_unparsed_name",krb5_fwd_tgt_creds:223,0,1,"c.krb5_fwd_tgt_creds",krb5_get_credentials:224,0,1,"c.krb5_get_credentials",krb5_get_credentials_renew:225,0,1,"c.krb5_get_credentials_renew",krb5_get_credentials_validate:226,0,1,"c.krb5_get_credentials_validate",krb5_get_default_realm:227,0,1,"c.krb5_get_default_realm",krb5_get_error_message:228,0,1,"c.krb5_get_error_message",krb5_get_etype_info:229,0,1,"c.krb5_get_etype_info",krb5_get_fallback_host_realm:230,0,1,"c.krb5_get_fallback_host_realm",krb5_get_host_realm:231,0,1,"c.krb5_get_host_realm",krb5_get_in_tkt_with_keytab:232,0,1,"c.krb5_get_in_tkt_with_keytab",krb5_get_in_tkt_with_password:233,0,1,"c.krb5_get_in_tkt_with_password",krb5_get_in_tkt_with_skey:234,0,1,"c.krb5_get_in_tkt_with_skey",krb5_get_init_creds_keytab:235,0,1,"c.krb5_get_init_creds_keytab",krb5_get_init_creds_opt:838,1,1,"c.krb5_get_init_creds_opt",krb5_get_init_creds_opt_alloc:236,0,1,"c.krb5_get_init_creds_opt_alloc",krb5_get_init_creds_opt_free:237,0,1,"c.krb5_get_init_creds_opt_free",krb5_get_init_creds_opt_get_fast_flags:238,0,1,"c.krb5_get_init_creds_opt_get_fast_flags",krb5_get_init_creds_opt_init:239,0,1,"c.krb5_get_init_creds_opt_init",krb5_get_init_creds_opt_set_address_list:240,0,1,"c.krb5_get_init_creds_opt_set_address_list",krb5_get_init_creds_opt_set_anonymous:241,0,1,"c.krb5_get_init_creds_opt_set_anonymous",krb5_get_init_creds_opt_set_canonicalize:242,0,1,"c.krb5_get_init_creds_opt_set_canonicalize",krb5_get_init_creds_opt_set_change_password_prompt:243,0,1,"c.krb5_get_init_creds_opt_set_change_password_prompt",krb5_get_init_creds_opt_set_etype_list:244,0,1,"c.krb5_get_init_creds_opt_set_etype_list",krb5_get_init_creds_opt_set_expire_callback:245,0,1,"c.krb5_get_init_creds_opt_set_expire_callback",krb5_get_init_creds_opt_set_fast_ccache:246,0,1,"c.krb5_get_init_creds_opt_set_fast_ccache",krb5_get_init_creds_opt_set_fast_ccache_name:247,0,1,"c.krb5_get_init_creds_opt_set_fast_ccache_name",krb5_get_init_creds_opt_set_fast_flags:248,0,1,"c.krb5_get_init_creds_opt_set_fast_flags",krb5_get_init_creds_opt_set_forwardable:249,0,1,"c.krb5_get_init_creds_opt_set_forwardable",krb5_get_init_creds_opt_set_in_ccache:250,0,1,"c.krb5_get_init_creds_opt_set_in_ccache",krb5_get_init_creds_opt_set_out_ccache:251,0,1,"c.krb5_get_init_creds_opt_set_out_ccache",krb5_get_init_creds_opt_set_pa:252,0,1,"c.krb5_get_init_creds_opt_set_pa",krb5_get_init_creds_opt_set_pac_request:253,0,1,"c.krb5_get_init_creds_opt_set_pac_request",krb5_get_init_creds_opt_set_preauth_list:254,0,1,"c.krb5_get_init_creds_opt_set_preauth_list",krb5_get_init_creds_opt_set_proxiable:255,0,1,"c.krb5_get_init_creds_opt_set_proxiable",krb5_get_init_creds_opt_set_renew_life:256,0,1,"c.krb5_get_init_creds_opt_set_renew_life",krb5_get_init_creds_opt_set_responder:257,0,1,"c.krb5_get_init_creds_opt_set_responder",krb5_get_init_creds_opt_set_salt:258,0,1,"c.krb5_get_init_creds_opt_set_salt",krb5_get_init_creds_opt_set_tkt_life:259,0,1,"c.krb5_get_init_creds_opt_set_tkt_life",krb5_get_init_creds_password:260,0,1,"c.krb5_get_init_creds_password",krb5_get_permitted_enctypes:261,0,1,"c.krb5_get_permitted_enctypes",krb5_get_profile:262,0,1,"c.krb5_get_profile",krb5_get_prompt_types:263,0,1,"c.krb5_get_prompt_types",krb5_get_renewed_creds:264,0,1,"c.krb5_get_renewed_creds",krb5_get_server_rcache:265,0,1,"c.krb5_get_server_rcache",krb5_get_time_offsets:266,0,1,"c.krb5_get_time_offsets",krb5_get_validated_creds:267,0,1,"c.krb5_get_validated_creds",krb5_gic_opt_pa_data:839,1,1,"c.krb5_gic_opt_pa_data",krb5_init_context:268,0,1,"c.krb5_init_context",krb5_init_context_profile:269,0,1,"c.krb5_init_context_profile",krb5_init_creds_context:840,1,1,"c.krb5_init_creds_context",krb5_init_creds_free:270,0,1,"c.krb5_init_creds_free",krb5_init_creds_get:271,0,1,"c.krb5_init_creds_get",krb5_init_creds_get_creds:272,0,1,"c.krb5_init_creds_get_creds",krb5_init_creds_get_error:273,0,1,"c.krb5_init_creds_get_error",krb5_init_creds_get_times:274,0,1,"c.krb5_init_creds_get_times",krb5_init_creds_init:275,0,1,"c.krb5_init_creds_init",krb5_init_creds_set_keytab:276,0,1,"c.krb5_init_creds_set_keytab",krb5_init_creds_set_password:277,0,1,"c.krb5_init_creds_set_password",krb5_init_creds_set_service:278,0,1,"c.krb5_init_creds_set_service",krb5_init_creds_step:279,0,1,"c.krb5_init_creds_step",krb5_init_keyblock:280,0,1,"c.krb5_init_keyblock",krb5_init_random_key:281,0,1,"c.krb5_init_random_key",krb5_init_secure_context:282,0,1,"c.krb5_init_secure_context",krb5_int16:841,1,1,"c.krb5_int16",krb5_int32:842,1,1,"c.krb5_int32",krb5_is_config_principal:283,0,1,"c.krb5_is_config_principal",krb5_is_referral_realm:284,0,1,"c.krb5_is_referral_realm",krb5_is_thread_safe:285,0,1,"c.krb5_is_thread_safe",krb5_k_create_key:286,0,1,"c.krb5_k_create_key",krb5_k_decrypt:287,0,1,"c.krb5_k_decrypt",krb5_k_decrypt_iov:288,0,1,"c.krb5_k_decrypt_iov",krb5_k_encrypt:289,0,1,"c.krb5_k_encrypt",krb5_k_encrypt_iov:290,0,1,"c.krb5_k_encrypt_iov",krb5_k_free_key:291,0,1,"c.krb5_k_free_key",krb5_k_key_enctype:292,0,1,"c.krb5_k_key_enctype",krb5_k_key_keyblock:293,0,1,"c.krb5_k_key_keyblock",krb5_k_make_checksum:294,0,1,"c.krb5_k_make_checksum",krb5_k_make_checksum_iov:295,0,1,"c.krb5_k_make_checksum_iov",krb5_k_prf:296,0,1,"c.krb5_k_prf",krb5_k_reference_key:297,0,1,"c.krb5_k_reference_key",krb5_k_verify_checksum:298,0,1,"c.krb5_k_verify_checksum",krb5_k_verify_checksum_iov:299,0,1,"c.krb5_k_verify_checksum_iov",krb5_kdc_rep:843,1,1,"c.krb5_kdc_rep",krb5_kdc_req:844,1,1,"c.krb5_kdc_req",krb5_kdc_sign_ticket:300,0,1,"c.krb5_kdc_sign_ticket",krb5_kdc_verify_ticket:301,0,1,"c.krb5_kdc_verify_ticket",krb5_key:845,1,1,"c.krb5_key",krb5_keyblock:846,1,1,"c.krb5_keyblock",krb5_keytab:847,1,1,"c.krb5_keytab",krb5_keytab_entry:848,1,1,"c.krb5_keytab_entry",krb5_keyusage:849,1,1,"c.krb5_keyusage",krb5_kt_add_entry:302,0,1,"c.krb5_kt_add_entry",krb5_kt_client_default:303,0,1,"c.krb5_kt_client_default",krb5_kt_close:304,0,1,"c.krb5_kt_close",krb5_kt_cursor:850,1,1,"c.krb5_kt_cursor",krb5_kt_default:305,0,1,"c.krb5_kt_default",krb5_kt_default_name:306,0,1,"c.krb5_kt_default_name",krb5_kt_dup:307,0,1,"c.krb5_kt_dup",krb5_kt_end_seq_get:308,0,1,"c.krb5_kt_end_seq_get",krb5_kt_free_entry:309,0,1,"c.krb5_kt_free_entry",krb5_kt_get_entry:310,0,1,"c.krb5_kt_get_entry",krb5_kt_get_name:311,0,1,"c.krb5_kt_get_name",krb5_kt_get_type:312,0,1,"c.krb5_kt_get_type",krb5_kt_have_content:313,0,1,"c.krb5_kt_have_content",krb5_kt_next_entry:314,0,1,"c.krb5_kt_next_entry",krb5_kt_read_service_key:315,0,1,"c.krb5_kt_read_service_key",krb5_kt_remove_entry:316,0,1,"c.krb5_kt_remove_entry",krb5_kt_resolve:317,0,1,"c.krb5_kt_resolve",krb5_kt_start_seq_get:318,0,1,"c.krb5_kt_start_seq_get",krb5_kuserok:319,0,1,"c.krb5_kuserok",krb5_kvno:851,1,1,"c.krb5_kvno",krb5_last_req_entry:852,1,1,"c.krb5_last_req_entry",krb5_magic:853,1,1,"c.krb5_magic",krb5_make_authdata_kdc_issued:320,0,1,"c.krb5_make_authdata_kdc_issued",krb5_marshal_credentials:321,0,1,"c.krb5_marshal_credentials",krb5_merge_authdata:322,0,1,"c.krb5_merge_authdata",krb5_mk_1cred:323,0,1,"c.krb5_mk_1cred",krb5_mk_error:324,0,1,"c.krb5_mk_error",krb5_mk_ncred:325,0,1,"c.krb5_mk_ncred",krb5_mk_priv:326,0,1,"c.krb5_mk_priv",krb5_mk_rep:327,0,1,"c.krb5_mk_rep",krb5_mk_rep_dce:328,0,1,"c.krb5_mk_rep_dce",krb5_mk_req:329,0,1,"c.krb5_mk_req",krb5_mk_req_checksum_func:854,1,1,"c.krb5_mk_req_checksum_func",krb5_mk_req_extended:330,0,1,"c.krb5_mk_req_extended",krb5_mk_safe:331,0,1,"c.krb5_mk_safe",krb5_msgtype:855,1,1,"c.krb5_msgtype",krb5_octet:856,1,1,"c.krb5_octet",krb5_os_localaddr:332,0,1,"c.krb5_os_localaddr",krb5_pa_data:857,1,1,"c.krb5_pa_data",krb5_pa_pac_req:858,1,1,"c.krb5_pa_pac_req",krb5_pa_server_referral_data:859,1,1,"c.krb5_pa_server_referral_data",krb5_pa_svr_referral_data:860,1,1,"c.krb5_pa_svr_referral_data",krb5_pac:861,1,1,"c.krb5_pac",krb5_pac_add_buffer:333,0,1,"c.krb5_pac_add_buffer",krb5_pac_free:334,0,1,"c.krb5_pac_free",krb5_pac_get_buffer:335,0,1,"c.krb5_pac_get_buffer",krb5_pac_get_client_info:336,0,1,"c.krb5_pac_get_client_info",krb5_pac_get_types:337,0,1,"c.krb5_pac_get_types",krb5_pac_init:338,0,1,"c.krb5_pac_init",krb5_pac_parse:339,0,1,"c.krb5_pac_parse",krb5_pac_sign:340,0,1,"c.krb5_pac_sign",krb5_pac_sign_ext:341,0,1,"c.krb5_pac_sign_ext",krb5_pac_verify:342,0,1,"c.krb5_pac_verify",krb5_pac_verify_ext:343,0,1,"c.krb5_pac_verify_ext",krb5_parse_name:344,0,1,"c.krb5_parse_name",krb5_parse_name_flags:345,0,1,"c.krb5_parse_name_flags",krb5_pointer:862,1,1,"c.krb5_pointer",krb5_post_recv_fn:863,1,1,"c.krb5_post_recv_fn",krb5_pre_send_fn:864,1,1,"c.krb5_pre_send_fn",krb5_preauthtype:865,1,1,"c.krb5_preauthtype",krb5_prepend_error_message:346,0,1,"c.krb5_prepend_error_message",krb5_princ_component:791,3,1,"",krb5_princ_name:792,3,1,"",krb5_princ_realm:793,3,1,"",krb5_princ_set_realm:794,3,1,"",krb5_princ_set_realm_data:795,3,1,"",krb5_princ_set_realm_length:796,3,1,"",krb5_princ_size:797,3,1,"",krb5_princ_type:798,3,1,"",krb5_principal2salt:347,0,1,"c.krb5_principal2salt",krb5_principal:866,1,1,"c.krb5_principal",krb5_principal_compare:348,0,1,"c.krb5_principal_compare",krb5_principal_compare_any_realm:349,0,1,"c.krb5_principal_compare_any_realm",krb5_principal_compare_flags:350,0,1,"c.krb5_principal_compare_flags",krb5_principal_data:867,1,1,"c.krb5_principal_data",krb5_process_key:351,0,1,"c.krb5_process_key",krb5_prompt:868,1,1,"c.krb5_prompt",krb5_prompt_type:869,1,1,"c.krb5_prompt_type",krb5_prompter_fct:870,1,1,"c.krb5_prompter_fct",krb5_prompter_posix:352,0,1,"c.krb5_prompter_posix",krb5_pwd_data:871,1,1,"c.krb5_pwd_data",krb5_random_key:353,0,1,"c.krb5_random_key",krb5_rcache:872,1,1,"c.krb5_rcache",krb5_rd_cred:354,0,1,"c.krb5_rd_cred",krb5_rd_error:355,0,1,"c.krb5_rd_error",krb5_rd_priv:356,0,1,"c.krb5_rd_priv",krb5_rd_rep:357,0,1,"c.krb5_rd_rep",krb5_rd_rep_dce:358,0,1,"c.krb5_rd_rep_dce",krb5_rd_req:359,0,1,"c.krb5_rd_req",krb5_rd_safe:360,0,1,"c.krb5_rd_safe",krb5_read_password:361,0,1,"c.krb5_read_password",krb5_realm_compare:362,0,1,"c.krb5_realm_compare",krb5_recvauth:363,0,1,"c.krb5_recvauth",krb5_recvauth_version:364,0,1,"c.krb5_recvauth_version",krb5_replay_data:873,1,1,"c.krb5_replay_data",krb5_responder_context:874,1,1,"c.krb5_responder_context",krb5_responder_fn:875,1,1,"c.krb5_responder_fn",krb5_responder_get_challenge:365,0,1,"c.krb5_responder_get_challenge",krb5_responder_list_questions:366,0,1,"c.krb5_responder_list_questions",krb5_responder_otp_challenge:876,1,1,"c.krb5_responder_otp_challenge",krb5_responder_otp_challenge_free:367,0,1,"c.krb5_responder_otp_challenge_free",krb5_responder_otp_get_challenge:368,0,1,"c.krb5_responder_otp_get_challenge",krb5_responder_otp_set_answer:369,0,1,"c.krb5_responder_otp_set_answer",krb5_responder_otp_tokeninfo:877,1,1,"c.krb5_responder_otp_tokeninfo",krb5_responder_pkinit_challenge:878,1,1,"c.krb5_responder_pkinit_challenge",krb5_responder_pkinit_challenge_free:370,0,1,"c.krb5_responder_pkinit_challenge_free",krb5_responder_pkinit_get_challenge:371,0,1,"c.krb5_responder_pkinit_get_challenge",krb5_responder_pkinit_identity:879,1,1,"c.krb5_responder_pkinit_identity",krb5_responder_pkinit_set_answer:372,0,1,"c.krb5_responder_pkinit_set_answer",krb5_responder_set_answer:373,0,1,"c.krb5_responder_set_answer",krb5_response:880,1,1,"c.krb5_response",krb5_roundup:799,3,1,"",krb5_salttype_to_string:374,0,1,"c.krb5_salttype_to_string",krb5_sendauth:375,0,1,"c.krb5_sendauth",krb5_server_decrypt_ticket_keytab:376,0,1,"c.krb5_server_decrypt_ticket_keytab",krb5_set_default_realm:377,0,1,"c.krb5_set_default_realm",krb5_set_default_tgs_enctypes:378,0,1,"c.krb5_set_default_tgs_enctypes",krb5_set_error_message:379,0,1,"c.krb5_set_error_message",krb5_set_kdc_recv_hook:380,0,1,"c.krb5_set_kdc_recv_hook",krb5_set_kdc_send_hook:381,0,1,"c.krb5_set_kdc_send_hook",krb5_set_password:382,0,1,"c.krb5_set_password",krb5_set_password_using_ccache:383,0,1,"c.krb5_set_password_using_ccache",krb5_set_principal_realm:384,0,1,"c.krb5_set_principal_realm",krb5_set_real_time:385,0,1,"c.krb5_set_real_time",krb5_set_trace_callback:386,0,1,"c.krb5_set_trace_callback",krb5_set_trace_filename:387,0,1,"c.krb5_set_trace_filename",krb5_sname_match:388,0,1,"c.krb5_sname_match",krb5_sname_to_principal:389,0,1,"c.krb5_sname_to_principal",krb5_string_to_cksumtype:390,0,1,"c.krb5_string_to_cksumtype",krb5_string_to_deltat:391,0,1,"c.krb5_string_to_deltat",krb5_string_to_enctype:392,0,1,"c.krb5_string_to_enctype",krb5_string_to_key:393,0,1,"c.krb5_string_to_key",krb5_string_to_salttype:394,0,1,"c.krb5_string_to_salttype",krb5_string_to_timestamp:395,0,1,"c.krb5_string_to_timestamp",krb5_ticket:881,1,1,"c.krb5_ticket",krb5_ticket_times:882,1,1,"c.krb5_ticket_times",krb5_timeofday:396,0,1,"c.krb5_timeofday",krb5_timestamp:883,1,1,"c.krb5_timestamp",krb5_timestamp_to_sfstring:397,0,1,"c.krb5_timestamp_to_sfstring",krb5_timestamp_to_string:398,0,1,"c.krb5_timestamp_to_string",krb5_tkt_authent:884,1,1,"c.krb5_tkt_authent",krb5_tkt_creds_context:885,1,1,"c.krb5_tkt_creds_context",krb5_tkt_creds_free:399,0,1,"c.krb5_tkt_creds_free",krb5_tkt_creds_get:400,0,1,"c.krb5_tkt_creds_get",krb5_tkt_creds_get_creds:401,0,1,"c.krb5_tkt_creds_get_creds",krb5_tkt_creds_get_times:402,0,1,"c.krb5_tkt_creds_get_times",krb5_tkt_creds_init:403,0,1,"c.krb5_tkt_creds_init",krb5_tkt_creds_step:404,0,1,"c.krb5_tkt_creds_step",krb5_trace_callback:886,1,1,"c.krb5_trace_callback",krb5_trace_info:887,1,1,"c.krb5_trace_info",krb5_transited:888,1,1,"c.krb5_transited",krb5_typed_data:889,1,1,"c.krb5_typed_data",krb5_ui_2:890,1,1,"c.krb5_ui_2",krb5_ui_4:891,1,1,"c.krb5_ui_4",krb5_unmarshal_credentials:405,0,1,"c.krb5_unmarshal_credentials",krb5_unparse_name:406,0,1,"c.krb5_unparse_name",krb5_unparse_name_ext:407,0,1,"c.krb5_unparse_name_ext",krb5_unparse_name_flags:408,0,1,"c.krb5_unparse_name_flags",krb5_unparse_name_flags_ext:409,0,1,"c.krb5_unparse_name_flags_ext",krb5_us_timeofday:410,0,1,"c.krb5_us_timeofday",krb5_use_enctype:411,0,1,"c.krb5_use_enctype",krb5_verify_authdata_kdc_issued:412,0,1,"c.krb5_verify_authdata_kdc_issued",krb5_verify_checksum:413,0,1,"c.krb5_verify_checksum",krb5_verify_init_creds:414,0,1,"c.krb5_verify_init_creds",krb5_verify_init_creds_opt:892,1,1,"c.krb5_verify_init_creds_opt",krb5_verify_init_creds_opt_init:415,0,1,"c.krb5_verify_init_creds_opt_init",krb5_verify_init_creds_opt_set_ap_req_nofail:416,0,1,"c.krb5_verify_init_creds_opt_set_ap_req_nofail",krb5_vprepend_error_message:417,0,1,"c.krb5_vprepend_error_message",krb5_vset_error_message:418,0,1,"c.krb5_vset_error_message",krb5_vwrap_error_message:419,0,1,"c.krb5_vwrap_error_message",krb5_wrap_error_message:420,0,1,"c.krb5_wrap_error_message",krb5_x:800,3,1,"",krb5_xc:801,3,1,"",passwd_phrase_element:893,1,1,"c.passwd_phrase_element"},krb5_address:{addrtype:803,2,1,"c.krb5_address.addrtype",contents:803,2,1,"c.krb5_address.contents",length:803,2,1,"c.krb5_address.length",magic:803,2,1,"c.krb5_address.magic"},krb5_ap_rep:{enc_part:805,2,1,"c.krb5_ap_rep.enc_part",magic:805,2,1,"c.krb5_ap_rep.magic"},krb5_ap_rep_enc_part:{ctime:806,2,1,"c.krb5_ap_rep_enc_part.ctime",cusec:806,2,1,"c.krb5_ap_rep_enc_part.cusec",magic:806,2,1,"c.krb5_ap_rep_enc_part.magic",seq_number:806,2,1,"c.krb5_ap_rep_enc_part.seq_number",subkey:806,2,1,"c.krb5_ap_rep_enc_part.subkey"},krb5_ap_req:{ap_options:807,2,1,"c.krb5_ap_req.ap_options",authenticator:807,2,1,"c.krb5_ap_req.authenticator",magic:807,2,1,"c.krb5_ap_req.magic",ticket:807,2,1,"c.krb5_ap_req.ticket"},krb5_authdata:{ad_type:809,2,1,"c.krb5_authdata.ad_type",contents:809,2,1,"c.krb5_authdata.contents",length:809,2,1,"c.krb5_authdata.length",magic:809,2,1,"c.krb5_authdata.magic"},krb5_authenticator:{authorization_data:811,2,1,"c.krb5_authenticator.authorization_data",checksum:811,2,1,"c.krb5_authenticator.checksum",client:811,2,1,"c.krb5_authenticator.client",ctime:811,2,1,"c.krb5_authenticator.ctime",cusec:811,2,1,"c.krb5_authenticator.cusec",magic:811,2,1,"c.krb5_authenticator.magic",seq_number:811,2,1,"c.krb5_authenticator.seq_number",subkey:811,2,1,"c.krb5_authenticator.subkey"},krb5_checksum:{checksum_type:816,2,1,"c.krb5_checksum.checksum_type",contents:816,2,1,"c.krb5_checksum.contents",length:816,2,1,"c.krb5_checksum.length",magic:816,2,1,"c.krb5_checksum.magic"},krb5_const_principal:{data:819,2,1,"c.krb5_const_principal.data",length:819,2,1,"c.krb5_const_principal.length",magic:819,2,1,"c.krb5_const_principal.magic",realm:819,2,1,"c.krb5_const_principal.realm",type:819,2,1,"c.krb5_const_principal.type"},krb5_cred:{enc_part2:821,2,1,"c.krb5_cred.enc_part2",enc_part:821,2,1,"c.krb5_cred.enc_part",magic:821,2,1,"c.krb5_cred.magic",tickets:821,2,1,"c.krb5_cred.tickets"},krb5_cred_enc_part:{magic:822,2,1,"c.krb5_cred_enc_part.magic",nonce:822,2,1,"c.krb5_cred_enc_part.nonce",r_address:822,2,1,"c.krb5_cred_enc_part.r_address",s_address:822,2,1,"c.krb5_cred_enc_part.s_address",ticket_info:822,2,1,"c.krb5_cred_enc_part.ticket_info",timestamp:822,2,1,"c.krb5_cred_enc_part.timestamp",usec:822,2,1,"c.krb5_cred_enc_part.usec"},krb5_cred_info:{caddrs:823,2,1,"c.krb5_cred_info.caddrs",client:823,2,1,"c.krb5_cred_info.client",flags:823,2,1,"c.krb5_cred_info.flags",magic:823,2,1,"c.krb5_cred_info.magic",server:823,2,1,"c.krb5_cred_info.server",session:823,2,1,"c.krb5_cred_info.session",times:823,2,1,"c.krb5_cred_info.times"},krb5_creds:{addresses:824,2,1,"c.krb5_creds.addresses",authdata:824,2,1,"c.krb5_creds.authdata",client:824,2,1,"c.krb5_creds.client",is_skey:824,2,1,"c.krb5_creds.is_skey",keyblock:824,2,1,"c.krb5_creds.keyblock",magic:824,2,1,"c.krb5_creds.magic",second_ticket:824,2,1,"c.krb5_creds.second_ticket",server:824,2,1,"c.krb5_creds.server",ticket:824,2,1,"c.krb5_creds.ticket",ticket_flags:824,2,1,"c.krb5_creds.ticket_flags",times:824,2,1,"c.krb5_creds.times"},krb5_crypto_iov:{data:825,2,1,"c.krb5_crypto_iov.data",flags:825,2,1,"c.krb5_crypto_iov.flags"},krb5_data:{data:827,2,1,"c.krb5_data.data",length:827,2,1,"c.krb5_data.length",magic:827,2,1,"c.krb5_data.magic"},krb5_enc_data:{ciphertext:829,2,1,"c.krb5_enc_data.ciphertext",enctype:829,2,1,"c.krb5_enc_data.enctype",kvno:829,2,1,"c.krb5_enc_data.kvno",magic:829,2,1,"c.krb5_enc_data.magic"},krb5_enc_kdc_rep_part:{caddrs:830,2,1,"c.krb5_enc_kdc_rep_part.caddrs",enc_padata:830,2,1,"c.krb5_enc_kdc_rep_part.enc_padata",flags:830,2,1,"c.krb5_enc_kdc_rep_part.flags",key_exp:830,2,1,"c.krb5_enc_kdc_rep_part.key_exp",last_req:830,2,1,"c.krb5_enc_kdc_rep_part.last_req",magic:830,2,1,"c.krb5_enc_kdc_rep_part.magic",msg_type:830,2,1,"c.krb5_enc_kdc_rep_part.msg_type",nonce:830,2,1,"c.krb5_enc_kdc_rep_part.nonce",server:830,2,1,"c.krb5_enc_kdc_rep_part.server",session:830,2,1,"c.krb5_enc_kdc_rep_part.session",times:830,2,1,"c.krb5_enc_kdc_rep_part.times"},krb5_enc_tkt_part:{authorization_data:831,2,1,"c.krb5_enc_tkt_part.authorization_data",caddrs:831,2,1,"c.krb5_enc_tkt_part.caddrs",client:831,2,1,"c.krb5_enc_tkt_part.client",flags:831,2,1,"c.krb5_enc_tkt_part.flags",magic:831,2,1,"c.krb5_enc_tkt_part.magic",session:831,2,1,"c.krb5_enc_tkt_part.session",times:831,2,1,"c.krb5_enc_tkt_part.times",transited:831,2,1,"c.krb5_enc_tkt_part.transited"},krb5_encrypt_block:{crypto_entry:832,2,1,"c.krb5_encrypt_block.crypto_entry",key:832,2,1,"c.krb5_encrypt_block.key",magic:832,2,1,"c.krb5_encrypt_block.magic"},krb5_error:{client:834,2,1,"c.krb5_error.client",ctime:834,2,1,"c.krb5_error.ctime",cusec:834,2,1,"c.krb5_error.cusec",e_data:834,2,1,"c.krb5_error.e_data",error:834,2,1,"c.krb5_error.error",magic:834,2,1,"c.krb5_error.magic",server:834,2,1,"c.krb5_error.server",stime:834,2,1,"c.krb5_error.stime",susec:834,2,1,"c.krb5_error.susec",text:834,2,1,"c.krb5_error.text"},krb5_get_init_creds_opt:{address_list:838,2,1,"c.krb5_get_init_creds_opt.address_list",etype_list:838,2,1,"c.krb5_get_init_creds_opt.etype_list",etype_list_length:838,2,1,"c.krb5_get_init_creds_opt.etype_list_length",flags:838,2,1,"c.krb5_get_init_creds_opt.flags",forwardable:838,2,1,"c.krb5_get_init_creds_opt.forwardable",preauth_list:838,2,1,"c.krb5_get_init_creds_opt.preauth_list",preauth_list_length:838,2,1,"c.krb5_get_init_creds_opt.preauth_list_length",proxiable:838,2,1,"c.krb5_get_init_creds_opt.proxiable",renew_life:838,2,1,"c.krb5_get_init_creds_opt.renew_life",salt:838,2,1,"c.krb5_get_init_creds_opt.salt",tkt_life:838,2,1,"c.krb5_get_init_creds_opt.tkt_life"},krb5_gic_opt_pa_data:{attr:839,2,1,"c.krb5_gic_opt_pa_data.attr",value:839,2,1,"c.krb5_gic_opt_pa_data.value"},krb5_kdc_rep:{client:843,2,1,"c.krb5_kdc_rep.client",enc_part2:843,2,1,"c.krb5_kdc_rep.enc_part2",enc_part:843,2,1,"c.krb5_kdc_rep.enc_part",magic:843,2,1,"c.krb5_kdc_rep.magic",msg_type:843,2,1,"c.krb5_kdc_rep.msg_type",padata:843,2,1,"c.krb5_kdc_rep.padata",ticket:843,2,1,"c.krb5_kdc_rep.ticket"},krb5_kdc_req:{addresses:844,2,1,"c.krb5_kdc_req.addresses",authorization_data:844,2,1,"c.krb5_kdc_req.authorization_data",client:844,2,1,"c.krb5_kdc_req.client",from:844,2,1,"c.krb5_kdc_req.from",kdc_options:844,2,1,"c.krb5_kdc_req.kdc_options",ktype:844,2,1,"c.krb5_kdc_req.ktype",magic:844,2,1,"c.krb5_kdc_req.magic",msg_type:844,2,1,"c.krb5_kdc_req.msg_type",nktypes:844,2,1,"c.krb5_kdc_req.nktypes",nonce:844,2,1,"c.krb5_kdc_req.nonce",padata:844,2,1,"c.krb5_kdc_req.padata",rtime:844,2,1,"c.krb5_kdc_req.rtime",second_ticket:844,2,1,"c.krb5_kdc_req.second_ticket",server:844,2,1,"c.krb5_kdc_req.server",till:844,2,1,"c.krb5_kdc_req.till",unenc_authdata:844,2,1,"c.krb5_kdc_req.unenc_authdata"},krb5_keyblock:{contents:846,2,1,"c.krb5_keyblock.contents",enctype:846,2,1,"c.krb5_keyblock.enctype",length:846,2,1,"c.krb5_keyblock.length",magic:846,2,1,"c.krb5_keyblock.magic"},krb5_keytab_entry:{key:848,2,1,"c.krb5_keytab_entry.key",magic:848,2,1,"c.krb5_keytab_entry.magic",principal:848,2,1,"c.krb5_keytab_entry.principal",timestamp:848,2,1,"c.krb5_keytab_entry.timestamp",vno:848,2,1,"c.krb5_keytab_entry.vno"},krb5_last_req_entry:{lr_type:852,2,1,"c.krb5_last_req_entry.lr_type",magic:852,2,1,"c.krb5_last_req_entry.magic",value:852,2,1,"c.krb5_last_req_entry.value"},krb5_pa_data:{contents:857,2,1,"c.krb5_pa_data.contents",length:857,2,1,"c.krb5_pa_data.length",magic:857,2,1,"c.krb5_pa_data.magic",pa_type:857,2,1,"c.krb5_pa_data.pa_type"},krb5_pa_pac_req:{include_pac:858,2,1,"c.krb5_pa_pac_req.include_pac"},krb5_pa_server_referral_data:{referral_valid_until:859,2,1,"c.krb5_pa_server_referral_data.referral_valid_until",referred_realm:859,2,1,"c.krb5_pa_server_referral_data.referred_realm",rep_cksum:859,2,1,"c.krb5_pa_server_referral_data.rep_cksum",requested_principal_name:859,2,1,"c.krb5_pa_server_referral_data.requested_principal_name",true_principal_name:859,2,1,"c.krb5_pa_server_referral_data.true_principal_name"},krb5_pa_svr_referral_data:{principal:860,2,1,"c.krb5_pa_svr_referral_data.principal"},krb5_principal:{data:866,2,1,"c.krb5_principal.data",length:866,2,1,"c.krb5_principal.length",magic:866,2,1,"c.krb5_principal.magic",realm:866,2,1,"c.krb5_principal.realm",type:866,2,1,"c.krb5_principal.type"},krb5_principal_data:{data:867,2,1,"c.krb5_principal_data.data",length:867,2,1,"c.krb5_principal_data.length",magic:867,2,1,"c.krb5_principal_data.magic",realm:867,2,1,"c.krb5_principal_data.realm",type:867,2,1,"c.krb5_principal_data.type"},krb5_prompt:{hidden:868,2,1,"c.krb5_prompt.hidden",prompt:868,2,1,"c.krb5_prompt.prompt",reply:868,2,1,"c.krb5_prompt.reply"},krb5_pwd_data:{element:871,2,1,"c.krb5_pwd_data.element",magic:871,2,1,"c.krb5_pwd_data.magic",sequence_count:871,2,1,"c.krb5_pwd_data.sequence_count"},krb5_replay_data:{seq:873,2,1,"c.krb5_replay_data.seq",timestamp:873,2,1,"c.krb5_replay_data.timestamp",usec:873,2,1,"c.krb5_replay_data.usec"},krb5_responder_otp_challenge:{service:876,2,1,"c.krb5_responder_otp_challenge.service",tokeninfo:876,2,1,"c.krb5_responder_otp_challenge.tokeninfo"},krb5_responder_otp_tokeninfo:{alg_id:877,2,1,"c.krb5_responder_otp_tokeninfo.alg_id",challenge:877,2,1,"c.krb5_responder_otp_tokeninfo.challenge",flags:877,2,1,"c.krb5_responder_otp_tokeninfo.flags",format:877,2,1,"c.krb5_responder_otp_tokeninfo.format",length:877,2,1,"c.krb5_responder_otp_tokeninfo.length",token_id:877,2,1,"c.krb5_responder_otp_tokeninfo.token_id",vendor:877,2,1,"c.krb5_responder_otp_tokeninfo.vendor"},krb5_responder_pkinit_challenge:{identities:878,2,1,"c.krb5_responder_pkinit_challenge.identities"},krb5_responder_pkinit_identity:{identity:879,2,1,"c.krb5_responder_pkinit_identity.identity",token_flags:879,2,1,"c.krb5_responder_pkinit_identity.token_flags"},krb5_response:{expected_nonce:880,2,1,"c.krb5_response.expected_nonce",magic:880,2,1,"c.krb5_response.magic",message_type:880,2,1,"c.krb5_response.message_type",request_time:880,2,1,"c.krb5_response.request_time",response:880,2,1,"c.krb5_response.response"},krb5_ticket:{enc_part2:881,2,1,"c.krb5_ticket.enc_part2",enc_part:881,2,1,"c.krb5_ticket.enc_part",magic:881,2,1,"c.krb5_ticket.magic",server:881,2,1,"c.krb5_ticket.server"},krb5_ticket_times:{authtime:882,2,1,"c.krb5_ticket_times.authtime",endtime:882,2,1,"c.krb5_ticket_times.endtime",renew_till:882,2,1,"c.krb5_ticket_times.renew_till",starttime:882,2,1,"c.krb5_ticket_times.starttime"},krb5_tkt_authent:{ap_options:884,2,1,"c.krb5_tkt_authent.ap_options",authenticator:884,2,1,"c.krb5_tkt_authent.authenticator",magic:884,2,1,"c.krb5_tkt_authent.magic",ticket:884,2,1,"c.krb5_tkt_authent.ticket"},krb5_trace_info:{message:887,2,1,"c.krb5_trace_info.message"},krb5_transited:{magic:888,2,1,"c.krb5_transited.magic",tr_contents:888,2,1,"c.krb5_transited.tr_contents",tr_type:888,2,1,"c.krb5_transited.tr_type"},krb5_typed_data:{data:889,2,1,"c.krb5_typed_data.data",length:889,2,1,"c.krb5_typed_data.length",magic:889,2,1,"c.krb5_typed_data.magic",type:889,2,1,"c.krb5_typed_data.type"},krb5_verify_init_creds_opt:{ap_req_nofail:892,2,1,"c.krb5_verify_init_creds_opt.ap_req_nofail",flags:892,2,1,"c.krb5_verify_init_creds_opt.flags"},passwd_phrase_element:{magic:893,2,1,"c.passwd_phrase_element.magic",passwd:893,2,1,"c.passwd_phrase_element.passwd",phrase:893,2,1,"c.passwd_phrase_element.phrase"}},objnames:{"0":"c","function","C function","1":"c","type","C type","2":"c","member","C member","3":"py","data","Python data"},objtypes:{"0":"c:function","1":"c:type","2":"c:member","3":"py:data"},terms:{"01am":23,"05pm":896,"0x0000":478,"0x00000001":440,498,522,523,750,753,"0x00000002":436,494,525,529,747,752,"0x00000004":521,524,745,"0x00000008":488,526,528,751,"0x00000010":21,496,527,746,"0x00000020":487,530,744,"0x00000040":749,"0x00000080":743,"0x00000100":748,"0x00000200":754,"0x00008000":497,770,"0x0001":444,471,544,562,724,727,760,"0x00010000":485,771,"0x0002":425,454,472,560,723,726,"0x00020000":486,"0x0003":455,473,"0x0004":445,474,557,728,"0x00040000":778,"0x0005":423,469,"0x0006":431,468,"0x0007":428,456,"0x0008":457,475,559,729,"0x00080000":784,"0x0009":453,476,"0x000a":477,"0x000b":482,"0x000c":449,479,"0x000d":480,"0x000e":458,481,"0x000f":447,467,"0x0010":424,448,470,556,"0x00100000":774,"0x0011":442,459,"0x0012":443,461,"0x0013":450,460,"0x0014":430,451,462,"0x0017":463,"0x0018":426,464,"0x0019":465,"0x001a":466,"0x0020":552,"0x00200000":780,"0x0040":558,"0x00400000":775,"0x0080":561,"0x00800000":495,783,"0x0100":422,555,"0x01000000":776,"0x0101":427,"0x01ff":483,"0x0200":554,"0x02000000":491,779,"0x0400":553,"0x04000000":484,777,"0x08000000":493,782,"0x1":564,565,711,715,719,759,"0x10":710,"0x10000000":492,781,"0x1fff":433,"0x2":563,712,714,717,"0x2000":434,"0x20000000":437,490,740,773,"0x3":718,"0x4":708,713,720,"0x4000":432,"0x40000000":439,489,741,772,"0x54800000":499,"0x7fff":762,766,"0x8":709,"0x8000":429,435,763,765,"0x80000000":438,742,"0xfffffff0":441,"10d":896,"12h":20,34,"1foo":21,"30m":896,"3de":14,"3h30m":937,"4gb":916,"5h30m":940,"76cho3000":917,"8h30":896,"abstract":918,920,926,927,929,933,"boolean":6,20,23,36,48,55,868,892,"break":32,900,"byte":20,43,46,48,99,104,287,311,908,909,910,912,913,922,"case":2,3,6,11,14,19,20,21,23,24,28,38,39,43,46,195,245,280,325,330,350,359,375,389,416,704,895,896,898,917,920,921,922,925,929,930,942,944,949,951,"char":43,46,49,50,56,59,60,91,92,93,94,107,136,141,143,144,146,149,152,155,156,160,166,169,170,187,192,193,194,210,213,214,219,222,223,227,228,230,231,233,235,247,252,260,264,267,277,278,306,311,312,317,319,329,336,344,345,346,352,361,363,365,366,369,372,373,374,375,377,379,382,383,384,387,389,390,391,392,394,395,397,398,406,407,408,409,417,418,419,420,801,827,839,868,870,876,877,879,887,932,"class":3,23,942,"const":43,49,52,53,54,58,59,60,91,92,93,94,99,100,101,102,103,106,107,108,113,114,117,119,120,125,126,129,130,136,141,144,146,149,152,155,156,160,166,169,172,173,174,175,177,178,180,181,183,184,185,188,189,194,195,197,213,214,223,228,231,232,233,234,235,247,252,260,264,265,267,277,278,281,284,286,287,288,289,290,294,298,299,300,301,312,317,319,320,322,324,326,329,331,333,336,339,340,341,342,343,344,345,346,351,352,353,355,356,357,358,359,360,361,365,366,369,372,373,376,377,378,379,382,383,384,387,389,393,405,412,413,417,418,419,420,790,818,819,863,864,870,886,887,932,"default":2,3,4,5,6,7,8,10,11,12,15,19,20,21,22,23,24,26,29,30,32,33,34,35,37,38,39,40,41,43,44,46,48,59,60,78,132,147,148,154,223,229,243,253,265,269,275,278,315,317,345,359,375,383,414,710,896,903,904,905,906,908,916,921,922,923,937,939,940,941,943,944,945,946,950,951,"export":20,34,916,917,921,922,931,932,"final":19,21,112,158,902,909,913,"function":3,6,14,23,25,29,34,35,43,46,48,49,50,55,57,58,59,60,61,62,67,68,69,71,72,73,74,76,77,78,81,82,84,85,86,87,88,89,92,93,99,100,101,102,103,104,105,107,113,114,116,117,119,124,125,126,129,130,133,136,137,139,148,150,151,153,156,157,158,159,167,169,171,172,173,174,175,177,178,180,181,182,183,192,194,195,198,199,200,201,202,203,205,206,207,208,209,212,215,216,221,228,235,236,241,245,246,252,254,258,260,261,262,264,265,266,267,271,272,275,276,277,278,279,287,288,289,290,294,295,296,298,299,301,308,310,320,323,324,325,326,327,329,330,331,333,334,342,343,345,352,355,356,357,358,359,360,361,368,371,373,376,378,382,383,385,387,389,396,400,401,403,404,407,408,410,412,414,416,417,419,854,863,864,868,870,875,901,902,916,917,920,921,922,925,928,929,931,932,"goto":46,"h\u00f6gskola":917,"import":5,6,14,15,17,19,21,23,34,35,916,922,936,"int":43,51,53,56,59,62,91,92,93,94,97,111,116,120,122,166,223,241,242,243,244,249,254,255,279,306,311,345,350,352,361,382,383,404,407,408,409,416,803,809,812,816,827,838,844,846,851,855,857,868,870,871,889,892,921,"long":3,14,15,23,25,26,37,38,39,41,43,99,287,365,366,737,764,895,898,916,917,920,929,932,946,"new":2,3,6,14,15,20,21,23,24,26,34,35,37,41,43,48,87,89,129,132,138,143,154,160,163,165,166,167,169,172,173,174,175,176,177,178,180,182,183,192,194,195,211,219,229,235,243,245,246,250,253,257,260,262,269,275,280,298,300,301,303,307,313,327,330,336,338,343,344,345,359,365,366,367,368,369,370,371,372,373,380,381,382,383,386,387,399,400,401,402,403,404,407,717,718,895,899,913,916,917,921,922,925,926,929,936,937,940,942,951,"null":19,20,21,43,44,46,48,54,64,92,99,100,102,103,107,113,129,136,141,154,155,156,164,173,195,198,200,203,209,220,223,224,228,230,231,235,240,260,264,267,269,273,275,287,288,289,290,294,298,300,301,315,322,323,325,326,329,330,331,332,336,342,343,344,354,356,359,360,361,363,364,365,366,369,372,375,377,380,381,382,383,386,388,389,397,407,408,409,412,414,791,916,921,930,932,951,"public":21,40,917,925,926,927,928,"return":3,9,12,20,21,22,23,38,43,46,48,50,52,54,56,57,59,60,69,74,91,92,93,100,103,109,110,119,127,128,133,135,137,141,142,144,145,146,147,148,149,151,152,153,154,155,156,159,161,169,176,189,192,214,223,224,227,228,229,231,235,260,262,263,264,267,268,271,279,282,283,284,288,290,301,302,303,305,306,308,310,311,314,315,316,317,318,320,323,325,330,344,345,352,355,361,365,366,368,371,375,377,378,380,382,383,384,386,388,389,396,398,400,404,406,407,408,409,410,412,414,416,729,863,864,904,916,918,919,920,921,922,923,926,927,929,930,931,932,933,940,944,"short":14,19,21,41,306,898,"static":46,921,932,"switch":14,28,31,43,48,161,895,"true":9,14,20,21,22,23,24,25,26,33,35,36,37,38,40,41,43,52,54,105,109,110,127,128,160,192,245,283,284,285,300,319,343,348,349,350,362,388,416,811,824,858,950,"try":21,25,32,35,38,39,41,43,904,916,936,944,"var":5,8,20,21,23,34,37,899,904,905,915,951,"void":43,46,57,58,59,60,63,80,171,179,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,215,216,218,219,220,221,222,237,239,240,241,242,243,244,245,249,254,255,256,257,258,259,260,270,275,285,291,297,334,339,346,352,367,370,379,380,381,386,399,415,416,417,418,419,420,818,836,854,862,863,864,870,875,886,931,932,"while":3,12,14,15,16,20,21,23,24,34,35,43,46,895,902,921,936,937,944,951,AES:14,15,20,25,904,916,917,AFS:14,AND:917,ARE:917,Added:916,946,Adding:17,32,34,908,Are:3,23,BUT:917,But:899,CCS:917,CMS:467,476,477,479,480,481,482,916,CTS:14,20,916,DES:13,20,26,41,467,916,DNS:21,25,30,33,34,39,44,333,662,904,916,DNs:5,22,23,Dis:19,Doing:903,FOR:917,For:3,10,14,16,17,18,19,20,21,22,23,24,26,28,32,33,34,35,36,37,38,39,43,46,99,100,103,142,287,288,290,736,894,895,899,902,903,904,908,909,913,914,915,916,918,919,920,921,922,923,925,926,927,928,929,930,931,932,933,934,936,937,940,943,944,949,951,HAS:917,His:19,ITS:42,917,Its:20,21,908,NFS:936,NOT:5,23,34,917,Not:20,21,44,51,151,614,895,ONE:5,23,ORed:151,One:3,20,23,34,36,38,43,342,895,896,936,937,950,SUCH:917,Such:14,37,39,46,TGS:3,20,21,23,25,26,35,48,224,300,403,757,858,908,916,928,THAT:917,THE:917,TLS:22,29,That:21,902,The:0,3,4,5,6,7,8,9,10,11,12,15,19,20,21,22,23,24,25,26,28,29,31,33,34,35,37,38,39,40,41,43,46,53,62,69,71,74,78,80,91,93,99,100,102,103,113,117,119,121,125,126,129,135,136,138,144,146,148,153,165,166,173,176,189,198,200,217,220,224,228,229,245,248,252,262,268,274,282,286,287,288,289,290,294,296,298,300,305,307,312,315,320,321,322,325,326,331,333,344,345,346,354,356,359,360,365,366,367,368,369,370,371,372,373,376,380,381,382,383,389,398,402,403,405,406,407,408,412,414,420,618,728,736,738,743,744,747,748,750,754,805,811,825,835,848,863,864,868,874,881,894,895,896,898,899,900,901,902,903,904,905,906,908,909,910,912,913,915,916,917,918,919,920,921,922,923,925,926,927,928,929,930,931,932,933,934,936,937,939,940,942,944,946,948,949,950,951,Then:3,6,17,23,24,34,940,There:20,21,23,34,35,895,902,904,905,908,912,937,These:14,16,20,21,23,26,34,35,37,39,43,731,902,908,916,917,920,922,925,949,951,UCS:916,USE:917,Use:3,15,22,23,46,49,65,66,67,68,72,73,76,77,78,83,92,111,115,132,141,143,145,150,153,154,163,164,169,172,173,174,175,177,178,180,181,182,183,194,195,224,227,229,230,231,236,239,261,265,269,272,275,280,286,309,310,315,317,318,321,322,324,325,326,327,328,329,330,331,332,335,338,339,340,341,344,345,354,355,356,357,359,360,363,375,389,401,403,405,406,408,439,563,564,835,845,902,904,916,925,939,944,946,Used:447,448,598,599,835,894,944,Uses:2,3,15,21,23,Using:3,6,14,23,25,40,936,WILL:917,WITH:917,With:0,3,6,15,22,23,39,950,_kerbero:39,_kpasswd:39,_krb5_address:803,_krb5_ap_rep:805,806,_krb5_ap_rep_enc_part:806,_krb5_ap_req:807,_krb5_auth_context:808,_krb5_authdata:809,_krb5_authent:811,_krb5_ccach:814,_krb5_cccol_cursor:815,_krb5_checksum:816,_krb5_context:135,156,820,_krb5_cred:821,824,_krb5_cred_enc_part:822,_krb5_cred_info:823,_krb5_crypto_iov:825,_krb5_data:827,_krb5_enc_data:829,_krb5_enc_kdc_rep_part:830,_krb5_enc_tkt_part:831,_krb5_encrypt_block:832,_krb5_error:834,_krb5_get_init_cr:838,_krb5_get_init_creds_opt:838,_krb5_gic_opt_pa_data:839,_krb5_init_creds_context:840,_krb5_kdc_rep:843,_krb5_kdc_req:844,_krb5_keyblock:846,_krb5_kt:847,_krb5_last_req_entri:852,_krb5_pa_data:857,_krb5_pa_pac_req:858,_krb5_pa_server_referral_data:859,_krb5_pa_svr_referral_data:860,_krb5_prompt:868,_krb5_pwd_data:871,_krb5_responder_otp_challeng:876,_krb5_responder_otp_tokeninfo:877,_krb5_responder_pkinit_challeng:878,_krb5_responder_pkinit_ident:879,_krb5_respons:880,_krb5_ticket:881,_krb5_ticket_tim:882,_krb5_tkt_authent:884,_krb5_tkt_creds_context:885,_krb5_trace_info:887,_krb5_transit:888,_krb5_typed_data:889,_krb5_verify_init_creds_opt:892,_passwd_phrase_el:893,_profile_t:262,269,_tcp:39,_udp:39,abbrevi:902,941,abc:904,951,abi:883,abil:14,368,371,950,abl:15,16,19,20,21,23,25,29,34,35,39,895,900,936,937,944,abort:800,801,931,about:0,14,19,20,22,26,31,39,41,43,46,251,899,902,904,906,916,917,920,929,934,937,940,951,abov:6,14,19,21,22,23,25,26,32,34,37,41,43,46,899,904,908,917,921,922,923,937,944,absenc:20,46,absent:940,absolut:20,21,894,898,902,ac02:917,acceler:917,accept:3,4,8,14,15,16,20,21,23,26,34,38,39,41,151,389,896,898,902,916,917,918,922,931,932,937,940,acceptor:8,916,941,acceptor_cred_handl:43,access:3,4,8,9,14,15,17,18,19,20,21,22,23,24,25,26,28,29,32,33,34,35,37,39,43,46,895,900,902,910,913,916,920,925,926,928,929,930,935,937,943,944,949,950,accident:916,accommod:46,899,accomplish:23,26,accord:3,19,21,23,36,38,43,154,167,908,909,915,922,944,946,account:20,21,23,24,25,28,30,48,56,245,336,895,916,930,935,940,944,948,950,account_expir:245,836,acknowledg:917,acl:3,4,8,18,20,21,22,23,31,915,acl_fil:4,8,19,20,34,acquir:3,6,8,23,43,48,245,274,402,548,908,916,922,946,acquisit:43,403,across:17,20,21,34,43,926,927,928,936,act:10,19,21,26,899,916,action:4,6,14,899,917,927,activ:6,8,14,21,23,25,37,40,169,939,actor:19,actual:6,14,23,26,35,46,98,99,100,102,103,113,129,287,288,289,290,294,298,899,937,actual_mech:43,ad_kdcissu:320,412,ad_typ:195,809,908,ad_type_extern:787,ad_type_field_type_mask:787,ad_type_regist:787,ad_type_reserv:787,add:3,6,9,11,12,14,15,19,20,21,22,23,31,33,36,38,48,300,343,710,896,916,937,add_auth_ind:916,929,add_mkei:14,23,add_princip:5,14,25,37,add_rel:932,added:3,6,14,15,20,23,24,25,32,34,38,40,302,738,895,916,919,addent:11,916,adding:3,8,23,32,41,916,addit:3,18,19,20,21,22,23,26,29,34,37,38,39,40,43,46,48,301,363,364,414,834,895,899,902,904,906,907,916,917,920,929,934,940,944,951,addition:10,21,36,928,937,addpol:3,23,35,addprinc:3,23,34,37,896,926,addr1:52,53,addr2:52,53,addr:54,232,233,234,332,823,824,830,address1:908,address2:908,address:0,15,20,21,23,24,30,33,38,39,44,48,260,325,326,331,356,359,360,523,524,525,526,803,822,824,831,844,904,908,916,931,937,940,941,address_list:838,addresssanit:916,addrlist:54,addrtyp:429,803,908,addrtype_addrport:787,addrtype_chao:787,addrtype_ddp:787,addrtype_inet6:787,addrtype_inet:787,addrtype_ipport:787,addrtype_is_loc:787,addrtype_iso:787,addrtype_netbio:787,addrtype_xn:787,adjust:14,29,33,34,37,48,100,103,288,290,410,adm:20,22,39,admcil:19,admcilsp:19,admin:3,4,5,8,14,15,16,19,21,22,23,26,32,34,895,904,915,916,926,944,951,admin_serv:3,8,20,21,23,34,39,adminhost:3,23,administ:4,15,34,administr:0,2,3,4,5,6,11,14,15,16,18,19,20,21,22,24,25,26,31,32,35,36,38,895,901,914,915,916,917,927,934,936,940,950,951,adminjohndoefoo:21,adtyp:809,advanc:14,30,150,314,916,934,advantag:14,21,26,32,advertis:21,917,advic:31,advis:14,917,aead:48,aes128:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,aes256:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,aes:20,917,aesni:904,917,af_unspec:931,affect:4,19,20,21,26,28,40,126,133,229,916,940,951,afford:32,afs3:14,after:2,3,4,6,10,12,14,21,23,24,25,33,34,35,37,80,98,136,228,272,380,401,883,894,895,900,902,908,909,912,913,916,936,937,944,951,afterward:23,927,again:14,23,28,33,34,718,899,916,922,936,937,against:2,14,20,21,25,28,34,39,40,46,48,129,298,342,356,359,360,363,412,899,904,916,919,922,943,949,agent:20,agre:917,agreement:917,aklog:55,alexand:917,alg_id:877,algid:736,algorithm:14,26,126,913,917,944,alia:3,11,15,23,43,48,144,146,312,365,366,alias:3,11,15,22,23,38,39,916,alic:11,28,949,950,all:0,2,3,6,9,14,15,17,18,19,20,21,23,24,25,28,29,32,33,34,35,37,38,43,46,48,153,163,164,282,342,359,414,745,746,751,815,825,895,896,899,902,903,907,908,913,916,917,928,930,937,939,941,942,943,944,946,949,951,alloc:43,46,48,61,78,93,98,99,100,102,103,107,115,117,119,121,124,148,280,287,288,289,290,296,355,357,407,825,868,919,921,923,926,930,allow:2,3,4,5,6,8,10,12,14,15,16,17,18,19,20,21,23,24,26,28,29,32,33,34,35,36,37,38,40,41,43,46,48,111,252,279,359,404,407,896,898,900,902,904,906,909,916,917,918,919,920,922,923,924,925,926,927,928,929,930,931,932,933,936,937,940,943,950,allow_dup_skei:3,23,allow_forward:3,5,23,allow_postd:3,5,23,allow_proxi:3,23,allow_renew:3,23,allow_svr:3,23,25,35,40,allow_tgs_req:3,23,allow_tix:3,23,allow_weak_crypto:14,21,26,41,48,allowedkeysalt:3,23,almeida:917,alon:34,921,along:0,36,825,895,904,922,alongsid:34,alphabet:896,alphanumer:21,alreadi:6,14,22,23,34,36,43,124,333,895,902,904,906,940,944,946,also:15,17,18,22,23,24,25,26,28,29,32,33,34,35,37,38,39,40,43,46,126,342,403,894,895,898,904,906,908,916,917,919,920,922,923,925,926,928,930,932,933,937,alter:14,37,altern:8,15,20,21,22,24,28,34,37,43,500,902,904,915,916,917,940,although:39,898,917,923,933,936,937,altogeth:20,alwai:14,15,20,21,23,24,39,44,51,55,61,63,66,68,71,80,83,139,142,155,365,714,908,912,916,america:917,among:46,amount:20,21,35,39,102,119,121,289,361,903,an2ln:21,930,an2ln_typ:930,analog:15,anam:56,944,anchor:20,21,940,andrea:917,andrew:5,23,ani:0,3,6,8,9,10,14,15,16,17,19,20,21,23,24,25,26,28,32,34,36,37,38,39,40,41,43,46,48,56,137,147,153,154,156,224,260,268,275,278,279,310,315,359,363,364,404,414,738,835,895,899,900,908,909,913,916,917,918,922,923,930,936,937,940,941,944,950,ank:3,23,anl:21,annot:16,36,916,anonym:3,20,23,25,28,43,48,501,502,916,937,940,941,anoth:15,17,21,24,32,41,48,101,171,824,895,899,904,908,919,920,926,930,931,937,951,ansi:903,answer:21,46,48,366,729,736,738,874,922,anticip:33,39,anyon:936,950,anyth:21,37,anywai:20,39,46,330,anywher:936,951,ap_opt:329,330,375,807,884,ap_opts_etype_negoti:787,ap_opts_mutual_requir:330,359,375,787,ap_opts_reserv:787,ap_opts_use_session_kei:330,787,ap_opts_use_subkei:330,787,ap_opts_wire_mask:787,ap_req_authdata:195,ap_req_nofail:416,892,ap_req_opt:329,330,359,375,api:0,14,41,43,45,98,100,103,186,188,190,191,196,197,245,250,251,262,281,288,290,351,353,411,738,825,845,895,901,904,916,918,922,929,appdata:21,899,appdefault:48,appear:14,20,21,24,34,37,39,41,46,908,917,921,append:3,20,23,38,387,898,904,913,appl:901,917,appl_vers:363,375,appli:3,10,14,18,19,20,21,23,24,35,41,43,171,917,926,929,937,940,944,948,applic:0,12,16,18,20,21,28,30,31,37,43,46,48,59,60,156,250,329,330,331,363,375,504,528,529,716,739,894,895,898,899,901,904,914,916,917,920,922,925,930,932,936,937,943,947,950,appnam:59,60,approach:43,appropri:6,14,21,23,24,28,29,34,37,39,43,46,154,373,398,918,928,929,940,941,944,approxim:903,916,apputil:901,aprepencpart:805,arbitrari:3,23,43,arcfour:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,architectur:902,904,archiv:42,903,area:34,46,arg:3,23,417,418,419,800,801,904,944,arg_keytab:232,235,argument:3,4,6,8,10,14,20,23,44,46,48,63,80,91,93,245,257,260,263,275,325,326,331,352,354,356,360,386,417,418,419,887,904,916,921,922,930,944,946,argv_pars:917,ari:944,aris:917,armor:20,37,48,229,920,929,940,armor_ccach:940,around:23,904,arrai:3,36,43,46,48,100,103,111,173,240,244,254,288,290,322,332,352,354,819,823,825,830,831,844,866,867,930,932,arrang:23,arriv:899,asan:904,asc:903,ascii:6,23,39,908,ask:6,37,39,46,48,736,737,738,920,936,937,940,944,asn:48,909,910,919,aspect:15,28,925,assert:20,43,908,916,922,929,assign:3,19,20,23,34,39,48,82,84,944,associ:3,4,9,19,20,21,23,35,38,43,537,895,899,908,917,951,assum:14,21,34,36,39,43,44,107,124,155,903,937,940,951,asynchron:403,929,athena:3,5,14,15,19,20,21,23,24,28,32,34,904,917,932,936,937,951,athent:260,atom:916,attach:916,attack:2,14,21,23,29,30,32,35,40,46,325,326,331,899,916,940,attempt:0,3,6,20,21,23,24,29,35,39,43,243,250,414,908,916,944,attr:252,839,attribut:3,5,6,9,16,19,20,21,22,23,24,26,36,37,48,253,650,839,916,917,919,922,929,940,944,audit:916,aug:3,23,augment:922,august:917,auth:16,20,39,43,48,61,329,330,359,363,364,375,504,809,823,831,auth_context:61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,90,223,323,325,326,327,328,329,330,331,354,356,357,358,359,360,363,364,375,auth_gssapi:3,23,auth_to_loc:21,28,930,auth_to_local_nam:21,28,authdata1:908,authdata2:908,authdata:184,189,224,320,322,412,824,908,916,924,940,941,authdata_plugin:925,authdatum:412,authent:3,5,6,10,12,14,15,20,21,22,24,25,26,29,30,32,34,35,36,37,38,39,40,43,44,46,48,61,62,63,64,66,67,68,69,71,72,73,74,76,77,79,80,81,82,83,84,85,86,87,88,89,90,166,201,223,224,250,322,323,325,326,327,328,329,330,331,336,342,354,356,357,358,359,360,375,437,500,506,615,736,805,807,811,857,874,884,895,898,899,900,901,908,909,913,916,917,919,929,930,937,940,941,947,951,authfrom:174,author:3,19,20,21,48,153,224,253,300,614,744,824,861,916,917,924,939,authoriaz:811,authorit:19,21,154,918,923,926,930,931,authoritykeyidentifi:37,authorization_data:811,831,844,authtim:340,341,342,343,882,908,authtime_out:336,authto:174,authz:844,auto:916,autoconf:901,autodoc:906,autohead:902,autolock:917,autom:902,916,automak:921,automat:3,4,6,8,15,17,23,34,895,898,900,902,913,916,937,939,944,autoreconf:902,avail:3,6,11,12,14,20,21,29,34,38,43,46,56,170,187,192,193,227,252,306,310,315,361,368,371,374,398,416,563,821,843,881,895,902,913,918,924,939,941,945,951,avoid:3,14,19,24,38,46,245,904,916,937,awai:14,41,936,937,awar:908,awk:6,back:19,20,23,24,30,39,40,895,904,909,916,922,925,backend:14,904,916,917,background:4,8,10,34,backslash:344,backspac:344,backup:30,32,39,900,backward:8,20,21,24,26,34,946,bad:34,135,156,balanc:14,38,39,banner:46,352,870,bar:6,21,basch:917,base:0,3,20,21,22,23,24,25,26,34,37,38,39,43,46,49,59,60,62,91,93,98,117,296,344,388,895,899,906,915,916,917,920,925,929,933,937,940,949,basi:14,18,23,39,basic:932,basicconstraint:37,baz:21,bb463167:42,becaus:6,17,19,20,21,23,24,25,35,37,38,39,41,43,46,251,342,895,902,904,908,912,927,929,932,936,940,950,becom:0,6,14,17,21,23,34,39,136,235,260,275,895,916,936,940,944,beeblebrox:34,been:6,12,14,20,21,23,26,35,124,895,899,913,916,917,922,925,937,941,948,951,beep:937,939,befor:2,3,4,5,6,14,15,20,21,22,23,26,35,37,39,41,44,98,100,103,155,288,290,381,389,825,868,896,899,900,902,917,920,927,929,937,940,beforehand:43,began:14,begin:4,6,15,21,23,28,36,43,91,93,99,100,102,103,203,209,287,288,289,290,344,403,908,919,922,923,932,949,behalf:946,behav:3,43,407,416,894,904,behavior:3,14,20,21,28,39,46,228,414,416,916,921,924,925,930,939,943,948,behind:14,28,being:3,14,20,21,23,29,39,44,46,245,372,738,899,906,949,belong:33,161,below:6,20,21,23,28,36,43,738,901,917,944,benefit:39,berkelei:904,917,besid:15,21,best:14,25,34,38,beta:6,23,better:23,24,845,916,between:3,9,20,21,23,25,26,29,34,35,41,45,136,158,385,883,895,916,930,937,939,940,beyond:913,920,925,929,951,big:908,909,910,912,922,biggest:14,bin:34,902,904,906,915,944,binari:21,32,904,917,bind:3,5,20,21,22,23,39,916,943,bind_dn:3,binddn:3,bindir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,bindpwd:3,bison:904,bit:14,20,24,37,46,66,83,142,153,157,359,883,894,908,912,916,919,944,bitwis:151,738,bjaspan:3,23,blank:949,bleep:3,11,23,937,950,951,block:14,20,24,48,99,100,102,103,287,288,289,290,916,blocksiz:95,bob:944,950,bodi:844,929,book:15,boot:34,900,bootstrap:21,borrow:937,boston:39,both:3,12,21,22,23,24,26,28,29,36,37,39,40,43,159,245,251,902,916,917,921,944,bourn:34,box:36,brace:21,921,bracket:20,21,28,breviti:909,brian:917,bridg:916,brief:32,901,925,broken:14,904,brother:917,brute:14,23,35,bsd:916,917,btree:6,23,buffer:23,43,48,56,98,99,119,170,187,192,193,279,287,300,301,306,331,336,339,374,397,398,404,407,409,538,825,916,922,buflen:170,187,192,193,374,397,398,bug:0,23,42,901,902,934,build:34,39,41,48,49,136,895,901,904,914,915,916,921,925,943,built:21,24,28,46,48,378,895,902,904,916,922,932,937,943,builtin:904,916,917,bundl:21,917,bunni:39,busi:917,byacc:904,c89:903,cacert:29,37,cach:3,14,15,21,23,28,43,44,48,78,138,140,223,224,229,247,264,267,323,325,326,329,331,356,359,360,375,403,414,522,545,549,753,897,901,904,905,911,915,916,924,937,939,940,941,943,944,945,946,949,951,cache_nam:3,23,939,940,941,cache_out:132,154,cacheconf:908,cachenam:895,945,cachetyp:916,cacreateseri:37,caddr:823,830,831,cakei:37,california:917,call:14,16,20,21,23,24,28,34,43,46,91,93,100,103,113,120,122,123,125,126,136,156,158,176,228,245,251,261,268,275,279,282,288,290,294,301,308,317,323,380,381,404,825,868,875,894,895,901,902,916,920,921,922,927,929,930,936,944,callback:48,260,275,352,380,381,387,854,868,870,874,916,920,929,931,caller:43,46,71,85,99,100,102,103,117,119,121,136,144,146,245,252,269,279,287,288,289,290,296,301,312,314,330,361,365,366,404,414,825,894,916,923,929,932,camellia128:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,camellia256:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,camellia:20,916,can:0,2,3,4,5,6,8,9,10,11,14,15,16,17,18,19,20,21,22,23,24,25,26,28,29,32,33,34,35,36,37,38,39,40,41,43,46,50,56,136,138,154,224,254,271,301,307,331,342,344,366,386,389,400,403,414,416,735,863,864,874,882,894,895,896,898,899,902,903,904,906,908,909,916,918,919,920,921,922,923,925,926,927,928,929,930,931,933,936,937,940,944,948,951,cancel:23,candid:913,944,cannot:3,15,23,24,25,35,37,43,46,91,93,135,151,260,344,414,883,908,937,940,941,946,canon:4,15,22,23,38,39,192,300,926,930,canonhost_out:194,canonic:15,21,22,33,43,48,301,389,546,916,940,946,capabl:32,916,936,capac:25,capath:20,card:3,20,21,23,916,care:3,14,19,23,28,43,925,carefulli:37,carnegi:917,carri:3,25,951,cartoon:34,casio:14,cast:883,894,918,920,921,926,927,928,929,931,933,cat:6,categori:25,caus:3,4,6,14,20,21,23,24,25,26,34,35,37,38,39,40,43,48,245,247,388,734,895,899,904,916,917,941,945,caution:3,cb_data:386,886,cb_ret:932,cbc:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,cbdata:932,cbrown:951,cc246071:916,cc246091:916,ccach:3,23,41,43,48,132,135,164,224,225,226,232,233,234,246,250,251,264,267,321,329,375,383,403,405,414,815,904,915,918,942,946,ccache_typ:21,ccachenam:904,ccapi:901,917,ccselect:28,916,921,924,931,ccselect_plugin:918,921,ceas:0,6,23,cell:14,center:10,901,917,951,central:0,cert:16,21,37,cert_fil:946,certain:23,32,236,904,917,946,951,certauth:916,924,certauth_plugin:919,certid:21,certif:3,20,21,29,40,43,48,253,693,910,916,924,946,951,certifi:21,certlabel:21,cf2:48,cflag:904,943,cfr:917,chain:20,21,916,challeng:20,21,40,46,48,366,367,368,370,371,695,698,736,737,874,877,909,916,chang:2,3,6,9,14,15,19,20,21,22,24,25,26,28,33,34,37,39,46,48,78,136,158,245,260,382,383,620,717,894,902,906,908,915,916,917,925,927,933,935,942,944,950,change_password:26,change_password_for:382,383,changeov:34,changepw:3,14,15,23,26,166,245,300,301,382,channel:14,21,36,43,46,325,916,944,charact:3,19,20,21,23,34,38,39,344,397,408,713,942,charg:917,chat:934,check:12,20,21,23,26,28,34,37,43,48,59,60,153,283,356,359,360,550,902,904,906,912,921,932,933,937,941,944,check_a:928,check_tg:928,checkout:906,checksum:43,48,104,175,202,203,300,301,329,330,331,333,342,343,532,539,658,660,661,665,811,854,910,913,922,checksum_typ:816,cheetah:906,chl:46,367,368,370,chl_out:371,choic:21,38,43,46,250,940,choos:14,22,25,34,38,39,43,900,918,936,940,949,chosen:16,21,22,26,43,46,229,903,909,915,916,918,949,chpass:3,23,927,chrand:3,23,chunk:114,295,cipher:14,26,48,99,100,102,103,287,288,289,290,cipher_st:99,100,102,103,287,288,289,290,ciphertext:25,99,100,102,103,104,287,288,289,290,805,829,909,913,circular:23,circumst:20,37,citi:917,ckf_:738,ckfrom:175,cksum:113,129,294,298,413,cksumtyp:81,96,111,113,114,130,170,294,295,299,cksumtype_cmac_camellia128:787,cksumtype_cmac_camellia256:787,cksumtype_crc32:787,cksumtype_descbc:787,cksumtype_hmac_md5_arcfour:787,cksumtype_hmac_sha1_96_aes128:787,cksumtype_hmac_sha1_96_aes256:787,cksumtype_hmac_sha1_des3:787,cksumtype_hmac_sha256_128_aes128:787,cksumtype_hmac_sha384_192_aes256:787,cksumtype_md5_hmac_arcfour:787,cksumtype_nist_sha:787,cksumtype_rsa_md4:787,cksumtype_rsa_md4_d:787,cksumtype_rsa_md5:787,cksumtype_rsa_md5_d:787,cksumtype_sha1:787,cksumtypep:390,ckto:175,claim:651,655,917,clang:916,clarifi:37,clariti:944,clean:23,268,269,386,906,916,932,cleanli:916,cleanup:46,932,clear:3,6,11,15,23,36,46,48,136,156,377,clearpolici:3,19,23,cleartext:806,822,830,click:34,client1:37,client2:37,client:3,12,14,16,18,20,21,22,23,25,26,28,31,32,34,35,36,38,39,40,41,43,46,48,145,154,223,224,235,241,242,258,260,264,267,275,276,277,330,333,359,363,403,651,652,738,805,806,811,823,824,831,834,843,844,895,899,901,904,908,909,910,915,916,917,918,919,921,924,926,929,931,937,940,941,943,944,946,949,951,client_aware_channel_bind:21,client_aware_gss_bind:916,client_cert:37,client_kei:916,client_keytab:43,client_princ:46,300,clientauth:21,clientkei:37,clifford:951,clock:21,34,48,267,356,360,896,929,940,clockskew:15,21,359,913,932,940,close:21,32,48,71,85,132,137,138,148,164,167,265,301,307,753,913,927,933,clpreauth:28,924,clpreauth_mymech_initvt:921,clpreauth_plugin:920,cmac:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,cmd_path:944,cname:33,34,38,39,code:0,20,21,23,41,43,46,48,49,50,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,117,118,119,121,124,125,126,129,130,133,134,135,141,142,145,147,148,149,150,151,152,153,154,155,156,157,158,159,161,162,163,164,166,169,170,171,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,251,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,287,288,289,290,294,295,296,298,299,300,301,302,303,305,306,308,310,311,314,315,316,317,318,321,322,323,324,325,326,327,328,329,330,331,332,333,335,337,338,339,342,344,345,347,352,354,355,356,357,358,359,360,361,363,364,374,375,376,377,378,382,383,384,385,389,396,397,398,400,401,402,403,404,405,406,407,408,409,410,414,728,834,835,863,883,894,901,903,904,916,917,920,921,922,925,927,929,931,932,933,934,coerc:913,coexist:19,collect:21,43,48,132,154,726,727,901,916,918,939,940,941,945,949,951,collis:48,899,colon:5,20,21,23,28,39,152,344,346,420,951,column:6,com:3,6,9,11,16,20,21,22,23,28,35,37,38,39,41,42,909,910,916,917,936,937,949,950,951,com_err:835,904,916,921,combin:3,8,15,20,23,26,43,48,254,909,941,come:21,46,359,902,903,936,comma:3,6,10,20,21,23,command:4,8,9,10,14,15,20,21,22,23,24,26,29,32,34,35,37,41,896,898,901,902,903,904,916,935,936,937,939,942,944,946,951,command_opt:5,6,23,commenc:34,comment:0,15,21,commerci:21,37,917,commit:9,917,927,common:21,23,25,34,43,904,917,920,936,950,common_appdata:21,commonconfig:21,commonli:8,41,commun:0,21,23,25,29,34,37,43,863,895,901,917,918,934,compani:937,companion:36,compar:47,48,129,298,909,comparison:21,compat:8,20,21,36,43,902,904,916,926,928,946,compil:0,902,903,904,905,916,917,943,944,compile_et:904,complet:5,6,14,20,21,23,39,43,45,158,272,274,359,375,401,402,736,901,904,905,complex:916,compli:917,complic:37,904,compon:19,21,28,37,38,43,46,48,92,93,223,344,345,350,388,645,706,708,761,908,912,916,917,932,937,949,component1:908,912,component2:908,912,compos:37,compress:903,compromis:14,17,21,32,895,900,comput:14,20,21,29,43,44,46,48,91,117,129,229,296,298,910,917,920,929,936,937,concaten:729,909,922,concatent:922,concept:914,924,concern:25,35,917,937,concis:932,concret:906,concurr:20,24,condit:37,154,301,916,917,944,conduct:29,conf:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,22,23,24,25,26,27,28,29,30,31,32,33,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,conf_keyfil:5,23,conf_req_flag:43,conf_stat:43,confidenti:26,43,916,config:20,21,23,141,155,269,378,901,904,915,916,922,935,938,configur:3,4,5,9,14,16,17,19,20,21,23,24,25,30,31,38,41,43,46,48,50,78,154,167,194,251,261,269,388,414,416,563,564,896,899,901,902,903,905,906,916,921,924,933,937,940,941,944,948,950,951,confirm:2,3,5,6,23,130,299,916,946,conflict:15,28,359,602,603,605,606,922,conform:21,903,916,942,confound:104,confus:917,confusingli:46,confvalid:901,conjunct:946,connect:3,4,5,8,12,20,23,32,34,38,43,48,895,899,916,917,937,consequ:14,consequenti:917,consid:0,14,21,24,33,39,41,342,899,904,908,consider:39,45,consist:21,39,344,898,903,908,909,916,923,930,consol:20,consolid:0,consortium:934,951,constant:46,57,58,725,731,819,constitut:917,constrain:3,23,333,547,654,916,946,constraint:917,949,construct:0,43,46,277,279,329,404,863,864,916,921,946,consult:21,930,consum:24,894,925,contact:3,7,8,14,20,21,23,29,39,260,895,918,934,947,contain:3,4,5,6,8,9,15,19,20,21,22,23,24,28,29,33,34,37,38,39,41,43,46,48,54,67,72,76,152,154,169,172,173,183,184,195,231,245,247,276,279,300,301,320,330,336,342,344,355,356,357,360,363,365,375,404,414,845,874,887,895,896,898,899,901,902,903,904,905,906,908,909,912,913,917,921,922,931,932,934,936,937,939,940,944,945,946,949,950,951,container_dn:3,23,container_reference_dn:5,23,containerdn:3,23,containerref:5,23,contempl:917,content:0,6,9,11,12,14,23,27,34,37,43,44,46,48,82,84,124,133,137,147,148,174,175,177,178,180,182,183,198,199,200,201,202,207,208,212,215,221,280,333,334,803,809,816,825,846,857,888,895,908,910,912,917,922,940,941,context:21,41,43,44,46,48,49,50,51,52,53,54,55,56,59,60,61,66,70,75,83,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,172,173,174,175,176,177,178,180,181,182,183,184,186,188,189,190,194,195,196,197,198,199,200,201,202,203,204,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,245,246,247,248,250,251,252,253,257,260,261,264,265,267,276,277,278,279,280,281,283,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,367,368,369,370,371,372,375,376,378,379,380,381,382,383,384,385,386,387,388,389,393,404,405,406,407,408,409,410,411,412,413,414,417,418,419,420,564,791,792,793,794,795,796,797,798,836,863,864,870,874,886,916,918,920,921,923,929,930,931,context_handl:43,922,contigu:43,continu:2,6,17,34,909,916,917,944,contract:917,contrari:43,46,contribut:101,107,119,914,917,951,contributor:907,917,control:4,14,15,18,19,20,21,22,26,28,34,36,37,38,41,43,46,243,279,404,414,904,905,916,918,923,924,925,928,930,931,932,933,948,convei:14,23,39,43,835,861,916,917,conveni:46,323,368,371,902,convent:39,406,932,convention:951,convers:21,909,convert:14,21,38,43,48,169,258,389,916,949,cooki:599,911,916,929,coordin:922,copi:15,17,23,26,29,32,34,37,41,43,48,86,88,269,272,342,401,900,908,917,925,932,937,944,copyright:901,903,917,951,core:920,925,929,932,934,corpor:917,951,correct:4,10,14,21,23,33,34,41,124,733,895,904,916,917,correctli:12,43,863,864,894,916,936,correspond:6,19,21,37,39,43,44,46,56,152,245,263,342,882,906,909,916,921,922,927,951,corrupt:6,17,23,916,cost:23,29,904,917,could:0,14,16,17,21,25,28,33,34,35,39,899,916,921,936,937,944,couldn:12,count:3,6,23,43,48,87,89,111,286,908,912,counter:3,23,35,countermeasur:32,counterpart:19,33,countri:917,cours:17,courtesan:917,cover:33,cpp:904,cppflag:904,cppopt:904,cpu:40,cpw:3,14,23,crash:17,21,34,crawdad:917,crawford:917,crc:14,26,creat:3,4,7,12,14,15,19,20,21,22,24,26,28,31,32,35,43,47,48,67,72,76,93,113,114,125,126,135,138,172,173,174,175,176,177,178,180,182,183,205,236,262,265,271,294,295,307,308,324,331,345,359,363,364,375,387,400,414,708,895,896,898,902,906,909,913,916,917,918,919,920,922,923,924,926,927,928,929,930,931,932,933,934,936,937,940,create_polici:23,creation:14,21,23,37,909,creativ:917,creativecommon:917,cred:46,48,150,151,153,159,166,232,233,234,235,260,264,267,272,275,321,382,401,403,405,414,531,916,944,cred_handl:43,922,cred_stor:43,cred_usag:43,cred_usage_stor:43,creddata:354,credenti:3,8,12,16,20,21,23,28,33,35,37,45,48,138,166,177,206,207,223,224,229,321,329,333,354,375,402,405,440,549,618,653,745,821,822,823,824,875,894,897,898,899,901,904,911,916,920,922,923,924,929,937,939,940,941,943,944,945,946,949,951,credentials_cach:3,23,creds_out:354,405,criteria:37,895,critic:46,934,crl:20,21,cron:17,20,34,39,cross:20,21,342,343,359,904,908,916,crt:20,21,crypto:14,121,191,901,904,916,917,crypto_entri:832,crypto_test:917,cryptograph:14,43,916,917,cryptographi:14,40,cryptosystem:14,csv:6,916,ctime:806,811,834,cts:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,ctx:43,72,73,76,77,86,87,88,89,171,176,213,228,270,271,272,273,274,275,276,277,278,279,346,365,366,367,368,369,370,371,372,373,379,399,400,401,402,403,404,417,418,419,420,875,ctype:109,110,127,131,168,413,cuba:917,cultur:917,current:2,3,6,8,9,11,14,20,21,22,23,28,39,48,136,179,330,346,356,360,382,440,740,887,895,898,904,908,913,916,920,923,924,929,937,942,949,951,curri:15,curs:904,cursor:48,139,150,158,163,164,314,318,813,815,curv:21,40,cusec:806,811,834,custom:21,906,915,916,919,cut:39,cve:916,cybersaf:540,917,cycl:916,cygnu:663,917,daemon:8,19,20,21,23,31,36,37,38,895,900,916,921,951,daffodil:15,937,dai:3,5,21,23,37,48,396,896,937,951,daili:14,daisi:39,dal:925,damag:895,917,danger:17,944,danilo:917,dash:21,data:3,6,9,14,20,21,22,23,24,26,32,43,44,46,48,63,79,80,98,113,114,117,119,120,121,123,129,130,141,151,153,155,169,178,203,208,212,224,245,253,257,258,260,262,275,294,295,296,298,299,300,323,326,329,330,331,333,335,340,341,352,354,356,359,360,368,371,375,376,380,381,382,383,386,388,393,405,467,479,480,481,537,538,677,720,744,791,792,795,809,811,819,821,824,825,827,830,831,834,836,843,844,854,857,861,863,864,866,867,870,873,875,884,889,895,899,900,904,908,909,910,912,916,917,919,920,921,924,928,929,933,941,data_length:116,data_out:321,data_set:43,databas:2,4,5,6,7,8,9,10,12,15,18,19,20,21,22,26,28,30,31,32,35,37,43,898,900,901,904,905,915,916,917,924,927,929,940,943,944,951,database_modul:20,24,database_nam:20,23,34,datadir:904,datarootdir:904,datatyp:45,date:3,6,8,20,21,26,37,167,224,398,830,897,916,datebas:4,david:15,23,936,937,951,db2:3,6,20,23,35,901,915,916,db3:904,db_185:904,db_arg:3,4,6,8,10,23,db_header:904,db_lib:904,db_librari:20,22,24,db_module_dir:20,db_princ_arg:3,23,dbadmin:19,dbdefault:5,23,dbmatch:21,dbmodul:3,22,23,24,35,dbname:3,6,10,23,dbutil:917,dce:43,48,641,679,916,dcmd_path:944,deactiv:20,deal:895,917,dealloc:92,923,930,debian:31,916,debug:3,7,8,9,20,28,903,dec:34,35,896,dec_err:324,dec_error:355,decid:34,39,245,937,decim:6,43,908,951,decis:30,917,926,930,951,declar:43,922,decod:21,46,48,159,184,359,908,919,921,decompos:538,decreas:21,898,decrement:48,decrypt:3,23,35,43,48,79,354,364,825,881,899,944,946,dedic:34,default_ccache_nam:21,136,895,951,default_client_keytab_nam:15,21,898,default_cr:43,default_domain:21,default_kdb_fil:905,default_kdc_enctyp:905,default_keytab_nam:21,898,905,default_principal_expir:20,896,default_principal_flag:19,20,916,default_profile_path:905,default_rcache_nam:21,899,default_realm:21,28,33,34,923,932,default_tgs_enctyp:21,26,default_tkt_enctyp:21,26,default_valu:59,60,defccnam:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,defcktnam:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,defeat:40,defens:25,defer:43,919,923,926,930,defin:3,12,20,21,33,34,39,43,101,119,228,738,899,904,908,909,921,925,932,933,944,definit:10,16,20,901,917,926,928,defktnam:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,del_polici:3,23,delai:24,39,904,916,940,deleg:3,20,21,23,333,547,654,908,916,937,941,946,delegated_cred_handl:43,delent:11,delet:2,3,5,6,11,15,19,21,32,34,151,899,916,917,936,939,944,951,delimit:21,311,delold:2,14,26,delpol:3,23,delprinc:3,23,delstr:3,delta:20,48,deltat:187,deltatp:391,demand:414,demonstr:12,14,deni:3,19,23,25,28,35,926,930,944,denial:21,denot:6,19,896,909,depart:917,depend:25,33,39,43,46,126,365,373,738,874,903,904,915,916,921,933,936,937,deploi:36,37,38,902,deploy:14,24,37,deprec:14,20,26,70,75,94,120,122,123,131,168,186,188,190,191,196,197,225,226,232,233,234,239,281,309,340,341,351,353,393,411,413,916,der:909,919,922,929,der_out:323,325,326,331,deriv:6,14,20,23,25,48,99,100,102,103,113,129,287,288,289,290,294,298,909,913,916,917,942,des3:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,des:14,26,descend:895,899,describ:0,3,14,15,16,21,23,24,25,28,32,34,37,43,375,406,825,834,835,894,908,917,920,921,922,924,932,937,944,descript:23,32,39,43,834,901,915,916,918,919,920,923,925,926,927,928,929,930,931,932,933,descriptor:62,363,364,375,deseri:48,design:28,34,46,315,895,899,951,desir:14,15,23,28,43,119,121,250,251,329,904,916,931,944,desired_mech:43,922,desired_nam:43,desired_object:43,desktop:46,dest_ctx:179,destdir:902,destin:32,902,916,destroi:43,48,136,147,148,386,414,895,916,918,919,920,923,926,927,928,929,930,931,933,935,939,940,destroy_polici:23,detach:8,detail:10,14,15,22,24,26,28,33,34,36,262,736,895,901,903,916,918,919,920,923,926,927,928,929,930,931,932,933,944,detect:6,8,14,23,323,325,326,331,356,360,899,904,922,determin:3,4,5,6,8,20,21,23,24,28,34,43,48,62,102,105,117,136,154,230,231,261,289,359,385,389,416,887,895,898,899,902,904,909,912,916,919,923,926,930,931,937,951,dev:20,21,41,951,develop:0,902,914,916,917,934,951,devic:3,20,21,23,46,655,656,devicenam:20,dfl:21,899,951,dget_tgt_via_passwd:944,dict:3,21,23,dict_fil:4,20,933,dictat:23,dictionari:20,21,29,30,34,35,40,916,933,940,did:34,223,267,342,937,didn:12,28,differ:3,6,12,15,21,25,26,28,33,34,37,38,39,43,45,48,107,119,159,265,375,385,863,899,902,904,921,929,930,936,937,940,944,951,diffi:20,21,940,difficult:35,difficulti:38,digest:20,917,digit:896,951,digitalsignatur:21,37,dir:20,21,37,895,904,915,940,951,direct:21,22,23,28,41,48,917,922,932,951,directli:3,18,20,21,23,29,34,43,46,375,618,922,929,940,945,directori:5,12,20,21,22,23,28,33,34,37,169,342,895,899,903,905,906,915,916,936,944,948,949,950,951,dirnam:21,895,dirpath:895,disabl:3,14,20,21,23,24,26,28,34,37,38,39,41,380,381,386,550,899,902,904,916,924,940,948,951,disable_encrypted_timestamp:21,25,40,disable_fresh:37,940,disable_last_success:20,22,35,disable_lockout:20,22,35,disable_pac:20,916,disallow:19,disallow_forward:5,23,disassoci:4,10,disast:39,disclaim:917,disclosur:19,916,discoveri:25,33,34,916,discuss:34,899,917,925,934,disjoint:0,disk:4,5,6,15,17,23,24,32,34,46,895,900,903,dispatch:922,displai:2,3,5,9,11,15,23,37,42,46,245,728,898,908,916,917,940,941,947,display:169,disrupt:14,dist:903,distclean:902,distinguish:5,21,23,917,distribut:10,901,902,903,904,905,916,917,937,951,distributor:917,divid:913,dll:28,921,922,932,dns:21,904,dns_canonicalize_hostnam:21,38,916,dns_canonicalize_realm:916,dns_lookup_kdc:21,dns_lookup_realm:21,39,dns_uri_lookup:21,39,dnsname:21,doc:22,42,906,document:5,20,21,23,29,33,34,43,894,902,904,913,916,917,921,934,doe:3,6,8,10,14,15,20,21,22,23,24,25,26,34,37,38,39,40,43,46,56,119,144,152,160,301,311,313,345,375,389,397,414,895,898,902,904,909,916,917,921,922,923,930,932,936,937,944,doesn:2,6,23,161,895,936,doing:6,23,29,46,916,917,921,940,944,domain:12,15,20,21,33,34,36,37,38,39,916,937,domain_realm:28,33,39,949,don:12,710,713,895,902,904,936,944,951,donat:23,917,done:8,22,23,32,34,39,895,904,920,929,932,944,951,dot:38,doubl:896,down:39,download:8,917,downstream:23,916,downtim:14,doxygen:0,906,dprinc_look_ahead:944,draft:692,695,698,916,drift:15,drop:916,dry:6,dsa:476,dst:148,due:14,19,23,41,dug:917,dugsong:917,dump:4,7,8,17,20,24,34,915,916,dump_fil:4,dumpfil:6,23,904,dumptyp:6,dup:20,duplic:48,824,899,durabl:20,24,durat:3,20,21,23,882,940,944,dure:3,4,8,17,20,21,23,26,34,35,40,43,352,380,414,717,908,909,916,920,927,937,944,dynam:21,921,924,926,932,e19253:42,e2big:119,e_data:834,929,each:2,3,6,8,10,15,19,20,21,23,24,25,26,28,33,35,37,39,43,44,46,252,263,265,352,753,895,898,900,902,908,909,913,916,917,921,925,926,927,931,936,937,940,941,944,946,949,950,ear:917,earli:14,earlier:20,26,34,224,930,earliest:6,153,913,eas:36,easi:14,17,25,35,937,easier:0,14,916,easili:14,34,902,916,eavesdrop:43,eavesdropp:899,ebaa:42,eblock:186,188,190,196,197,281,351,353,393,411,echo:352,361,edata:929,edit:2,11,12,31,904,905,936,editor:0,edt:3,23,edu:0,3,5,12,14,15,19,20,21,23,24,28,32,34,42,916,917,932,934,936,937,944,educ:33,edwards25519:21,40,917,edwards25519_t:917,effect:14,19,20,21,23,37,39,729,895,899,effici:916,effort:25,eight:33,einval:260,373,390,392,394,395,either:15,20,21,22,23,25,26,34,35,36,37,41,43,44,195,245,253,274,325,326,327,331,402,403,407,729,864,895,902,913,917,921,926,930,937,944,950,eku:20,21,elaps:3,23,element:43,46,48,189,320,412,825,871,909,elements_stor:43,elimin:14,40,ellipt:40,els:34,921,936,937,944,elsewher:17,emac:904,email:0,642,936,emailprotect:21,embed:677,empti:3,6,19,20,21,23,36,43,46,48,93,229,231,279,345,388,389,404,414,899,904,908,940,enabl:3,4,8,14,15,20,21,22,23,24,25,28,34,36,37,39,40,41,43,55,78,895,903,904,916,919,924,944,951,enable_onli:21,28,enc:3,6,15,20,23,199,301,824,916,enc_err:324,enc_errbuf:355,enc_padata:830,enc_part2:376,821,843,881,enc_part:805,821,843,881,enc_tkt:300,301,encdata:909,enckdcreppart:830,enckrbcredpart:823,enclos:20,21,896,encod:21,43,46,48,189,300,323,325,355,541,881,888,908,909,919,922,929,encompass:43,encount:21,34,941,encourag:21,encrypt:2,3,6,14,15,17,21,23,25,29,30,32,34,36,40,43,46,48,79,95,98,99,100,112,113,114,116,124,125,126,129,130,153,229,280,287,288,294,295,298,299,310,315,325,326,357,359,394,480,481,539,599,670,748,806,807,821,823,824,825,830,831,843,844,881,898,899,900,901,905,909,910,916,917,920,922,929,934,941,946,951,encrypted_challeng:21,encrypted_challenge_ind:20,916,encrypted_timestamp:21,enctyp:6,11,14,20,21,23,48,95,97,98,99,101,104,107,111,112,116,118,125,126,192,193,211,224,280,287,310,315,378,411,829,831,844,846,908,912,915,916,920,946,enctype_aes128_cts_hmac_sha1_96:447,787,enctype_aes128_cts_hmac_sha256_128:787,enctype_aes256_cts_hmac_sha1_96:448,787,enctype_aes256_cts_hmac_sha384_192:787,enctype_arcfour_hmac:787,enctype_arcfour_hmac_exp:787,enctype_camellia128_cts_cmac:787,enctype_camellia256_cts_cmac:787,enctype_des3_cbc_env:787,enctype_des3_cbc_raw:787,enctype_des3_cbc_sha1:787,enctype_des3_cbc_sha:787,enctype_des_cbc_crc:787,enctype_des_cbc_md4:787,enctype_des_cbc_md5:787,enctype_des_cbc_raw:787,enctype_des_hmac_sha1:787,enctype_dsa_sha1_cm:787,enctype_md5_rsa_cm:787,enctype_nul:101,229,787,enctype_out:229,enctype_rc2_cbc_env:787,enctype_rsa_env:787,enctype_rsa_es_oaep_env:787,enctype_sha1_rsa_cm:787,enctype_unknown:787,enctypep:392,end:6,20,21,23,24,30,33,34,39,92,93,164,332,823,831,844,882,904,908,912,913,916,925,944,951,endian:908,909,910,912,922,endors:917,endpoint:62,917,endtim:224,882,908,energi:917,enforc:21,enforce_ok_as_deleg:21,916,engin:39,enoent:336,enomem:119,223,231,302,323,325,enough:3,23,26,99,102,167,287,289,764,ensur:14,15,17,20,23,24,25,26,34,37,46,171,863,864,923,930,937,enter:3,5,10,14,23,34,37,325,326,331,361,922,936,937,enterpris:38,43,345,708,916,940,946,entir:3,14,20,39,538,908,929,entiti:43,917,entri:3,8,9,11,12,14,15,19,20,21,22,23,24,26,32,34,35,37,38,39,40,41,43,46,48,153,173,195,198,200,220,245,309,315,320,322,325,326,331,337,352,359,414,830,848,852,895,898,900,909,910,913,916,928,929,937,941,944,entropi:916,enumer:14,26,env:21,37,41,951,envelop:467,479,480,481,environ:14,15,20,21,23,24,26,28,30,34,35,37,38,41,43,56,136,268,269,282,386,387,895,898,899,902,915,916,envvar:21,eperm:926,930,epoch:48,883,equal:15,24,912,916,944,equip:951,equival:20,36,166,382,383,916,erang:336,err_fmt:21,916,erron:41,error:3,20,21,24,34,37,39,43,48,49,50,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,117,118,119,121,124,125,126,129,130,133,134,135,137,141,142,145,147,148,149,150,151,152,153,154,155,156,157,158,159,161,162,163,164,166,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,236,238,243,248,260,261,262,264,265,266,267,268,271,272,274,275,276,277,278,279,280,282,287,288,289,290,294,295,296,298,299,300,301,302,303,305,306,308,310,311,314,315,316,317,318,321,322,323,324,325,326,327,328,329,330,331,332,333,335,337,338,339,342,344,345,347,352,354,356,357,358,359,360,361,363,364,374,375,376,377,378,382,383,384,385,389,396,397,398,400,401,402,403,404,405,406,407,408,409,410,414,543,615,617,711,712,834,835,863,899,901,904,916,920,921,926,927,929,930,937,946,error_t:917,escap:713,especi:15,26,34,38,916,essenti:20,est:23,35,896,establish:37,43,899,etc:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,etyp:6,229,378,671,916,946,etype_list:244,838,etype_list_length:244,838,euid:21,899,915,evalu:21,even:14,20,21,23,25,28,34,38,39,43,245,388,894,896,899,916,917,940,944,event:39,48,916,917,929,eventu:26,39,everi:20,21,23,32,34,48,318,895,evid:43,evolut:916,exact:22,903,exactli:21,34,153,407,746,747,751,909,944,examin:21,37,920,929,exampl:3,5,6,9,14,16,20,21,22,24,26,28,32,34,35,37,38,39,41,43,56,100,103,288,290,895,896,899,902,903,916,917,921,932,936,937,940,944,951,exce:894,896,except:3,15,19,21,23,37,39,43,329,916,917,922,944,excess:902,exchang:34,40,48,224,247,279,363,375,437,875,909,929,exclud:6,17,32,916,exclus:3,913,917,940,944,exec:904,943,944,execprefix:904,execut:3,6,22,34,46,380,903,904,943,exemplari:917,exhaust:32,exist:0,2,3,5,6,14,15,20,21,22,23,26,28,32,34,35,43,46,48,137,147,155,329,330,359,363,364,375,407,414,895,900,908,916,922,940,942,944,exit:3,10,11,23,895,916,937,941,946,exp:3,15,20,21,26,37,expand:21,913,916,expans:904,916,expdat:3,23,expect:14,21,34,41,267,301,342,343,728,906,920,925,937,expected_nonc:880,expens:20,25,35,experi:0,14,39,916,experienc:0,931,experiment:916,expir:2,3,6,15,19,20,21,23,26,33,37,43,46,48,224,243,260,830,882,895,896,899,908,916,937,940,941,944,951,expiri:14,245,916,explain:34,explicit:14,19,21,22,24,28,39,917,explicitli:3,14,19,23,28,34,44,253,904,916,926,927,928,937,expos:3,6,14,23,46,846,940,944,express:3,21,23,896,917,extend:20,21,37,48,420,887,922,951,extendedkeyusag:37,extens:37,39,247,906,916,922,extent:917,extern:20,22,43,908,extfil:37,extra:19,39,40,764,903,extra_address:21,extract:3,15,19,23,34,229,898,916,extrem:3,eytab:3,15,facil:4,15,20,43,916,facilit:916,factor:21,909,fail:2,3,6,14,15,20,21,23,24,35,38,39,43,46,228,260,279,342,354,404,863,902,904,916,922,923,937,939,944,fail_count:6,failov:39,failur:3,6,14,23,24,35,46,119,129,130,159,260,298,299,310,407,408,409,916,917,922,931,933,failurecountinterv:3,23,35,failuretim:3,23,fake:21,46,fall:39,40,895,916,fallback:3,20,21,23,38,40,46,916,923,fallback_realm:923,fals:14,20,21,23,26,28,33,36,37,38,39,43,52,54,105,109,110,127,128,160,192,245,283,284,285,319,348,349,350,362,388,416,950,famili:20,186,188,190,191,196,197,250,251,281,351,353,411,931,famou:34,far:37,fashion:29,917,944,fast:20,21,25,36,37,48,229,544,599,908,916,920,929,fast_avail:908,fast_ccache_nam:247,faster:25,39,895,902,fatal:154,fdii:937,feasibl:34,featur:24,29,368,371,914,917,934,feb:9,februari:894,fee:917,feedback:0,fellow:917,fenc:921,fences_wicker_initvt:921,fermi:917,fetch:4,5,6,10,11,21,23,71,141,414,916,few:904,936,951,fiat:917,fiction:921,fictiti:937,field:3,6,20,21,23,35,36,37,39,44,46,48,153,256,310,330,331,343,352,356,357,359,360,412,747,751,887,908,909,912,913,916,920,921,929,933,937,949,file2:899,913,951,file:3,4,5,6,7,9,10,11,12,14,15,16,17,19,22,24,28,29,30,31,37,38,39,41,46,48,50,152,262,269,317,321,363,364,375,378,405,753,895,896,897,898,899,901,902,903,904,905,906,914,915,916,917,918,919,920,921,922,923,925,926,927,928,929,930,931,932,933,935,936,937,944,949,950,951,filenam:2,3,5,6,7,8,15,20,21,23,28,34,36,37,41,43,387,895,899,916,951,filesystem:20,23,34,37,913,915,fill:46,48,50,56,119,121,134,150,152,224,230,231,303,306,311,327,347,357,358,390,391,394,396,397,912,913,921,932,filter:20,21,find:12,21,23,38,39,43,48,50,908,913,916,918,936,937,940,944,fine:39,43,fini:918,919,920,923,926,927,928,929,930,931,finish:48,fip:916,fire:39,firewal:29,39,41,firm:917,first:3,6,9,12,16,19,20,21,22,23,26,28,34,37,38,39,43,44,52,53,93,105,136,228,258,279,300,322,348,349,350,361,362,386,404,761,825,898,899,904,906,908,909,910,912,913,916,917,919,921,922,923,928,930,937,942,944,949,951,fit:311,917,five:3,21,23,34,896,899,927,942,fix:6,913,916,flag:2,3,5,6,11,14,19,20,21,22,23,25,26,28,33,35,39,40,43,46,48,55,62,69,74,78,151,153,192,269,279,325,326,327,331,343,352,354,356,359,360,363,364,404,726,727,728,729,733,734,735,736,738,745,746,823,824,825,830,831,838,877,892,895,904,916,920,929,937,939,940,941,943,944,flag_rsa_protocol:940,flagnam:19,flat:895,flavor:3,23,flexibl:21,38,flip:14,flush:932,fmt:346,379,417,418,419,420,fnal:917,folder:21,follow:2,3,6,10,14,15,19,20,21,22,23,24,25,26,28,29,34,35,36,37,38,39,43,62,228,245,248,263,333,344,345,352,359,361,389,408,895,896,898,899,901,902,904,905,908,909,910,912,916,917,921,922,925,932,934,936,937,940,941,943,944,948,949,950,951,foo:3,6,15,21,foobar:39,904,950,fool:25,foot:921,for_us:946,forbid:3,23,forbidden:21,forc:3,5,8,9,11,14,19,20,21,23,25,26,35,39,40,136,foreground:4,8,forev:3,23,forget:5,23,34,156,fork:10,34,944,form:0,3,15,20,21,23,24,25,28,29,34,39,43,152,317,325,326,331,373,389,642,874,895,900,909,916,917,940,949,951,format:0,3,6,19,20,21,36,39,43,48,321,346,405,406,417,419,420,731,736,738,877,887,895,897,898,899,904,906,910,914,916,921,922,944,946,951,former:388,formul:21,forth:21,forward:3,15,20,21,23,33,34,36,38,43,48,354,531,548,838,916,937,940,941,944,951,found:7,10,12,20,21,23,34,39,59,60,151,153,154,195,301,315,359,904,913,916,936,937,944,945,951,foundat:917,four:21,24,35,40,908,909,910,913,922,944,fqdn:29,fraction:25,frame:908,framework:43,916,917,fred:28,free:46,47,48,49,65,67,72,76,91,93,111,115,141,143,145,150,153,169,172,173,174,175,177,178,180,181,182,183,194,195,224,227,229,236,261,272,275,280,286,310,315,317,321,322,324,325,326,327,328,329,330,331,332,335,338,339,344,345,354,355,356,357,359,360,363,375,389,401,403,405,406,408,917,919,921,932,free_ind:919,free_list:923,free_modreq:929,free_restrict:926,free_str:930,932,free_valu:932,freed:44,57,58,61,78,85,106,136,144,146,198,199,200,201,202,204,207,208,210,211,212,215,216,217,218,219,221,222,228,262,312,334,365,366,368,371,863,864,freeli:917,frequent:14,33,38,39,883,936,fresh:0,15,17,20,43,598,911,916,940,944,fri:9,friend:937,friendli:916,friendlier:916,from:0,2,3,4,5,6,7,8,9,10,11,17,19,20,21,22,24,25,28,29,32,34,35,37,38,39,41,43,44,46,48,49,93,99,100,101,102,103,113,119,121,129,148,166,169,180,181,183,195,241,245,250,258,269,287,288,289,290,294,298,322,327,330,342,346,352,356,357,358,359,360,375,376,378,380,382,383,414,420,440,830,843,844,895,898,899,902,903,904,908,909,913,914,916,917,918,919,920,922,924,925,927,932,934,936,937,940,942,944,946,949,951,from_mast:8,915,front:20,344,fsanit:904,ftp:32,34,fubar:21,951,fulfil:944,full:4,8,9,14,20,23,39,48,331,904,916,925,936,944,fulli:3,15,19,21,23,29,32,34,35,46,940,951,fullname_out:143,fulvio:42,func:63,80,fund:917,fundsxpress:917,furnish:917,further:10,34,899,950,furthermor:14,245,917,futur:23,26,37,43,156,228,887,916,923,g10:917,g_accept_sec_context:917,g_acquire_cr:917,g_canon_nam:917,g_compare_nam:917,g_context_tim:917,g_delete_sec_context:917,g_dsp_name:917,g_dsp_statu:917,g_dup_nam:917,g_exp_sec_context:917,g_export_nam:917,g_glue:917,g_imp_nam:917,g_imp_sec_context:917,g_init_sec_context:917,g_initi:917,g_inquire_context:917,g_inquire_cr:917,g_inquire_nam:917,g_process_context:917,g_rel_buff:917,g_rel_cr:917,g_rel_nam:917,g_rel_oid_set:917,g_seal:917,g_sign:917,g_store_cr:917,g_unseal:917,g_userok:917,g_util:917,g_verifi:917,gain:14,25,34,926,928,937,gcc:904,gen_sym:944,gener:2,9,12,14,15,17,19,20,21,23,25,26,32,35,41,43,48,113,125,126,260,283,294,327,330,342,440,523,524,525,526,822,839,854,895,899,901,902,903,904,906,908,916,917,920,924,929,934,937,944,949,generalizedtim:909,generalstr:37,generic_trusted_ca:20,21,gennadi:944,genrsa:37,german:916,get:3,12,14,16,19,20,21,23,32,33,35,38,39,48,59,60,163,236,254,258,275,904,916,920,923,929,936,937,940,944,951,get_cooki:916,929,get_cr:46,get_tgt_via_passwd:944,get_valu:932,getaddrinfo:38,getdat:3,5,6,19,23,gethostnam:38,43,getnameinfo:38,getopt:901,getpol:3,23,getprinc:3,6,14,23,26,35,916,getpwuid:3,23,getrandom:916,getstr:3,getusershel:944,gic_opt:920,give:6,14,23,28,38,902,908,909,917,930,936,937,given:2,3,5,6,8,10,14,20,21,23,28,36,38,39,41,43,46,48,49,59,60,124,135,317,329,389,864,904,908,913,916,917,941,gladman:917,glob:3,6,15,23,global:5,19,20,21,22,23,141,155,916,glorifi:921,glossolalia:14,glue:901,gmbh:917,gmt:896,gnu:902,904,916,917,goal:46,going:20,24,937,good:12,15,23,34,917,936,937,951,googl:917,gotten:937,gov:21,917,govern:23,917,942,gpg:903,gpl:917,grace:940,gracefulli:922,grain:43,grammar:908,912,grant:3,14,19,20,21,23,26,28,34,35,37,39,43,46,48,224,235,260,264,267,758,895,908,916,917,926,930,935,937,940,944,950,gratitud:917,great:19,153,267,750,greater:53,greg:951,groff:0,group:20,21,40,909,917,grow:899,gs2:916,gss:28,901,908,915,916,922,951,gss_:922,gss_accept_sec_context:43,916,922,gss_acquire_cr:43,916,gss_acquire_cred_from:43,916,gss_acquire_cred_impersonate_nam:43,gss_acquire_cred_with_password:916,gss_add_cr:922,gss_add_cred_from:922,gss_add_cred_impersonate_nam:922,gss_add_cred_with_password:922,gss_add_oid_set_memb:922,gss_buffer_desc:43,gss_buffer_set_t:43,gss_buffer_t:43,922,gss_c_accept:43,gss_c_both:43,gss_c_buffer_flag_alloc:43,gss_c_buffer_type_data:43,gss_c_buffer_type_head:43,gss_c_buffer_type_mic_token:43,gss_c_buffer_type_pad:43,gss_c_buffer_type_sign_onli:43,gss_c_buffer_type_stream:43,gss_c_buffer_type_trail:43,gss_c_channel_bound_flag:916,gss_c_dce_styl:43,gss_c_deleg_policy_flag:916,gss_c_inq_negoex_kei:922,gss_c_inq_negoex_verify_kei:922,gss_c_ma_negoex_and_spnego:922,gss_c_no_credenti:43,gss_c_no_nam:43,gss_c_nt_anonym:43,gss_c_nt_export_nam:43,922,gss_c_nt_hostbased_servic:43,gss_c_nt_machine_uid_nam:43,gss_c_nt_string_uid_nam:43,gss_c_nt_user_nam:43,gss_c_null_oid:43,gss_c_qop_default:43,gss_c_sec_context_sasl_ssf:916,gss_const_key_value_set_t:43,gss_create_empty_oid_set:922,gss_cred_id_t:43,922,gss_cred_usage_t:43,gss_ctx_id_t:43,922,gss_display_statu:922,gss_error:43,gss_export_cr:43,gss_export_nam:43,gss_get_mic_iov:43,gss_get_mic_iov_length:43,gss_get_name_attribut:43,gss_import_cr:43,922,gss_import_nam:43,922,gss_import_sec_context:922,gss_init_sec_context:43,gss_inquire_attrs_for_mech:922,gss_inquire_cr:43,gss_inquire_cred_by_oid:43,916,gss_inquire_nam:43,gss_inquire_sec_context_by_oid:916,922,gss_iov:916,gss_iov_buffer_desc:43,gss_iov_buffer_desc_struct:43,gss_iov_buffer_flag_alloc:43,gss_iov_buffer_t:43,gss_iov_buffer_type_data:43,gss_iov_buffer_type_head:43,gss_iov_buffer_type_mic_token:43,gss_iov_buffer_type_pad:43,gss_iov_buffer_type_sign_onli:43,gss_iov_buffer_type_stream:43,gss_iov_buffer_type_trail:43,gss_key_value_element_desc:43,gss_key_value_element_struct:43,gss_key_value_set_desc:43,gss_key_value_set_struct:43,gss_krb5_cred_no_ci_flags_x:916,gss_krb5_get_cred_imperson:43,916,gss_krb5_nt_enterprise_nam:43,916,gss_krb5_nt_principal_nam:43,gss_krb5_nt_x509_cert:43,916,gss_mech_config:28,915,951,gss_mech_interpos:922,gss_name_t:43,922,gss_oid:43,922,gss_oid_set:43,922,gss_qop_t:43,gss_release_iov_buff:43,gss_s_cred_unavail:43,gss_s_duplicate_el:43,gss_s_unavail:43,gss_store_cr:916,gss_store_cred_into:43,gss_unwrap_aead:43,gss_unwrap_iov:43,gss_verify_mic_iov:43,gss_wrap_aead:43,gss_wrap_iov:43,gss_wrap_iov_length:43,gss_wrapex:916,gssapi:15,16,20,21,45,894,895,898,899,901,916,917,918,924,943,951,gssapi_err_gener:917,gssapi_ext:43,922,gssapi_krb5:43,gssapiauthent:28,gssapip_spnego:917,gssapistrictacceptorcheck:38,gssapiv2:43,gssd_pname_to_uid:917,gssi_:922,gssi_import_cred_by_mech:922,gssi_import_name_by_mech:922,gssi_import_sec_context_by_mech:922,gssrpc:917,gssspi_exchange_meta_data:922,gssspi_query_mechanism_info:922,gssspi_query_meta_data:922,guarante:14,guard:899,guess:21,34,916,guest:3,21,23,guid:15,30,32,924,h5l:21,44,had:6,23,28,34,37,936,937,950,haddl:85,hand:14,23,34,handi:34,handl:3,6,14,19,23,36,43,48,71,132,135,137,139,141,142,143,144,145,146,147,149,150,151,152,153,154,155,157,158,159,161,164,223,224,235,246,250,251,265,276,300,302,303,305,308,310,311,312,313,314,316,318,335,336,342,343,359,403,414,917,920,922,925,929,handle_error:43,handle_out_of_space_error:43,happen:3,17,20,23,34,39,41,937,happi:917,hard:20,23,hardcod:895,898,932,harder:916,hardwar:3,20,23,34,46,919,929,937,941,harm:899,harvard:917,harwood:951,has:0,3,5,6,12,14,15,17,19,20,21,23,24,25,26,27,28,34,35,37,38,39,43,46,78,124,260,263,279,356,360,388,404,737,895,899,902,903,904,908,912,913,916,917,922,926,927,928,931,936,937,941,944,949,hash:6,21,23,37,899,909,913,916,hat:691,917,951,have:0,2,3,6,8,12,14,15,17,19,20,21,23,24,25,26,28,32,33,34,35,37,38,39,43,46,101,153,230,274,402,895,899,902,903,906,908,909,912,913,916,917,918,920,921,922,925,926,927,929,931,933,936,937,940,944,948,950,951,have_getusershel:944,haven:904,951,hdata:230,head:21,header:6,21,43,48,535,538,807,904,918,919,920,921,923,925,926,927,928,929,930,931,932,933,headernam:904,heim_org:21,heimdal:42,43,45,895,916,held:917,941,hellman:20,21,940,help:21,37,899,904,916,932,934,937,943,951,helpdesk:14,henc:12,her:39,937,950,here:0,15,19,20,21,23,28,35,41,43,46,896,904,921,936,937,hereaft:917,herebi:917,hesiod:21,904,917,heurist:21,154,230,918,944,949,hexadecim:6,916,hhmmss:896,hhost:916,hidden:46,352,868,hide:3,23,940,hierarch:4,21,916,hierarchi:23,high:14,16,24,higher:43,895,906,916,highest:3,6,14,15,21,310,315,414,highli:903,916,himself:937,hin:903,hint:3,20,23,149,his:19,23,937,944,950,hist_kvno:6,histor:28,33,894,histori:6,26,904,916,hit:48,944,hmac:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,hold:3,43,78,170,187,192,193,397,398,895,holder:917,hole:32,34,39,912,home:5,21,23,28,936,944,948,949,950,honor:41,937,hook:48,863,864,916,924,hope:917,hopefulli:35,host01:951,host:3,4,7,8,12,14,15,16,20,21,23,24,25,26,29,30,31,33,36,37,38,39,43,46,48,194,223,230,329,331,388,389,414,643,645,899,902,904,916,924,929,936,937,940,941,944,948,949,950,951,host_based_servic:20,39,host_realm:923,hostaccount:28,hostnam:3,12,15,20,21,23,26,33,34,37,38,41,43,48,329,388,389,904,916,923,946,949,951,hostrealm:28,916,924,hostrealm_plugin:923,hotp:3,hour:5,19,20,23,33,896,936,937,944,951,houston:39,how:14,20,21,23,26,28,32,34,37,39,43,224,416,903,904,914,918,924,931,932,936,940,howev:3,6,14,17,20,21,23,25,32,33,35,37,39,902,917,937,951,html:0,22,42,903,906,916,html_subst:906,htmlsrc:906,http:21,22,25,30,38,39,42,902,903,906,916,917,934,http_anchor:21,29,hudson:951,human:169,896,916,hundr:24,hwauth:20,hxx:917,iakerb:916,icr:43,idea:38,ideal:15,23,34,46,902,ident:3,15,20,22,23,43,48,361,738,878,879,895,916,920,936,937,940,942,identif:916,917,identifi:4,10,21,28,43,166,265,315,317,731,824,830,845,916,917,922,946,idp:691,iec:903,ietf:916,ignor:3,15,19,20,21,26,28,43,48,235,260,264,267,269,278,282,342,345,350,359,388,534,706,709,863,899,902,904,908,916,921,949,951,ignore_acceptor_hostnam:21,38,43,illinoi:42,illumin:951,imap:38,904,949,immedi:6,14,21,23,39,916,929,impact:35,impend:46,imperson:916,impl:904,implement:0,14,20,21,23,24,28,29,36,38,40,43,44,46,51,113,119,151,294,382,383,895,902,904,908,910,912,916,917,918,919,920,921,922,923,925,926,927,929,930,931,932,933,934,937,944,951,impli:8,917,implicit:20,impos:926,imposs:23,35,improv:0,14,20,21,35,916,934,in_authdat:173,in_cr:224,225,226,321,330,375,in_data:329,330,375,in_length:131,413,in_tkt_servic:235,260,264,267,inaccess:39,inaccur:21,inaddr:172,inadequ:41,inauthdat1:322,inauthdat2:322,inbuf:356,357,358,359,360,inc:917,937,951,incc:134,incident:917,includ:6,9,15,16,19,20,21,24,26,32,33,34,37,38,39,43,48,99,104,144,287,311,325,326,330,331,343,344,359,407,684,811,824,831,844,858,894,895,899,901,904,905,906,908,909,912,916,917,920,921,922,926,928,929,932,936,940,944,951,include_pac:858,includedir:21,904,inclus:917,incom:20,38,922,incompat:902,904,925,incomplet:21,inconsist:24,incorpor:0,20,24,916,incorrect:35,39,733,734,936,937,incorrectli:937,incr:177,increas:20,24,40,100,103,288,290,924,increment:4,8,9,14,19,20,24,31,35,39,48,87,89,325,326,331,913,916,917,indata:178,inde:937,independ:21,26,138,163,245,307,904,index:6,22,29,42,369,903,913,indic:3,6,14,19,20,21,23,26,28,30,36,37,39,41,43,46,154,245,327,726,727,728,729,733,734,735,736,835,895,896,898,899,908,909,910,912,913,916,917,919,920,921,929,937,940,951,indirect:917,individu:9,20,917,937,951,inetd:8,12,34,41,infd:62,infer:91,93,344,influenc:38,info2:916,info:20,34,229,652,654,662,671,824,830,886,916,inform:3,4,6,7,9,11,20,22,26,28,33,34,38,39,41,43,46,48,169,185,229,250,251,282,325,327,333,342,364,386,387,416,651,653,655,656,657,738,822,823,861,868,873,887,895,903,904,907,908,909,912,916,920,921,924,925,929,932,934,940,951,infrastructur:21,40,901,902,916,infrequ:916,inherit:936,944,ini:21,init:4,10,918,919,920,923,926,927,928,929,930,931,init_cr:46,initi:3,5,12,14,15,21,22,23,25,26,34,35,38,40,45,48,99,102,115,124,229,269,287,289,336,401,506,875,882,895,898,904,908,916,917,920,921,936,937,940,941,943,944,946,951,initialcredenti:48,initiator_cred_handl:43,inittab:34,initvt:921,inject:25,inop:14,inout:98,99,100,102,103,114,287,288,289,290,295,329,330,359,361,363,364,375,407,inprinc:182,inptr:186,190,input:23,43,48,49,99,100,102,103,107,113,117,119,124,144,194,195,224,287,288,289,290,294,296,352,375,376,403,918,930,933,946,input_assoc_buff:43,input_ccach:940,input_cred_handl:43,input_message_buff:43,input_name_buff:922,input_name_typ:922,input_payload_buff:43,inputlen:104,inquir:3,15,19,23,inquiri:19,ins:32,insecur:14,32,39,43,230,insensit:39,350,704,896,insert:25,823,830,insid:15,26,195,909,916,insist:944,inspect:16,380,381,863,864,919,926,928,inspir:916,inst:50,instal:12,14,15,17,21,28,30,32,39,900,903,906,925,939,943,instanc:19,21,23,28,33,35,43,49,50,643,644,899,908,916,921,951,instead:3,4,6,8,14,20,21,23,24,34,37,38,46,239,246,278,309,340,341,342,344,417,419,864,904,916,917,922,929,939,941,944,950,institut:907,917,951,instruct:22,23,34,37,43,904,934,insuffici:223,231,302,323,325,904,int16_t:841,int32_t:842,int_max:785,integ:3,15,20,21,23,36,37,894,908,909,912,922,integr:26,33,43,46,326,331,356,360,901,903,915,916,917,937,intel:917,intend:3,10,23,41,43,46,352,944,interact:2,3,21,23,39,368,904,intercept:28,922,interest:21,35,899,905,interfac:3,11,14,19,20,23,28,34,46,895,899,901,904,916,921,924,interface_modname_initvt:921,interface_module_initvt:921,interface_plugin:921,interfer:902,intermedi:20,21,23,43,224,908,909,916,937,intern:24,36,41,107,729,845,918,919,920,924,926,927,928,929,931,933,951,internet:38,interoper:37,382,383,895,922,interpos:28,924,interpret:3,36,43,46,152,245,922,940,944,946,interprocess_token:922,interrupt:14,260,917,intersect:26,interv:3,8,23,34,35,894,896,interven:23,intervent:14,26,introduc:3,20,21,919,923,927,928,930,intrud:937,invalid:14,21,23,50,136,139,156,260,301,315,336,937,940,941,invers:912,investig:904,invis:25,invoc:6,41,43,invok:4,8,9,11,12,21,23,24,46,80,136,245,386,922,929,930,931,940,942,944,involv:21,929,iov:48,100,103,288,290,825,916,iov_count:43,iprop:4,8,20,916,917,iprop_en:4,8,20,23,iprop_hdr:917,iprop_listen:20,iprop_logfil:20,23,iprop_master_ulogs:20,23,iprop_port:20,23,iprop_replica_pol:8,20,23,iprop_resync_timeout:20,23,iprop_slave_pol:20,iprop_ulogs:20,ipropd_svc:917,ipv4:38,ipv6:21,38,916,iran:917,is_last_req:245,836,is_skei:153,747,824,908,isi:944,isn:20,23,333,899,902,917,iso:903,isol:39,issu:2,3,14,20,21,23,26,29,32,35,36,37,39,43,46,320,412,882,904,916,920,929,937,940,issuanc:3,23,issue_pac:916,issuer:21,37,320,412,issueraltnam:37,item:253,729,921,929,iter:3,20,23,24,48,164,359,815,918,932,iterator_cr:932,iterator_fre:932,its:3,4,8,10,14,15,17,20,21,23,24,26,28,29,32,33,34,35,37,38,39,40,41,43,46,48,87,89,92,107,117,203,209,228,269,296,301,356,359,360,381,412,896,907,908,916,917,918,919,920,921,922,929,933,939,940,941,949,itself:3,4,8,10,14,15,20,21,23,28,43,46,198,199,200,201,202,203,206,207,208,209,212,215,216,221,334,734,824,895,898,900,922,929,937,ivec:186,190,jan:23,januari:23,894,896,jellinghau:917,jennif:3,23,936,937,951,jeremi:917,jimi:12,job:8,17,34,39,joeadmin:19,23,32,950,joeuser:951,johndo:21,jqpublic:944,json:3,36,46,368,371,736,738,908,jul:896,juli:896,just:6,14,15,20,21,23,33,34,43,326,641,895,902,905,920,937,944,950,k5_gic_opt:235,260,k5_random_kei:115,124,k5_vic_opt:415,416,k5ident:21,28,935,948,k5login:21,28,935,936,944,948,k5login_authorit:21,28,950,k5login_directori:21,28,k5srvutil:1,14,26,898,k5user:944,k5wiki:902,916,934,kadm5:3,4,6,18,20,21,23,24,34,901,915,916,917,924,926,kadm5_auth:19,916,924,kadm5_auth_modinfo:926,kadm5_auth_plugin:926,kadm5_auth_restrict:926,kadm5_hook:916,924,kadm5_hook_modinfo:927,kadm5_hook_plugin:927,kadm5_pass_q_:933,kadm:943,kadmin:1,2,4,5,6,8,10,11,12,14,15,16,19,20,21,22,24,25,26,32,34,35,37,39,40,166,245,300,301,382,895,896,898,901,916,917,924,927,942,943,951,kadmind:1,3,5,9,19,20,21,22,23,24,26,28,34,39,900,916,924,942,951,kadmind_listen:20,kadmind_port:4,20,34,kaduk:14,kbd5_util:23,kbuild:901,kcm:21,321,405,895,916,917,951,kcm_mach_servic:21,kcm_socket:21,kdb5_err:917,kdb5_ldap_util:1,3,4,10,20,22,23,24,kdb5_util:1,4,7,8,10,11,14,20,22,23,24,26,34,896,901,915,916,951,kdb5_util_path:4,kdb5_util_prog:8,kdb:4,22,23,24,35,901,916,917,924,928,940,943,kdb_convert:917,kdb_log:917,kdc1:39,kdc2:39,kdc:3,4,5,6,8,9,10,11,15,16,17,18,19,21,22,23,24,25,26,29,31,32,33,36,40,43,46,48,101,107,119,166,224,230,235,241,245,247,258,260,269,300,301,333,342,343,414,544,546,563,658,736,830,843,844,863,864,882,895,898,900,901,904,905,908,910,911,916,919,920,923,924,925,931,933,937,940,946,951,kdc_cert:37,kdc_default_opt:21,kdc_err_more_preauth_data_requir:916,kdc_listen:20,34,kdc_max_dgram_reply_s:20,kdc_opt_allow_postd:787,kdc_opt_canonic:787,kdc_opt_cname_in_addl_tkt:787,kdc_opt_disable_transited_check:787,kdc_opt_enc_tkt_in_skei:787,kdc_opt_forward:787,kdc_opt_postd:787,kdc_opt_proxi:787,kdc_opt_renew:787,kdc_opt_renewable_ok:21,787,kdc_opt_request_anonym:787,kdc_opt_valid:787,kdc_option:844,kdc_port:20,kdc_princ_nam:37,kdc_princip:37,kdc_principal_seq:37,kdc_tcp_listen:20,34,37,kdc_tcp_listen_backlog:20,kdc_tcp_port:20,kdc_timesync:21,kdc_tkt_common_mask:787,kdcdefault:10,34,37,40,kdcissu:48,kdckei:37,kdclist:34,kdcpolici:916,924,kdcpolicy_plugin:928,kdcpreauth:916,924,kdcpreauth_mymech_initvt:921,kdcpreauth_plugin:929,kdcproxi:29,kdestroi:33,895,916,935,938,940,941,945,946,951,keep:3,9,15,23,35,899,902,903,936,keepkvno:3,keepold:3,14,23,916,kei:2,3,5,6,9,10,11,12,15,16,19,20,21,25,28,32,34,36,37,38,40,41,43,46,48,73,77,87,89,100,103,105,106,108,113,114,117,119,129,130,141,153,155,181,216,224,229,234,258,276,277,280,292,293,300,301,307,308,313,320,325,330,342,343,351,354,359,363,364,412,414,439,440,670,738,748,754,811,823,824,830,831,832,845,846,848,898,899,900,901,904,905,908,909,910,915,916,920,922,929,937,940,941,946,951,kept:3,17,20,23,32,kerb_ap_options_cbt:916,kerber:14,33,34,944,kerbero:2,3,4,5,6,7,8,9,10,11,12,14,18,19,20,21,24,25,26,27,28,30,31,32,33,36,37,38,42,43,45,46,47,48,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,117,118,121,124,125,126,129,130,133,134,135,141,142,145,147,148,149,150,151,152,153,155,156,157,158,159,161,162,163,164,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,235,236,238,248,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,287,288,289,290,294,295,296,298,299,300,301,302,303,305,306,308,310,311,314,315,316,317,318,321,322,323,324,325,326,327,328,329,330,331,332,333,335,337,338,339,342,344,345,347,352,354,355,356,357,358,359,360,361,363,364,374,375,376,377,378,382,383,384,385,389,396,397,398,400,401,402,403,404,405,406,407,408,409,410,414,895,896,899,900,901,902,904,905,907,908,924,927,930,932,934,935,936,939,940,941,942,943,944,945,946,947,948,949,950,kerberos_db:8,kerboro:18,kern:20,kernel:895,901,916,key_data:286,293,key_exp:830,key_stash_fil:6,20,23,34,keyagr:37,keyblock:48,70,75,90,101,107,115,117,215,216,224,280,281,331,353,359,393,824,908,keyboard:4,6,10,23,48,keybyt:112,keydata:6,keyencipher:21,37,keyexchang:107,keyfil:6,20,22,23,keyfilenam:21,keyid:37,keyindex:6,keyinfo:6,26,keylength:112,keylist:11,15,keyprocarg:315,keyr:895,904,916,951,keysalt:2,3,15,23,915,keyspac:14,keytab:2,3,7,8,11,12,14,17,21,23,26,28,31,41,43,46,48,304,310,311,312,314,317,318,359,363,364,416,895,897,899,900,904,905,908,911,915,916,940,941,943,944,946,951,keytab_fil:8,940,keytab_nam:941,keytab_out:303,keytabl:848,keytabnam:904,keytyp:10,keyusag:37,keyutil:904,keyword:21,896,kfw:916,kgetcr:916,kile:683,kill:34,kind:38,43,105,895,917,920,922,929,kinit:3,12,15,16,21,22,23,28,29,33,34,35,37,41,46,895,896,916,920,935,938,939,941,944,945,946,947,951,kiprop:4,8,23,kkdcp:29,39,916,917,klau:917,kldap:20,22,klein:917,klist:14,15,33,895,898,935,938,939,940,944,945,951,klmdb:20,know:21,33,35,37,899,904,922,937,knowledg:0,14,17,414,920,929,known:6,20,23,26,38,43,46,48,152,231,317,647,648,905,916,949,korea:917,kpasswd:3,4,14,15,20,21,23,29,33,916,935,936,938,951,kpasswd_listen:20,kpasswd_port:20,kpasswd_serv:21,29,39,kpclientauth:20,kpkdc:21,kprop:1,4,6,8,15,23,24,34,35,901,915,916,917,951,kprop_path:4,kprop_port:4,915,951,kpropd:1,4,7,9,23,34,41,901,915,916,kpropd_rpc:917,kproplog:1,8,917,kpserverauth:21,37,krb4:916,krb524:21,krb524_convert_creds_kdc:787,krb524_init_et:787,krb524_krb4_disabl:51,krb5:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,22,23,24,25,26,27,28,29,30,31,32,33,35,36,37,38,39,40,41,42,43,44,45,46,47,49,50,51,52,53,54,55,56,57,58,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,206,207,208,209,210,211,212,213,214,215,216,217,218,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,270,271,272,273,274,275,276,277,278,279,280,281,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,788,789,790,791,792,793,794,795,796,797,798,799,800,801,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,944,945,946,947,948,949,950,951,krb5_425_conv_princip:48,krb5_524_conv_princip:48,krb5_524_convert_cr:48,788,krb5_address:52,53,54,64,82,84,172,198,232,233,234,240,332,802,822,823,824,830,831,838,844,krb5_address_compar:48,krb5_address_ord:48,krb5_address_search:48,krb5_addrtyp:802,803,krb5_allow_weak_crypto:48,krb5_altauth_att_challenge_respons:787,krb5_aname_to_localnam:48,916,930,krb5_anonymous_princip:48,krb5_anonymous_princstr:57,787,krb5_anonymous_realm:48,krb5_anonymous_realmstr:58,787,krb5_ap_rep:787,802,krb5_ap_rep_enc_part:48,357,375,802,krb5_ap_req:787,802,krb5_appdefault_boolean:48,60,krb5_appdefault_str:48,59,krb5_as_rep:787,843,krb5_as_req:787,844,krb5_auth_con_fre:48,78,krb5_auth_con_genaddr:48,82,84,krb5_auth_con_get_checksum_func:48,krb5_auth_con_getaddr:44,48,krb5_auth_con_getauthent:48,krb5_auth_con_getflag:48,krb5_auth_con_getkei:48,krb5_auth_con_getkey_k:48,krb5_auth_con_getlocalseqnumb:48,krb5_auth_con_getlocalsubkei:48,krb5_auth_con_getrcach:48,krb5_auth_con_getrecvsubkei:48,75,krb5_auth_con_getrecvsubkey_k:48,krb5_auth_con_getremoteseqnumb:48,krb5_auth_con_getremotesubkei:48,krb5_auth_con_getsendsubkei:48,70,krb5_auth_con_getsendsubkey_k:48,krb5_auth_con_init:48,61,krb5_auth_con_initivector:48,krb5_auth_con_set_checksum_func:48,krb5_auth_con_set_req_cksumtyp:48,krb5_auth_con_setaddr:44,48,krb5_auth_con_setflag:48,78,krb5_auth_con_setport:44,48,krb5_auth_con_setrcach:48,krb5_auth_con_setrecvsubkei:44,48,krb5_auth_con_setrecvsubkey_k:48,krb5_auth_con_setsendsubkei:44,48,krb5_auth_con_setsendsubkey_k:48,krb5_auth_con_setuseruserkei:48,359,krb5_auth_context:48,62,63,64,65,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,84,85,86,87,88,89,90,223,323,325,326,327,328,329,330,331,354,356,357,358,359,360,363,364,375,802,854,krb5_auth_context_do_sequ:66,69,74,83,325,326,327,331,356,360,787,krb5_auth_context_do_tim:66,78,83,325,326,331,356,360,787,krb5_auth_context_generate_local_addr:62,787,krb5_auth_context_generate_local_full_addr:62,787,krb5_auth_context_generate_remote_addr:62,787,krb5_auth_context_generate_remote_full_addr:62,787,krb5_auth_context_permit_al:787,krb5_auth_context_ret_sequ:66,83,325,326,327,331,354,356,360,787,krb5_auth_context_ret_tim:66,83,325,326,331,354,356,360,787,krb5_auth_context_use_subkei:787,krb5_authdata:173,184,189,195,200,320,322,412,802,811,824,831,844,krb5_authdata_and_or:787,krb5_authdata_ap_opt:787,krb5_authdata_auth_ind:787,krb5_authdata_cammac:787,krb5_authdata_etype_negoti:787,krb5_authdata_fx_armor:787,krb5_authdata_if_relev:787,krb5_authdata_initial_verified_ca:787,krb5_authdata_kdc_issu:787,krb5_authdata_mandatory_for_kdc:787,krb5_authdata_osf_dc:787,krb5_authdata_sesam:787,krb5_authdata_signticket:787,krb5_authdata_win2k_pac:787,krb5_authdatatyp:184,189,195,802,809,krb5_authent:48,65,802,884,krb5_bad_enctyp:116,286,krb5_boolean:52,54,55,105,109,110,127,128,129,130,160,192,253,283,284,285,298,299,300,319,341,343,348,349,350,362,388,802,824,836,858,krb5_build_princip:46,47,48,92,krb5_build_principal_alloc_va:47,48,91,94,krb5_build_principal_ext:47,48,krb5_build_principal_va:48,krb5_c_:186,188,190,191,196,197,281,351,353,411,krb5_c_block_siz:48,krb5_c_checksum_length:48,168,krb5_c_crypto_length:48,krb5_c_crypto_length_iov:48,krb5_c_decrypt:48,287,krb5_c_decrypt_iov:48,103,288,krb5_c_derive_prfplu:48,916,krb5_c_encrypt:48,krb5_c_encrypt_iov:48,290,krb5_c_encrypt_length:48,102,289,krb5_c_enctype_compar:48,krb5_c_free_stat:48,krb5_c_fx_cf2_simpl:48,krb5_c_init_st:48,krb5_c_is_coll_proof_cksum:48,krb5_c_is_keyed_cksum:48,krb5_c_keyed_checksum_typ:48,krb5_c_keylength:48,124,krb5_c_make_checksum:48,131,294,krb5_c_make_checksum_iov:48,130,295,krb5_c_make_random_kei:48,krb5_c_padding_length:48,krb5_c_prf:48,119,296,krb5_c_prf_length:48,117,krb5_c_prfplu:48,916,krb5_c_random_add_entropi:48,krb5_c_random_make_octet:48,krb5_c_random_os_entropi:48,krb5_c_random_se:48,krb5_c_random_to_kei:48,krb5_c_string_to_kei:48,126,393,krb5_c_string_to_key_with_param:48,krb5_c_valid_cksumtyp:48,krb5_c_valid_enctyp:48,krb5_c_verify_checksum:48,113,294,298,413,krb5_c_verify_checksum_iov:48,114,299,krb5_calculate_checksum:48,krb5_cc_badnam:223,krb5_cc_cache_match:48,krb5_cc_close:48,132,154,164,krb5_cc_copy_cr:48,krb5_cc_cursor:139,150,158,802,krb5_cc_default:48,krb5_cc_default_nam:48,135,156,krb5_cc_destroi:48,krb5_cc_dup:48,krb5_cc_end_seq_get:48,158,krb5_cc_gen_new:48,krb5_cc_get_config:48,krb5_cc_get_flag:48,krb5_cc_get_full_nam:48,krb5_cc_get_nam:48,krb5_cc_get_princip:47,48,krb5_cc_get_typ:48,krb5_cc_initi:48,145,krb5_cc_move:48,krb5_cc_new_uniqu:48,krb5_cc_next_cr:48,139,158,krb5_cc_nosupp:151,krb5_cc_notfound:132,154,165,krb5_cc_remove_cr:48,916,krb5_cc_resolv:48,144,krb5_cc_retrieve_cr:48,151,krb5_cc_select:48,krb5_cc_set_config:44,48,283,krb5_cc_set_default_nam:48,136,krb5_cc_set_flag:48,krb5_cc_start_seq_get:48,139,150,krb5_cc_store_cr:48,krb5_cc_support_switch:48,krb5_cc_switch:48,krb5_ccach:132,133,134,135,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,157,158,159,161,164,223,224,225,226,232,233,234,246,250,251,264,267,329,375,383,403,414,802,krb5_ccache_conf_data:908,krb5_cccol:918,krb5_cccol_cursor:162,163,164,802,krb5_cccol_cursor_fre:48,163,164,krb5_cccol_cursor_new:48,162,164,krb5_cccol_cursor_next:48,162,163,krb5_cccol_have_cont:48,krb5_cccol_last_change_tim:44,krb5_ccselect_moddata:918,krb5_ccselect_vt:921,krb5_certauth_hwauth:919,krb5_certauth_hwauth_pass:919,krb5_change_password:48,169,krb5_check_clockskew:48,krb5_checksum:48,113,129,131,294,298,413,802,811,859,krb5_checksum_s:48,krb5_chpw_fail:260,krb5_chpw_messag:48,krb5_chpw_pwdnull:260,krb5_cksumtyp:81,96,109,110,111,113,114,127,130,131,168,170,204,294,295,299,390,413,802,816,krb5_cksumtype_to_str:48,krb5_clear_error_messag:48,krb5_client_ktnam:15,898,915,951,krb5_clpreauth_moddata:920,krb5_clpreauth_modreq:920,krb5_config:21,34,915,916,951,krb5_config_cantopen:50,krb5_config_notenufspac:56,306,krb5_const:787,krb5_const_point:131,186,190,413,802,krb5_const_princip:50,56,57,141,155,182,283,300,301,310,320,340,341,342,343,347,348,349,350,359,362,388,406,407,408,409,802,krb5_context:46,48,49,50,51,52,53,54,55,56,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,171,172,173,174,175,177,178,179,180,181,182,183,184,186,188,189,190,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,245,246,247,248,250,251,252,253,257,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,375,376,377,379,380,381,382,383,384,386,387,388,389,393,396,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,417,418,419,420,802,836,854,863,864,870,875,886,921,krb5_copy_address:48,krb5_copy_authdata:48,krb5_copy_authent:48,krb5_copy_checksum:48,krb5_copy_context:48,krb5_copy_cr:48,krb5_copy_data:48,863,864,krb5_copy_error_messag:48,krb5_copy_keyblock:48,krb5_copy_keyblock_cont:48,krb5_copy_princip:47,48,krb5_copy_ticket:48,krb5_cred:46,48,51,150,151,153,159,166,220,224,225,226,232,233,234,235,260,264,267,272,323,325,330,354,375,382,401,403,414,787,802,krb5_cred_enc_part:802,821,krb5_cred_info:802,822,krb5_crypto_iov:98,100,103,114,130,288,290,295,299,802,krb5_crypto_typ:97,825,krb5_crypto_type_checksum:114,130,295,299,787,krb5_crypto_type_data:114,130,295,299,787,krb5_crypto_type_empti:787,krb5_crypto_type_head:787,krb5_crypto_type_pad:787,krb5_crypto_type_sign_onli:98,114,130,295,299,787,krb5_crypto_type_stream:787,krb5_crypto_type_trail:787,krb5_cryptotyp:97,802,825,krb5_cybersafe_secureid:787,krb5_data:48,58,59,60,99,100,101,102,103,106,108,113,117,119,120,121,123,124,125,126,129,141,155,166,169,185,223,229,230,258,265,279,284,287,288,289,290,294,296,298,321,323,324,325,326,327,328,329,330,331,333,335,340,341,347,354,355,356,357,358,359,360,364,375,382,383,393,404,405,802,819,824,825,829,834,838,854,859,863,864,866,867,868,880,888,893,krb5_db_entri:919,krb5_decode_authdata_contain:48,189,krb5_decode_ticket:48,krb5_decrypt:48,krb5_deltat:187,235,256,259,260,275,391,802,838,krb5_deltat_badformat:391,krb5_deltat_to_str:48,krb5_domain_x500_compress:787,krb5_eblock_enctyp:48,krb5_enc_data:99,102,287,289,802,805,807,821,843,844,881,krb5_enc_kdc_rep_part:802,843,krb5_enc_tkt_part:300,301,802,881,krb5_encode_authdata_contain:48,184,krb5_encpadata_req_enc_pa_rep:787,krb5_encrypt:48,krb5_encrypt_block:186,188,190,196,197,281,351,353,393,411,802,krb5_encrypt_s:48,krb5_enctyp:95,97,98,101,104,105,111,112,115,116,118,124,125,126,128,188,191,192,193,211,229,232,233,234,244,261,280,292,310,315,378,392,411,802,829,832,838,844,846,krb5_enctype_to_nam:48,krb5_enctype_to_str:48,krb5_end_seq_get:150,krb5_error:212,273,324,355,375,787,802,krb5_error_cod:46,49,50,55,56,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,129,130,131,132,133,134,135,137,138,139,140,141,142,143,145,147,148,149,150,151,152,153,154,155,156,157,158,159,161,162,163,164,165,166,167,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,186,187,189,190,192,193,194,195,196,197,214,217,223,224,225,226,227,228,229,230,231,232,233,234,235,236,238,245,246,247,248,250,251,252,253,257,260,261,262,264,265,266,267,268,269,271,272,273,274,275,276,277,278,279,280,281,282,286,287,288,289,290,293,294,295,296,298,299,300,301,302,303,304,305,306,307,308,309,310,311,313,314,315,316,317,318,320,321,322,323,324,325,326,327,328,329,330,331,332,333,335,336,337,338,339,340,341,342,343,344,345,346,347,351,352,353,354,355,356,357,358,359,360,361,363,364,368,369,371,372,373,374,375,376,377,378,379,382,383,384,385,386,387,389,390,391,392,393,394,395,396,397,398,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,417,418,419,420,802,853,854,863,864,870,875,921,krb5_euid:899,krb5_expand_hostnam:48,krb5_expire_callback_func:245,802,krb5_fast_requir:248,787,krb5_fcc_intern:135,krb5_fences_vt:921,krb5_fences_vtable_v2:921,krb5_find_authdata:48,krb5_finish_kei:48,krb5_finish_random_kei:48,krb5_flag:142,151,153,157,224,225,226,232,233,234,238,248,269,329,330,359,375,403,802,807,823,824,830,831,838,844,877,884,892,krb5_free_address:48,172,332,krb5_free_ap_rep_enc_part:48,357,375,krb5_free_authdata:48,173,195,322,krb5_free_authent:48,65,174,krb5_free_checksum:48,175,krb5_free_checksum_cont:48,113,294,krb5_free_cksumtyp:48,111,krb5_free_context:48,136,176,268,282,krb5_free_cr:48,177,224,375,405,krb5_free_cred_cont:46,48,150,153,272,401,krb5_free_data:48,178,321,krb5_free_data_cont:48,141,229,324,325,326,327,328,329,330,331,335,356,360,krb5_free_default_realm:48,227,krb5_free_enctyp:48,261,krb5_free_error:48,355,375,krb5_free_error_messag:48,228,krb5_free_host_realm:48,230,231,krb5_free_keyblock:48,67,72,76,180,280,315,krb5_free_keyblock_cont:48,115,125,126,181,krb5_free_keytab_entry_cont:48,309,310,krb5_free_princip:46,47,48,49,91,92,93,145,154,182,344,345,389,krb5_free_str:48,143,169,194,krb5_free_tgt_cr:48,354,krb5_free_ticket:48,183,359,363,krb5_free_unparsed_nam:48,406,408,krb5_fwd_tgt_cred:48,krb5_gc:403,krb5_gc_cach:224,787,krb5_gc_canonic:787,krb5_gc_constrained_deleg:787,krb5_gc_forward:787,krb5_gc_no_stor:787,krb5_gc_no_transit_check:787,krb5_gc_user_us:224,787,krb5_generate_seq_numb:327,krb5_get_credenti:48,375,380,381,403,krb5_get_credentials_renew:48,krb5_get_credentials_valid:48,krb5_get_default_realm:48,krb5_get_error_messag:48,835,krb5_get_etype_info:48,916,krb5_get_fallback_host_realm:48,krb5_get_host_realm:48,389,krb5_get_in_tkt_with_keytab:48,krb5_get_in_tkt_with_password:48,krb5_get_in_tkt_with_skei:48,krb5_get_init_cr:234,250,251,krb5_get_init_creds_keytab:48,232,krb5_get_init_creds_opt:46,229,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,275,802,krb5_get_init_creds_opt_address_list:787,krb5_get_init_creds_opt_alloc:46,48,237,239,krb5_get_init_creds_opt_anonym:787,krb5_get_init_creds_opt_canonic:787,krb5_get_init_creds_opt_chg_pwd_prmpt:787,krb5_get_init_creds_opt_etype_list:787,krb5_get_init_creds_opt_forward:787,krb5_get_init_creds_opt_fre:46,48,236,krb5_get_init_creds_opt_get_fast_flag:48,krb5_get_init_creds_opt_init:48,krb5_get_init_creds_opt_preauth_list:787,krb5_get_init_creds_opt_proxi:787,krb5_get_init_creds_opt_renew_lif:787,krb5_get_init_creds_opt_salt:787,krb5_get_init_creds_opt_set_address_list:48,krb5_get_init_creds_opt_set_anonym:46,48,krb5_get_init_creds_opt_set_canonic:48,krb5_get_init_creds_opt_set_change_password_prompt:48,krb5_get_init_creds_opt_set_etype_list:48,229,krb5_get_init_creds_opt_set_expire_callback:48,krb5_get_init_creds_opt_set_fast_ccach:48,krb5_get_init_creds_opt_set_fast_ccache_nam:48,229,246,krb5_get_init_creds_opt_set_fast_flag:48,247,krb5_get_init_creds_opt_set_forward:48,krb5_get_init_creds_opt_set_in_ccach:48,krb5_get_init_creds_opt_set_out_ccach:48,krb5_get_init_creds_opt_set_pa:48,254,krb5_get_init_creds_opt_set_pac_request:48,krb5_get_init_creds_opt_set_preauth_list:48,krb5_get_init_creds_opt_set_proxi:48,krb5_get_init_creds_opt_set_renew_lif:48,krb5_get_init_creds_opt_set_respond:46,48,krb5_get_init_creds_opt_set_salt:48,254,krb5_get_init_creds_opt_set_tkt_lif:46,48,krb5_get_init_creds_opt_tkt_lif:787,krb5_get_init_creds_password:46,48,233,243,245,352,916,krb5_get_permitted_enctyp:48,krb5_get_profil:48,krb5_get_prompt_typ:46,48,krb5_get_renewed_cr:48,225,krb5_get_server_rcach:48,krb5_get_time_offset:48,krb5_get_validated_cr:48,226,krb5_gic_opt_pa_data:802,krb5_init_context:48,205,krb5_init_context_kdc:269,787,krb5_init_context_profil:48,krb5_init_context_secur:269,787,krb5_init_creds_context:270,271,272,273,274,275,276,277,278,279,802,krb5_init_creds_fre:48,275,krb5_init_creds_get:48,272,274,275,krb5_init_creds_get_cr:48,271,krb5_init_creds_get_error:48,krb5_init_creds_get_tim:48,krb5_init_creds_init:48,270,271,279,352,krb5_init_creds_set_keytab:48,krb5_init_creds_set_password:48,krb5_init_creds_set_servic:48,krb5_init_creds_step:48,272,274,275,916,krb5_init_creds_step_flag_continu:279,787,krb5_init_keyblock:48,krb5_init_random_kei:48,krb5_init_secure_context:48,205,268,916,krb5_int16:802,krb5_int16_max:567,787,krb5_int16_min:787,krb5_int32:66,69,74,83,266,363,364,374,385,389,394,410,802,804,806,810,811,817,819,822,826,828,830,833,834,835,837,844,849,852,865,866,867,869,873,877,879,880,883,889,krb5_int32_max:569,787,krb5_int32_min:787,krb5_invalid_princip:50,krb5_is_config_princip:47,48,krb5_is_referral_realm:48,krb5_is_thread_saf:48,krb5_k:845,krb5_k_create_kei:48,krb5_k_decrypt:48,krb5_k_decrypt_iov:48,290,krb5_k_encrypt:48,krb5_k_encrypt_iov:48,288,krb5_k_free_kei:48,68,73,77,286,krb5_k_key_enctyp:48,krb5_k_key_keyblock:48,krb5_k_make_checksum:48,113,krb5_k_make_checksum_iov:48,114,299,krb5_k_prf:48,krb5_k_reference_kei:48,krb5_k_verify_checksum:48,129,krb5_k_verify_checksum_iov:48,130,295,krb5_kdc_profil:10,20,34,915,916,951,krb5_kdc_rep:232,233,234,802,krb5_kdc_req:802,krb5_kdc_sign_ticket:48,340,341,krb5_kdc_unreach:260,krb5_kdc_verify_ticket:48,krb5_kdcpolicy_moddata:928,krb5_kdcpreauth_moddata:929,krb5_kdcpreauth_modreq:929,krb5_kdcrep_modifi:267,krb5_kdcrep_skew:267,krb5_kei:48,68,73,77,87,89,287,288,289,290,291,294,295,296,297,298,299,802,krb5_key_st:845,krb5_keyblock:48,67,70,72,75,76,86,88,90,99,100,101,102,103,106,107,108,113,114,115,117,119,124,125,126,129,130,180,181,234,281,286,293,300,301,315,320,340,341,342,343,351,353,393,412,802,806,811,823,824,830,831,832,848,krb5_keytab:232,235,276,302,303,304,305,307,308,310,311,312,313,314,316,317,318,359,363,364,376,414,802,krb5_keytab_entri:217,302,309,310,314,316,802,krb5_keytab_entry_st:848,krb5_keyusag:99,100,102,103,108,113,114,129,130,287,288,289,290,294,295,298,299,802,krb5_keyusage_ad_it:787,krb5_keyusage_ad_kdcissued_cksum:787,krb5_keyusage_ad_mt:787,krb5_keyusage_ad_signedpath:787,krb5_keyusage_ap_rep_encpart:787,krb5_keyusage_ap_req_auth:787,krb5_keyusage_ap_req_auth_cksum:787,krb5_keyusage_app_data_cksum:787,krb5_keyusage_app_data_encrypt:787,krb5_keyusage_as_rep_encpart:787,krb5_keyusage_as_req:787,krb5_keyusage_as_req_pa_enc_t:787,krb5_keyusage_cammac:787,krb5_keyusage_enc_challenge_cli:787,krb5_keyusage_enc_challenge_kdc:787,krb5_keyusage_fast_enc:787,krb5_keyusage_fast_finish:787,krb5_keyusage_fast_rep:787,krb5_keyusage_fast_req_chksum:787,krb5_keyusage_gss_tok_m:787,krb5_keyusage_gss_tok_wrap_integ:787,krb5_keyusage_gss_tok_wrap_priv:787,krb5_keyusage_iakerb_finish:787,krb5_keyusage_kdc_rep_ticket:787,krb5_keyusage_krb_cred_encpart:787,krb5_keyusage_krb_error_cksum:787,krb5_keyusage_krb_priv_encpart:787,krb5_keyusage_krb_safe_cksum:787,krb5_keyusage_pa_as_fresh:787,krb5_keyusage_pa_fx_cooki:787,krb5_keyusage_pa_otp_request:787,krb5_keyusage_pa_pkinit_kx:787,krb5_keyusage_pa_s4u_x509_user_repli:606,787,krb5_keyusage_pa_s4u_x509_user_request:605,787,krb5_keyusage_pa_sam_challenge_cksum:787,krb5_keyusage_pa_sam_challenge_trackid:603,787,krb5_keyusage_pa_sam_respons:602,787,krb5_keyusage_spak:787,krb5_keyusage_tgs_rep_encpart_sesskei:787,krb5_keyusage_tgs_rep_encpart_subkei:787,krb5_keyusage_tgs_req_ad_sesskei:787,krb5_keyusage_tgs_req_ad_subkei:787,krb5_keyusage_tgs_req_auth:787,krb5_keyusage_tgs_req_auth_cksum:787,krb5_kpasswd_accessdeni:787,krb5_kpasswd_autherror:166,787,krb5_kpasswd_bad_vers:787,krb5_kpasswd_harderror:166,787,krb5_kpasswd_initial_flag_need:787,krb5_kpasswd_malform:166,787,krb5_kpasswd_softerror:166,787,krb5_kpasswd_success:166,382,787,krb5_kt_add_entri:48,krb5_kt_client_default:48,krb5_kt_close:48,317,krb5_kt_cursor:308,314,318,802,krb5_kt_default:48,krb5_kt_default_nam:48,krb5_kt_dup:48,krb5_kt_end:314,krb5_kt_end_seq_get:48,318,krb5_kt_free_entri:48,314,krb5_kt_get_entri:48,krb5_kt_get_nam:48,krb5_kt_get_typ:48,krb5_kt_have_cont:48,krb5_kt_name_toolong:311,krb5_kt_next_entri:48,krb5_kt_notfound:313,krb5_kt_nowrit:302,316,krb5_kt_read_service_kei:48,krb5_kt_remove_entri:48,krb5_kt_resolv:48,krb5_kt_start_seq_get:48,308,krb5_ktname:43,898,915,951,krb5_kuserok:47,48,916,930,krb5_kvno:310,315,802,829,848,krb5_last_req_entri:802,830,krb5_libos_badpwdmatch:260,361,krb5_libos_pwdintr:260,krb5_lname_no_tran:930,krb5_lname_notran:56,krb5_lrq_all_acct_exptim:787,krb5_lrq_all_last_initi:787,krb5_lrq_all_last_renew:787,krb5_lrq_all_last_req:787,krb5_lrq_all_last_tgt:787,krb5_lrq_all_last_tgt_issu:787,krb5_lrq_all_pw_exptim:787,krb5_lrq_none:787,krb5_lrq_one_acct_exptim:787,krb5_lrq_one_last_initi:787,krb5_lrq_one_last_renew:787,krb5_lrq_one_last_req:787,krb5_lrq_one_last_tgt:787,krb5_lrq_one_last_tgt_issu:787,krb5_lrq_one_pw_exptim:787,krb5_magic:802,803,805,806,807,809,811,816,819,821,822,823,824,827,829,830,831,832,834,843,844,846,848,852,857,866,867,871,880,881,884,888,889,893,krb5_make_authdata_kdc_issu:48,krb5_marshal_credenti:48,krb5_merge_authdata:48,krb5_mk_1cred:48,krb5_mk_error:48,krb5_mk_ncred:48,323,krb5_mk_priv:48,79,krb5_mk_rep:48,krb5_mk_rep_dc:48,krb5_mk_req:48,80,81,330,krb5_mk_req_checksum_func:63,80,802,krb5_mk_req_extend:48,329,krb5_mk_safe:48,326,krb5_msgtype:503,504,505,506,531,543,716,739,757,758,802,830,843,844,krb5_no_2nd_tkt:267,krb5_no_tkt_suppli:223,267,krb5_nt_ent_principal_and_id:787,krb5_nt_enterprise_princip:787,krb5_nt_ms_princip:787,krb5_nt_ms_principal_and_id:787,krb5_nt_princip:91,93,344,787,krb5_nt_smtp_name:787,krb5_nt_srv_hst:223,389,787,krb5_nt_srv_inst:91,93,344,787,krb5_nt_srv_xhst:787,krb5_nt_uid:787,krb5_nt_unknown:389,787,krb5_nt_wellknown:91,93,344,787,krb5_nt_x500_princip:787,krb5_octet:802,803,809,816,846,857,880,888,889,krb5_os_localaddr:48,krb5_pa_data:802,830,843,844,krb5_pa_pac_req:802,krb5_pa_server_referral_data:802,krb5_pa_svr_referral_data:802,krb5_pac:300,301,333,334,335,336,337,338,339,340,341,342,343,802,krb5_pac_add_buff:48,krb5_pac_attributes_info:787,krb5_pac_client_claim:787,krb5_pac_client_info:333,787,krb5_pac_credentials_info:333,787,krb5_pac_data:861,krb5_pac_delegation_info:333,787,krb5_pac_device_claim:787,krb5_pac_device_info:787,krb5_pac_fre:48,338,339,krb5_pac_get_buff:48,krb5_pac_get_client_info:48,916,krb5_pac_get_typ:48,krb5_pac_init:48,krb5_pac_logon_info:333,787,krb5_pac_pars:48,krb5_pac_privsvr_checksum:333,787,krb5_pac_requestor:787,krb5_pac_server_checksum:333,787,krb5_pac_sign:48,krb5_pac_sign_ext:48,krb5_pac_ticket_checksum:787,krb5_pac_upn_dns_info:333,787,krb5_pac_verifi:48,343,krb5_pac_verify_ext:48,301,krb5_padata_afs3_salt:787,krb5_padata_ap_req:702,787,krb5_padata_as_checksum:787,krb5_padata_as_fresh:787,krb5_padata_enc_sandia_securid:787,krb5_padata_enc_timestamp:787,krb5_padata_enc_unix_tim:787,krb5_padata_encrypted_challeng:787,krb5_padata_etype_info2:787,krb5_padata_etype_info:787,krb5_padata_for_us:787,krb5_padata_fx_cooki:787,krb5_padata_fx_error:787,krb5_padata_fx_fast:787,krb5_padata_get_from_typed_data:787,krb5_padata_non:787,krb5_padata_osf_dc:787,krb5_padata_otp_challeng:787,krb5_padata_otp_pin_chang:787,krb5_padata_otp_request:787,krb5_padata_pac_opt:787,krb5_padata_pac_request:787,krb5_padata_pk_as_rep:787,krb5_padata_pk_as_rep_old:787,krb5_padata_pk_as_req:787,krb5_padata_pk_as_req_old:787,krb5_padata_pkinit_kx:787,krb5_padata_pw_salt:787,krb5_padata_redhat_idp_oauth2:787,krb5_padata_referr:787,krb5_padata_s4u_x509_us:787,krb5_padata_sam_challeng:787,krb5_padata_sam_challenge_2:787,krb5_padata_sam_redirect:787,krb5_padata_sam_respons:787,krb5_padata_sam_response_2:787,krb5_padata_sesam:787,krb5_padata_spak:787,krb5_padata_svr_referral_info:787,krb5_padata_tgs_req:787,krb5_padata_use_specified_kvno:787,krb5_parse_nam:46,47,48,345,406,krb5_parse_name_flag:47,48,krb5_plugin_no_handl:923,926,930,931,krb5_plugin_ver_notsupp:921,krb5_plugin_vt:921,krb5_pointer:186,190,197,281,315,353,363,364,375,802,813,850,krb5_post_recv_fn:380,802,krb5_pre_send_fn:381,802,krb5_preauth_fail:260,krb5_preauthtyp:232,233,234,254,802,838,857,krb5_prepend_error_messag:48,417,916,krb5_princ_compon:787,krb5_princ_nam:787,krb5_princ_nomatch:223,267,krb5_princ_realm:787,krb5_princ_set_realm:787,krb5_princ_set_realm_data:787,krb5_princ_set_realm_length:787,krb5_princ_siz:787,791,krb5_princ_typ:787,krb5_princip:46,47,48,49,91,92,93,94,132,145,147,154,182,218,223,229,235,260,264,267,275,315,319,363,364,375,382,383,384,389,412,414,802,811,823,824,830,831,834,843,844,848,859,860,881,krb5_principal2salt:48,krb5_principal_compar:47,48,349,350,388,krb5_principal_compare_any_realm:47,48,krb5_principal_compare_casefold:350,787,krb5_principal_compare_enterpris:350,787,krb5_principal_compare_flag:47,48,krb5_principal_compare_ignore_realm:350,787,krb5_principal_compare_utf8:350,787,krb5_principal_data:47,802,819,866,krb5_principal_parse_enterpris:345,787,krb5_principal_parse_ignore_realm:345,787,krb5_principal_parse_no_def_realm:787,krb5_principal_parse_no_realm:345,787,krb5_principal_parse_require_realm:345,787,krb5_principal_unparse_displai:408,787,krb5_principal_unparse_no_realm:408,787,krb5_principal_unparse_short:408,787,krb5_priv:787,krb5_process_kei:48,krb5_prog_etype_nosupp:378,krb5_prompt:352,802,870,krb5_prompt_typ:263,802,krb5_prompt_type_new_password:263,787,krb5_prompt_type_new_password_again:263,787,krb5_prompt_type_password:263,787,krb5_prompt_type_preauth:263,787,krb5_prompter_fct:260,275,802,krb5_prompter_posix:46,48,krb5_prop:15,34,41,krb5_pvno:787,krb5_pwd_data:802,krb5_pwqual_moddata:933,krb5_random_kei:48,krb5_rc_close:265,krb5_rc_requir:323,325,krb5_rc_st:872,krb5_rcach:71,85,265,802,krb5_rd_cred:48,325,krb5_rd_error:48,krb5_rd_priv:48,79,873,krb5_rd_rep:48,krb5_rd_rep_dc:48,krb5_rd_req:48,krb5_rd_safe:48,873,krb5_read_error:48,krb5_read_password:48,krb5_realm_branch_char:787,krb5_realm_cant_resolv:260,krb5_realm_compar:47,48,krb5_recvauth:48,364,375,krb5_recvauth_badauthv:787,krb5_recvauth_skip_vers:787,krb5_recvauth_vers:48,krb5_referral_realm:48,787,krb5_replay_data:323,325,326,331,354,356,360,802,krb5_responder_context:46,365,366,367,368,369,370,371,372,373,802,875,krb5_responder_context_st:874,krb5_responder_fn:257,802,874,krb5_responder_get_challeng:46,48,366,874,krb5_responder_list_quest:46,48,874,krb5_responder_otp_challeng:46,367,368,802,krb5_responder_otp_challenge_fre:46,48,368,krb5_responder_otp_flags_collect_pin:729,787,krb5_responder_otp_flags_collect_token:787,krb5_responder_otp_flags_nextotp:787,krb5_responder_otp_flags_separate_pin:787,krb5_responder_otp_format_alphanumer:787,krb5_responder_otp_format_decim:787,krb5_responder_otp_format_hexadecim:787,krb5_responder_otp_get_challeng:46,48,krb5_responder_otp_set_answ:46,48,krb5_responder_otp_tokeninfo:802,876,krb5_responder_pkinit_challeng:46,370,371,802,krb5_responder_pkinit_challenge_fre:48,371,krb5_responder_pkinit_flags_token_:738,krb5_responder_pkinit_flags_token_user_pin_count_low:787,krb5_responder_pkinit_flags_token_user_pin_final_tri:787,krb5_responder_pkinit_flags_token_user_pin_lock:787,krb5_responder_pkinit_get_challeng:46,48,krb5_responder_pkinit_ident:802,878,krb5_responder_pkinit_set_answ:46,48,krb5_responder_question_otp:46,48,787,krb5_responder_question_password:46,787,krb5_responder_question_pkinit:46,48,787,krb5_responder_set_answ:46,48,366,874,krb5_respons:802,krb5_roundup:787,krb5_safe:787,krb5_salttype_to_str:48,krb5_sam_must_pk_encrypt_sad:787,krb5_sam_send_encrypted_sad:787,krb5_sam_use_sad_as_kei:787,krb5_sendauth:48,363,krb5_server_decrypt_ticket_keytab:48,krb5_set_default_realm:44,48,krb5_set_default_tgs_enctyp:48,261,krb5_set_error_messag:48,krb5_set_kdc_recv_hook:48,krb5_set_kdc_send_hook:48,krb5_set_password:47,48,169,krb5_set_password_using_ccach:47,48,krb5_set_principal_realm:47,48,krb5_set_real_tim:48,krb5_set_trace_callback:48,krb5_set_trace_filenam:48,krb5_sname_match:47,48,359,krb5_sname_to_princip:47,48,krb5_string_to_cksumtyp:48,krb5_string_to_deltat:48,krb5_string_to_enctyp:48,krb5_string_to_kei:48,krb5_string_to_salttyp:48,krb5_string_to_timestamp:48,krb5_tc_match_2nd_tkt:153,787,krb5_tc_match_authdata:153,787,krb5_tc_match_flag:153,787,krb5_tc_match_flags_exact:153,787,krb5_tc_match_is_skei:153,787,krb5_tc_match_ktyp:153,787,krb5_tc_match_srv_nameonli:153,787,krb5_tc_match_tim:153,787,krb5_tc_match_times_exact:153,787,krb5_tc_noticket:787,krb5_tc_openclos:787,krb5_tc_supported_ktyp:153,787,krb5_tgs_name:787,krb5_tgs_name_s:787,krb5_tgs_rep:787,krb5_tgs_req:787,844,krb5_ticket:48,185,221,359,363,364,376,802,807,821,843,844,884,krb5_ticket_tim:274,402,802,823,824,830,831,krb5_timeofdai:48,krb5_timestamp:45,167,266,336,340,341,342,343,385,395,396,397,398,410,802,806,811,822,830,834,836,844,848,852,859,873,880,882,krb5_timestamp_to_sfstr:48,krb5_timestamp_to_str:48,krb5_tkt_authent:802,krb5_tkt_creds_context:399,400,401,402,403,404,802,krb5_tkt_creds_fre:48,403,krb5_tkt_creds_get:48,401,402,403,krb5_tkt_creds_get_cr:48,400,krb5_tkt_creds_get_tim:48,krb5_tkt_creds_init:48,400,krb5_tkt_creds_step:48,401,402,403,krb5_tkt_creds_step_flag_continu:404,787,krb5_trace:41,386,387,951,krb5_trace_callback:386,802,887,krb5_trace_info:386,802,886,krb5_trace_nosupp:386,387,krb5_transit:802,831,krb5_typed_data:802,krb5_ui_2:802,krb5_ui_4:333,335,337,358,802,806,811,834,873,krb5_unmarshal_credenti:48,krb5_unparse_nam:47,48,407,408,krb5_unparse_name_ext:48,krb5_unparse_name_flag:47,48,krb5_unparse_name_flags_ext:48,krb5_us_timeofdai:48,krb5_use_enctyp:48,krb5_verify_authdata_kdc_issu:48,krb5_verify_checksum:48,krb5_verify_init_cr:46,48,416,krb5_verify_init_creds_opt:46,414,415,416,802,krb5_verify_init_creds_opt_ap_req_nofail:787,krb5_verify_init_creds_opt_init:46,48,414,krb5_verify_init_creds_opt_set_ap_req_nofail:46,48,414,krb5_vprepend_error_messag:48,krb5_vset_error_messag:48,krb5_vwrap_error_messag:48,krb5_wellknown_namestr:787,krb5_wrap_error_messag:48,419,916,krb5_x:787,krb5_xc:787,krb5cc_1984:944,krb5cc_320:937,krb5cc_:915,944,951,krb5cc_p11795:937,krb5cc_ttypa:937,krb5ccname:15,136,895,939,940,941,944,951,krb5kdc:0,1,2,3,4,5,6,7,8,9,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,krb5kdc_err_key_exp:260,krb5kdc_err_more_preauth_data_requir:929,krb5krb_ap_err_skew:167,krb5krb_err_response_too_big:279,404,krb5lib:34,krb5plugin_service_locate_ft:931,krb5rcachedir:899,915,951,krb5rcachenam:899,951,krb5rcachetyp:899,951,krb5srv:39,krb:48,916,917,krb_ap_rep:48,krb_ap_req:48,krb_error:48,375,krbadmin:20,22,krbcanonicalnam:22,krbcontain:20,22,krbcore:934,krbdev:934,krbprincipalnam:22,krbtest:16,23,35,41,909,910,949,krbtgt:3,19,26,37,41,43,278,301,644,755,908,909,910,916,937,946,ksu:917,935,938,951,ksu_opt:944,kswitch:895,935,938,951,ktadd:14,32,34,898,kth:917,ktid:317,ktrem:3,15,ktutil:1,2,898,901,916,ktype:128,232,233,234,261,844,kungliga:917,kv5m_context:135,156,kvno:3,6,11,14,15,16,23,26,29,32,34,41,310,414,829,881,909,916,935,938,lab:5,23,917,label:21,917,laboratori:917,lack:37,378,916,lag:944,larg:20,23,24,34,36,39,46,100,103,119,288,290,902,916,larger:24,32,37,894,912,916,largest:35,last:3,6,9,20,23,24,35,44,48,173,198,200,220,245,314,322,386,733,852,895,896,919,928,last_fail:6,last_req:830,last_success:6,lastpwd:6,latenc:24,later:3,19,20,21,23,26,33,37,38,39,41,43,136,247,738,894,909,912,916,917,923,930,latest:34,224,882,902,916,937,latter:388,895,launchpad:42,law:917,lawsuit:917,lawyer:917,layer:916,922,925,layout:43,915,lcom_err:943,lcurs:904,ldap:3,4,5,6,10,20,22,35,38,904,916,917,ldap_conns_per_serv:20,ldap_kadmind_dn:5,20,22,23,ldap_kadmind_sasl_authcid:5,20,23,ldap_kadmind_sasl_authzid:20,ldap_kadmind_sasl_mech:20,ldap_kadmind_sasl_realm:20,ldap_kdc_dn:5,20,22,23,ldap_kdc_sasl_authcid:5,20,23,ldap_kdc_sasl_authzid:20,ldap_kdc_sasl_mech:20,22,ldap_kdc_sasl_realm:20,ldap_kerberos_container_dn:20,22,ldap_serv:20,22,ldap_service_password_fil:20,22,ldapadd:22,ldapi:20,22,24,ldapsasl_nocanon:38,ldapuri:3,5,23,ldb:904,ldflag:904,ldif:22,ldname:904,ldopt:904,lead:20,944,learn:15,least:15,23,32,34,39,99,102,153,165,287,289,407,733,750,912,926,930,leav:3,14,23,24,28,32,33,left:20,21,280,910,921,leg:916,legaci:26,46,883,legal:280,944,legitim:25,46,899,944,lehman:917,lehmann:917,len:12,118,337,339,length:3,20,23,33,43,46,48,91,92,99,100,102,103,116,117,119,124,191,203,209,244,254,260,280,284,287,288,289,290,311,336,339,361,397,736,796,797,803,809,816,819,827,846,857,866,867,877,889,908,909,912,913,922,942,lengthi:916,less:3,15,20,25,53,895,902,912,913,916,let:99,287,931,950,letter:34,39,937,level:3,5,10,23,25,37,39,43,902,906,932,liabil:917,liabl:917,lib:37,902,904,915,917,943,libdefault:15,20,26,28,33,34,38,39,40,41,43,44,895,898,899,932,libdir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,libedit:904,libera:934,libev:917,libk5crypto:916,libkdb5:919,libkdb_ldap:22,libkeyutil:904,libkrb5:21,28,43,894,916,libpam:42,librari:3,18,20,21,24,26,29,38,41,43,46,48,49,50,52,53,54,55,56,59,60,61,62,63,64,65,66,67,68,69,71,72,73,74,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,101,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,121,124,125,126,129,130,132,133,134,135,136,137,138,139,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,169,171,172,173,174,175,176,177,178,179,180,181,182,183,184,189,194,195,198,199,200,201,202,203,204,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,227,228,229,230,231,235,236,237,238,245,246,247,248,250,251,252,253,257,260,261,262,263,264,265,266,267,270,271,272,273,274,275,276,277,278,279,280,283,286,287,288,289,290,294,295,296,298,299,300,301,302,303,304,305,306,307,308,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,342,343,344,345,346,347,348,349,350,352,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,396,399,400,401,402,403,404,405,406,407,408,409,410,412,414,417,418,419,420,863,864,894,895,901,902,904,915,916,917,918,919,920,922,923,924,930,931,932,943,951,libtool:921,libverto:904,929,licens:903,904,907,916,life:3,5,19,23,940,lifetim:3,6,14,21,23,48,153,365,366,750,824,830,895,916,919,928,937,940,944,951,lightn:916,lightweight:901,like:3,6,8,12,14,15,19,21,23,32,33,34,37,38,39,41,43,192,895,899,900,902,904,906,921,925,937,likewis:944,limit:20,23,24,25,34,39,917,944,951,line:0,3,8,10,12,15,19,20,21,23,28,34,35,37,352,903,904,916,917,936,944,946,949,950,951,link:0,23,30,34,899,902,903,904,906,919,922,943,linkdn:3,23,linker:904,linux:895,904,916,list:0,2,3,4,6,10,14,15,19,21,26,28,32,34,36,39,40,43,46,48,93,153,164,184,189,195,214,230,231,320,378,412,417,418,419,831,874,895,904,905,915,917,919,920,923,929,932,936,937,941,944,949,950,list_mkei:23,list_princip:15,listen:4,8,10,20,34,39,916,listinfo:934,listpol:3,23,listprinc:3,23,liter:921,littl:922,live:6,15,921,lk5crypto:943,lkrb5:943,lmdb:20,24,904,916,lname:56,944,lndir:901,903,lnsize_in:56,lnsl:904,load:8,14,17,20,23,24,34,38,40,904,922,932,load_dump:6,23,loadabl:20,21,922,loader:904,local0:20,local7:20,local:3,5,8,12,14,15,20,21,22,23,28,32,34,36,39,43,46,48,62,64,80,230,231,325,326,327,329,331,344,356,359,360,389,398,408,523,524,715,896,899,900,901,904,906,908,909,910,915,916,923,924,936,937,940,941,943,944,946,951,local_addr:44,64,82,local_appdata:21,local_port:84,local_realm:944,localauth:916,924,localauth_plugin:930,localedir:904,localfr:28,localhost:15,localhostnam:43,localstatedir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,locat:4,7,8,10,15,19,20,21,22,24,25,29,34,39,41,43,48,895,899,904,905,913,915,916,917,924,932,937,939,940,941,943,944,945,946,951,locate_plugin:931,lock:6,20,23,24,34,35,734,735,913,916,937,lockdown_kei:3,19,23,916,lockit:3,lockout:3,20,23,24,25,30,lockout_polici:35,lockoutdur:3,23,35,lockouttim:3,23,log:8,9,23,24,26,28,33,34,37,39,46,48,735,895,916,924,936,937,939,944,950,951,log_:20,log_daemon:20,logic:39,916,login:20,21,33,38,41,46,937,944,951,logon:20,333,657,916,logout:937,939,longer:11,19,23,25,33,39,43,49,65,67,68,72,73,76,77,78,91,92,93,111,113,115,120,122,123,125,126,132,141,143,145,150,153,154,163,164,169,172,173,174,175,176,177,178,180,181,182,183,194,195,224,227,229,230,231,236,261,265,268,272,275,280,282,286,294,310,315,317,318,321,322,324,325,326,327,328,329,330,331,332,335,338,339,344,345,354,355,356,357,359,360,363,375,389,401,403,405,406,408,904,916,937,940,look:0,8,12,15,20,21,23,28,37,38,39,43,389,902,904,921,937,940,944,lookasid:904,lookup:21,22,33,38,39,194,813,904,916,931,lose:6,23,loss:23,917,lost:17,902,917,lot:39,lower:3,19,21,23,43,230,932,942,949,lowercas:23,38,899,lowest:21,lpr:20,lr_type:852,lr_type_interpretation_mask:787,lr_type_this_server_onli:787,lrealm:210,227,377,lsocket:904,lss:904,ltd:917,luke:39,luser:319,lxml:906,mac:901,mach:21,917,machin:4,8,12,14,15,17,18,21,31,32,34,37,38,39,895,900,904,936,937,950,951,maco:21,342,895,901,916,917,macro:421,887,944,made:8,21,23,34,41,136,253,269,378,895,916,917,925,927,945,951,magic:135,156,803,805,806,807,809,811,816,819,821,822,823,824,827,829,830,831,832,834,843,844,846,848,852,857,866,867,871,880,881,884,888,889,893,mai:3,6,8,10,11,14,15,19,20,21,22,23,24,25,26,28,33,34,35,36,37,38,39,40,41,43,46,99,107,126,158,195,224,228,229,241,245,258,262,287,330,359,375,380,381,388,389,414,729,845,863,875,887,896,899,902,904,905,908,909,912,913,916,917,920,922,923,925,926,927,928,929,932,934,936,937,939,940,944,949,951,mail:20,895,937,944,949,mailbox:899,mailman:934,main:368,371,934,maintain:0,9,15,20,23,902,904,951,mainten:3,6,23,maj_ver:921,major:43,903,921,make:0,3,6,12,14,15,17,20,21,22,23,25,26,28,32,33,34,35,37,39,41,43,48,112,236,241,250,301,368,371,403,894,902,903,904,906,908,916,917,922,936,940,945,makedepend:901,makefil:902,904,906,malform:166,223,619,908,malici:3,23,46,malloc:932,man:0,3,21,899,904,916,manag:5,19,23,33,916,932,935,951,mandatori:113,114,129,130,294,295,298,299,910,mandir:904,mani:3,17,21,23,28,35,39,41,925,937,951,manipul:22,23,45,825,898,manner:5,23,917,manual:0,6,10,15,23,33,34,902,904,916,manual_test:902,map:21,28,33,34,43,904,916,922,923,930,944,949,mapsiz:20,24,marc:917,mark:3,6,20,21,23,34,342,917,marker:908,916,markup:0,906,marshal:908,909,916,masachusett:951,mask:66,83,142,153,157,masquerad:17,936,937,massachusett:907,917,master:3,4,5,6,10,20,26,34,35,39,41,900,905,915,916,master_kdc:21,39,master_key_nam:5,6,20,23,master_key_typ:5,6,14,20,23,34,match:0,2,3,6,15,19,20,21,23,28,29,33,37,38,43,48,59,60,119,151,153,195,223,224,267,301,310,359,363,375,403,743,744,745,746,747,748,749,751,754,844,895,899,913,915,916,932,946,949,951,materi:14,46,916,917,921,matt:917,matter:17,21,max_keytab_name_len:787,max_lif:6,20,34,max_read:20,24,max_renew_lif:6,max_renewable_lif:20,34,max_renewable_ticket_lif:5,23,max_ticket_lif:5,23,maxfailur:3,23,35,maximum:3,5,6,10,14,15,20,21,23,24,33,39,46,311,361,894,929,937,940,maxlif:3,19,23,maxnumb:3,23,maxpathlen:764,maxrenewlif:3,5,19,23,maxtktlif:5,23,mcred:153,md4:26,917,md5:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,mdb:24,mean:3,12,14,20,21,23,33,34,37,46,900,905,917,937,944,951,meaning:3,23,meant:937,measur:25,894,mech:28,915,916,951,mech_typ:922,mechan:3,16,20,21,22,23,36,37,39,40,43,46,154,250,691,899,908,909,915,916,920,921,924,929,931,940,951,mechglu:917,922,media:5,21,23,medvinski:944,meet:949,megabyt:20,24,903,mellon:917,member:20,membership:46,memori:15,41,43,48,93,142,223,231,302,323,325,326,331,356,357,360,414,825,895,898,904,916,921,923,930,memset:46,mention:20,22,917,merchant:917,merg:18,20,48,917,messag:3,8,20,21,24,34,41,48,78,363,375,381,531,538,716,739,805,830,834,843,844,863,864,881,887,899,901,909,916,917,921,936,937,943,944,946,951,message_out:169,message_typ:880,met:917,944,metadata:6,method:21,25,39,230,908,916,918,919,920,921,923,926,927,928,929,930,931,932,933,940,mexico:917,mgluep:917,mic:532,916,mic_token:43,michigan:917,microsecond:266,385,410,806,822,873,908,microsoft:20,21,26,29,42,43,382,452,916,922,microsystem:917,middl:899,might:14,17,23,28,29,34,35,38,39,43,902,904,908,917,921,936,951,migrat:14,23,41,916,miller:917,951,min:3,19,23,896,min_ver:921,minclass:3,23,minim:6,14,23,24,916,minimum:3,20,23,33,minlength:3,23,minlif:3,23,minor:14,43,903,916,921,922,931,minor_statu:43,922,minu:20,913,minut:5,20,21,23,896,899,936,937,951,mismatch:43,260,342,936,miss:267,906,mission:944,mistak:936,mistakenli:171,mit1:909,mit:3,5,12,14,15,17,19,20,21,24,28,30,31,32,34,38,39,41,43,45,46,894,895,901,903,904,906,907,908,909,910,920,922,924,925,929,932,934,936,937,940,951,mitig:25,46,899,916,mitiys4k5:34,mix:937,mk_cmd:904,mk_req:854,mkdir:902,mkei:3,6,23,mkey_convert:6,23,mkey_fil:6,23,mkeynam:5,6,10,23,mkeytyp:5,6,23,mkeyvno:5,6,23,mkvno:6,modbi:6,mode:3,6,8,14,20,23,41,467,479,728,904,916,940,944,modern:14,15,23,38,modestli:40,modif:6,9,19,21,34,917,modifi:3,6,9,15,18,19,25,28,32,34,40,43,100,103,114,136,144,146,158,288,290,295,312,365,366,864,904,916,917,927,932,940,modify_princip:26,modnam:21,28,modpol:3,23,modprinc:3,23,35,37,40,926,modtim:6,modul:3,4,6,20,21,23,35,252,268,904,906,914,916,918,919,920,923,925,926,927,928,929,930,931,932,933,940,951,module_nam:21,modulenam:21,modulepath:21,modulo:913,moira:917,mon:3,23,35,monitor:25,month:896,916,more:6,14,15,19,20,21,22,23,25,29,32,34,35,37,38,39,41,43,46,262,279,344,404,565,736,738,759,887,895,898,899,901,904,905,909,916,923,929,934,936,951,more_preauth_data_requir:920,morn:33,most:2,6,17,20,21,23,24,25,26,28,33,34,37,39,40,41,43,48,154,895,898,899,901,916,920,921,922,937,939,951,mostli:904,move:20,27,34,48,msdn:916,msec_dirbit:787,msec_val_mask:787,msg:213,msg_type:830,843,844,mslsa:895,mssclogin:21,much:14,25,38,153,936,multi:35,37,916,multihom:21,multipl:3,10,14,15,16,20,21,22,23,24,28,34,35,36,37,39,43,46,845,895,899,902,916,921,922,929,940,949,951,multipli:35,multithread:48,muse:917,must:2,3,7,8,11,14,15,19,20,21,22,23,24,26,28,29,32,33,34,35,36,37,39,43,46,57,58,69,74,78,99,100,102,103,113,117,119,121,125,126,136,146,152,153,158,173,176,195,198,200,220,224,228,241,247,268,270,271,274,275,279,282,287,288,289,290,294,296,312,314,317,322,326,331,345,359,368,371,373,375,402,407,726,727,729,736,738,740,743,744,745,746,747,748,749,750,751,754,825,845,868,895,902,903,904,908,909,910,912,913,916,917,919,921,922,923,926,928,929,930,932,936,937,942,944,946,951,mutabl:845,mutex:845,mutual:34,330,375,437,503,805,940,944,my_cach:944,my_proxi:21,my_respond:46,mydir:895,mydomain:20,mymodul:28,mypreauth:28,myrealm:46,myremotetokentyp:20,name:2,3,4,5,6,8,10,12,14,15,16,19,20,21,22,23,24,28,29,30,32,33,34,36,37,40,46,48,49,50,59,60,141,147,153,155,159,214,222,223,227,230,235,246,247,252,260,264,267,278,300,301,310,315,317,319,320,329,333,336,342,343,350,352,359,362,365,377,382,384,406,407,408,409,412,414,501,638,640,641,642,643,647,652,662,738,749,811,831,860,870,874,881,896,898,903,906,908,909,912,915,916,917,918,921,923,930,931,932,933,937,939,940,941,942,943,944,946,951,name_s:306,name_str:37,name_typ:37,namelen:311,nat:21,23,916,nation:917,nativ:33,368,371,894,904,908,912,915,916,natur:38,naval:917,ncsa:42,nctx_out:176,ndnhnmn:896,nearli:3,necessari:3,14,21,22,23,24,33,34,37,39,43,120,122,123,260,343,387,407,920,921,925,936,937,necessarili:14,need:4,6,12,14,15,19,20,21,23,32,33,34,35,37,38,39,40,41,43,46,49,64,65,67,68,72,73,76,77,78,91,92,93,99,100,102,103,111,113,115,125,126,132,141,143,145,150,153,154,163,164,169,172,173,174,175,176,177,178,180,181,182,183,194,195,224,227,229,230,231,236,258,261,265,268,272,275,279,280,282,286,287,288,289,290,294,310,315,317,318,321,322,323,324,325,326,327,328,329,330,331,332,335,336,338,339,344,345,354,355,356,357,359,360,363,364,375,389,401,403,404,405,406,408,565,737,738,759,895,896,901,902,903,904,906,909,916,922,923,925,930,932,934,936,937,940,943,needchang:3,5,23,neg:28,883,912,neglig:917,negoex:916,924,negoti:908,916,922,neither:3,23,325,917,940,941,944,nersc:21,net:21,42,netbio:54,netbsd:916,917,netlib:904,netlogon:452,network:3,15,17,21,23,25,29,32,34,38,39,40,43,46,260,375,523,524,525,526,901,904,936,937,950,951,neuman:951,never:3,14,15,17,19,20,23,24,35,100,103,228,288,290,913,936,937,new_message_out:864,new_mkey_fil:6,23,new_princip:3,new_reply_out:863,864,new_stat:108,newer:6,14,20,23,904,newest:23,newli:3,6,23,26,37,107,113,125,126,176,294,329,330,359,363,364,375,895,902,916,newlin:344,352,newprinc:3,23,newpw:166,382,383,next:3,6,17,23,34,35,48,99,100,102,103,287,288,289,290,728,902,908,909,913,916,920,929,937,944,nfs:38,nii:944,nippon:917,nist:21,40,nitem:921,nktype:844,nlgilman:12,nls:916,no_auth_data_requir:3,23,no_host_referr:20,39,noaddress:21,nofail:46,nofork:4,nokei:3,23,37,non:2,3,14,19,21,23,26,33,37,43,44,99,100,102,103,113,129,130,155,224,241,245,250,269,287,288,289,290,294,298,299,300,315,330,342,359,375,382,383,388,863,908,912,916,940,943,944,nonc:358,822,830,844,916,none:3,20,21,22,23,26,36,37,57,58,132,273,285,304,369,372,899,909,944,951,nonexist:916,noninfring:917,nonrepudi:37,nonzero:21,224,946,noout:37,nopw:3,23,nor:917,941,944,norandkei:3,15,norealm:14,20,normal:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,north:917,nosync:20,24,notabl:23,note:3,5,6,14,20,21,23,26,32,34,154,241,245,602,603,605,606,896,902,929,937,940,944,950,951,noth:8,899,notic:17,24,917,notifi:934,novel:917,now:8,14,34,37,39,235,260,275,728,916,937,nowait:8,12,34,nrl:917,nss:917,nt_wellknown:761,ntlm:916,ntt:917,num:9,num_data:98,100,103,114,130,288,290,295,299,num_prompt:352,870,number:2,3,4,5,6,8,9,10,11,12,14,15,19,20,21,23,24,35,36,37,39,46,48,66,78,80,83,100,103,112,135,156,288,290,310,315,325,326,327,331,337,352,356,358,359,360,521,528,721,736,738,806,825,844,848,873,883,894,896,898,902,904,906,908,909,910,912,916,917,920,929,941,942,943,944,946,numer:6,34,166,382,383,896,916,941,numwork:10,object:3,5,6,20,21,22,24,25,28,35,36,43,48,262,269,738,902,904,908,917,918,919,920,921,922,923,926,927,928,929,930,931,932,933,observ:25,29,35,obtain:2,3,15,16,17,20,21,23,25,26,33,34,37,43,46,48,80,135,230,258,271,274,329,330,359,375,402,403,414,440,618,835,895,898,904,913,916,917,932,933,935,936,940,944,946,obvious:32,occasion:34,occur:3,6,9,23,78,342,386,916,occurr:171,octet:48,odd:937,oeap:481,off:15,21,24,25,28,33,35,39,352,361,offer:21,24,40,904,offlin:14,25,940,offset:10,48,410,908,913,often:20,22,23,28,33,38,39,898,925,951,oid:28,43,916,922,oid_op:917,ok_as_deleg:3,23,ok_to_auth_as_deleg:3,23,okai:3,23,937,941,old:2,3,6,14,15,20,21,23,34,37,243,346,420,916,936,old_cod:419,420,old_princip:3,oldcc:917,older:14,23,916,929,oldest_kvno_to_keep:3,om_uint32:43,922,omit:11,22,28,39,408,714,715,908,912,932,onc:3,6,14,15,21,23,34,43,46,78,361,733,895,899,902,927,931,936,951,one:2,3,5,6,9,15,16,17,19,20,21,23,24,25,26,28,32,34,35,36,37,38,39,40,41,43,46,48,153,165,243,263,264,270,271,275,279,330,333,344,356,360,389,738,895,896,898,899,902,904,905,906,908,909,913,916,918,920,921,923,926,929,930,936,937,940,942,944,945,ones:21,25,34,902,921,937,onli:3,4,6,8,9,10,14,15,18,19,20,21,22,23,26,28,32,33,34,35,38,39,41,43,46,48,54,114,153,224,228,241,245,295,325,361,365,366,545,729,749,860,887,894,895,900,902,904,908,913,916,917,922,923,929,930,932,936,937,940,944,946,949,951,onlin:14,25,onlyrealm:14,20,onto:17,21,32,34,904,922,937,opaqu:48,286,845,916,open:6,21,23,24,46,48,50,305,315,317,342,387,753,769,899,913,916,917,933,940,openldap:3,5,23,24,30,904,917,openldap_ldapconf:20,opensc:21,openssh:28,38,openssl:21,37,904,916,openvis:3,917,oper:2,3,5,9,10,14,15,19,20,21,22,24,26,28,33,34,35,37,41,43,48,62,119,121,136,156,158,382,383,386,753,835,845,895,901,902,903,904,909,913,915,916,917,926,930,940,944,951,oppos:37,opt:46,229,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,943,optim:904,optimist:20,40,48,254,option1:21,option2:21,option:2,11,12,15,19,22,24,28,29,34,35,36,37,39,43,48,59,60,224,225,226,229,232,233,234,235,253,260,269,275,325,326,329,330,331,344,375,403,414,416,546,736,806,807,811,822,823,830,834,838,839,844,882,898,903,916,919,920,921,923,926,928,930,937,951,oracl:42,917,order:3,4,6,14,16,17,19,20,21,22,23,32,33,34,35,37,38,43,46,48,245,736,895,898,899,903,904,908,912,917,918,922,932,951,ordinari:14,902,916,951,ordinarili:2,15,245,org:5,21,22,23,42,902,903,906,916,917,934,950,951,organ:903,917,orig_hostnam:194,origin:3,14,21,23,39,43,46,904,917,922,osconf:903,osf:679,other:3,4,6,10,14,15,19,20,21,23,24,26,28,34,35,37,38,39,43,46,154,279,310,359,404,644,738,835,894,895,898,901,902,903,904,908,909,912,916,917,920,922,926,927,928,930,931,932,934,936,937,942,944,949,950,othernam:37,otherrealm:21,otherwis:3,6,14,15,20,21,23,29,33,34,36,37,39,43,49,52,54,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,95,96,97,98,99,100,102,103,104,105,106,107,108,110,111,112,113,114,115,116,117,118,121,124,125,126,129,130,134,142,150,153,157,158,162,163,164,166,170,172,173,174,175,177,178,180,181,182,183,184,185,187,189,192,193,195,217,224,235,236,238,248,260,261,264,265,266,267,271,272,273,274,275,276,277,278,279,280,283,284,285,286,287,288,289,290,294,295,296,298,299,300,301,319,321,322,324,325,326,327,328,329,330,331,332,333,335,337,338,339,342,345,347,348,349,350,354,355,356,357,358,359,360,361,362,363,364,374,375,376,385,388,390,391,392,394,395,397,398,400,401,402,403,404,405,414,895,904,909,917,919,921,928,937,940,941,942,944,otp:3,16,25,30,46,368,694,696,697,720,736,915,916,our:20,36,901,902,917,out:3,8,12,21,23,24,33,35,36,37,41,43,49,50,56,59,60,63,64,65,66,67,68,69,71,72,73,74,76,77,78,89,91,92,93,95,96,97,99,101,102,104,105,107,108,111,112,113,115,116,117,118,119,121,124,125,126,129,130,132,134,135,138,141,142,143,145,149,150,152,153,154,158,163,164,166,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,194,195,223,224,227,229,230,231,235,236,238,251,260,261,262,264,265,266,267,268,269,272,273,274,275,279,280,282,286,287,289,294,296,298,299,301,303,305,306,307,308,310,311,314,315,317,318,320,321,322,323,324,325,326,327,328,329,330,331,332,335,336,337,338,339,344,345,347,354,355,356,357,358,359,360,361,363,364,368,371,374,375,382,383,389,390,391,392,394,395,396,397,398,401,402,403,404,405,406,408,409,410,412,532,533,535,536,539,895,904,916,917,936,939,946,out_cr:224,225,226,375,out_flag:238,outaddr:172,outag:20,39,outauthdat:322,outbuf:223,327,328,329,330,outcc:134,outcksum:131,outcr:177,outdata:178,outfil:6,outgo:15,922,outlin:0,29,outprinc:182,outptr:186,190,output:3,6,9,15,20,23,26,34,41,43,48,99,100,101,102,103,107,117,119,166,181,224,279,287,288,289,290,296,352,359,361,364,404,864,873,895,906,916,918,919,921,940,941,943,946,951,output_cr:43,output_cred_handl:43,output_message_buff:43,output_nam:922,output_payload_buff:43,outreach:14,outsid:15,895,951,over:0,10,14,15,20,21,23,24,28,32,34,36,38,39,43,46,48,107,113,114,117,155,164,294,295,296,300,301,325,363,375,815,916,918,924,932,936,937,overrid:3,6,10,14,20,21,23,36,48,378,380,381,386,387,863,904,912,916,940,overridden:2,10,11,19,21,899,916,overview:901,overwrit:6,23,384,939,overwrite_cr:43,overwritten:20,825,own:0,3,15,20,21,23,24,25,34,38,381,919,921,922,933,936,937,944,950,owner:917,ownership:899,p27:42,pa_as_fresh:910,pa_config_data:908,pa_hardwar:929,pa_real:920,pa_replaces_kei:929,pa_typ:857,908,pa_type_list:920,929,pac:3,20,23,48,340,341,650,659,684,858,861,916,940,pac_client_info:300,301,336,343,pac_out:301,packag:29,34,902,917,packet:20,25,36,330,916,929,pad:43,48,99,100,103,104,287,288,290,536,913,padata:843,844,920,929,padl:917,page:0,3,21,903,904,916,pair:6,20,21,26,839,pam:33,parallel:10,39,902,916,param:49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,paramet:5,6,10,20,23,28,35,36,43,46,48,169,229,323,325,343,904,905,908,915,916,922,926,929,944,parent:21,39,895,915,pars:3,15,28,43,45,46,48,235,260,264,267,278,356,360,368,371,901,908,part:14,21,23,26,32,41,199,264,267,278,283,301,344,359,384,821,831,843,881,895,900,908,909,913,917,921,922,932,944,951,parti:28,36,43,916,917,951,partial:14,19,46,913,particip:21,34,particular:2,11,14,16,17,19,20,21,37,43,46,317,902,904,917,936,937,particularli:14,17,25,39,936,943,partit:39,pass:14,20,21,28,36,43,99,100,102,103,228,250,270,271,275,279,280,282,287,288,289,290,325,368,371,380,381,382,386,387,887,904,922,931,940,944,passcod:668,passiv:25,passwd:5,23,33,893,917,944,passwd_phrase_el:802,871,password:3,4,5,6,9,10,11,14,15,16,17,19,20,21,22,24,25,26,28,29,32,33,34,35,36,37,39,40,43,48,233,245,258,618,620,717,718,719,737,738,895,900,915,916,920,924,935,937,942,944,950,951,password_changing_servic:3,23,password_expir:245,836,past:3,23,934,pasword:25,patch:23,path:4,5,8,20,21,22,23,25,28,29,34,39,359,902,904,906,916,944,951,pathnam:4,8,21,23,24,28,29,37,898,902,905,951,pattern:6,21,28,949,payment:917,pdf:0,pem:16,21,29,37,946,peopl:20,pepper1:107,pepper2:107,pepper:48,per:3,6,9,10,14,18,20,21,23,26,28,36,39,43,46,895,918,920,923,926,927,929,930,931,932,933,perfect:899,perform:3,4,5,6,12,14,19,20,21,22,23,24,25,26,34,37,38,39,43,46,62,91,250,254,258,359,363,375,382,383,386,416,437,845,895,916,917,926,927,928,937,perhap:3,14,20,23,24,period:6,8,14,17,20,21,23,24,35,937,940,permiss:3,15,18,19,20,23,34,43,137,147,159,895,916,917,937,permit:3,19,20,21,23,26,36,48,194,251,356,360,915,916,917,940,950,permitted_enctyp:21,26,persist:21,895,person:17,34,917,936,937,pertain:10,917,pgp:903,934,phase:944,phrase:893,physic:32,39,pick:20,25,37,902,pid:4,8,10,916,pid_fil:4,8,10,piec:35,265,pin:369,372,726,729,733,734,735,736,868,pipermail:934,pkc:21,738,pkcs11:21,916,917,pkcs12:21,pkinit:3,16,23,25,30,40,41,107,649,686,687,688,689,738,904,911,916,917,924,940,pkinit_allow_upn:20,21,pkinit_anchor:3,20,21,23,37,940,pkinit_cert_match:3,21,37,916,pkinit_dh_min_bit:20,21,pkinit_eku:21,pkinit_eku_check:20,21,37,pkinit_ident:20,21,37,pkinit_ind:16,20,pkinit_kdc_hostnam:21,37,pkinit_pool:20,21,pkinit_require_crl_check:20,21,pkinit_require_fresh:20,37,pkinit_revok:20,21,pkinit_san:21,place:2,8,14,15,21,26,28,32,33,37,39,43,44,46,48,107,117,229,264,267,279,296,301,336,364,376,404,825,864,904,906,913,919,927,939,944,950,placehold:901,903,plain:909,plaintext:116,533,plan:23,platform:24,883,894,895,902,903,904,916,pleas:0,15,20,736,934,plu:20,937,944,plug:917,pluggabl:21,28,916,921,924,927,932,plugin:3,20,22,901,904,914,915,916,917,932,plugin_base_dir:21,pnl:21,point:3,14,15,21,23,32,34,43,330,407,414,825,895,900,904,916,934,pointer:24,43,44,46,91,135,136,173,198,200,203,209,213,217,220,230,231,256,262,263,322,323,330,332,357,365,366,386,395,407,823,825,830,870,881,918,919,920,921,926,927,929,931,933,pol:3,19,23,polici:3,4,5,6,16,19,20,21,24,25,34,35,169,359,916,924,925,926,933,937,941,942,policy_nam:5,23,poll:4,8,20,23,916,pool:14,pop:32,popul:14,24,44,148,913,popular:34,port:3,4,7,8,10,12,15,20,21,23,34,36,41,44,48,62,331,524,526,915,951,portabl:895,portiion:917,portion:21,36,153,266,317,385,410,749,806,811,822,834,873,917,portmapp:23,portnum:10,pose:14,posit:6,19,28,35,883,912,posix:6,883,894,909,910,913,possess:37,937,possibl:3,5,6,14,15,17,20,21,22,23,24,25,26,32,34,35,37,38,39,43,46,48,93,166,224,738,898,899,904,916,917,920,921,929,934,937,949,post:48,895,934,postdat:3,19,20,23,267,937,940,941,potenti:14,32,34,46,900,power:20,24,25,39,916,practic:14,21,46,99,287,916,pre:0,16,20,22,43,48,91,260,329,330,359,363,364,375,380,857,906,909,916,917,927,940,pre_auth_typ:232,233,234,preauth:20,671,839,908,916,917,920,929,preauth_list:254,838,preauth_list_length:254,838,preauth_plugin:920,929,preauth_requir:920,929,preauthent:3,16,20,21,23,25,28,30,37,41,46,48,250,720,830,843,844,857,874,908,916,921,924,937,940,941,prebuilt:902,preced:10,14,21,39,912,944,951,precis:33,precomput:48,predefin:39,prefer:3,21,23,38,43,236,898,899,916,923,preferred_preauth_typ:21,prefix:20,39,48,344,902,904,916,922,943,944,preiniti:117,119,121,296,prepar:48,79,318,403,prepend:39,346,420,904,preprocessor:904,prerequisit:906,preselect:940,presenc:21,908,present:8,14,16,20,21,22,23,28,34,36,37,43,46,165,245,301,325,333,336,345,354,365,366,373,388,618,709,711,712,882,898,899,908,912,913,916,932,937,941,946,951,preserv:6,917,presid:917,pressvr:14,presum:899,prevent:2,3,19,20,21,23,25,26,29,40,330,521,522,899,916,917,927,936,940,previou:0,3,21,23,34,37,42,44,156,250,261,279,384,404,419,420,908,previous:3,6,23,43,48,902,916,prf:48,118,909,916,primari:3,4,7,8,9,14,17,20,21,23,24,31,35,38,39,41,43,48,145,895,916,918,927,931,933,934,939,940,945,949,951,primarili:24,55,947,primary_kdc:21,princ1:37,348,349,350,362,princ2:37,348,349,350,362,princ:3,6,15,21,49,50,91,92,93,94,388,791,792,793,794,795,796,797,798,909,princ_flag:6,princ_lockout:6,princ_look_ahead:944,princ_meta:6,princ_nam:37,939,princ_out:154,princ_stringattr:6,princ_tktpolici:6,princip:2,3,4,5,6,7,8,9,10,11,12,14,16,17,19,20,21,22,24,25,26,28,29,30,31,32,33,36,37,40,41,43,45,46,48,78,141,147,148,153,155,159,166,223,229,235,242,260,264,267,275,300,301,310,315,320,329,333,340,341,342,343,359,363,364,375,403,406,407,408,409,412,414,501,641,648,662,705,707,749,761,823,824,830,834,843,844,848,860,895,896,898,899,905,909,910,912,915,916,918,919,925,926,928,929,930,933,936,937,940,941,942,944,945,946,949,950,951,principal_databas:8,principal_nam:37,principal_out:344,345,principal_seq:37,principalnam:916,principl:708,princnam:25,35,40,46,895,princname_out:336,print:3,6,7,8,23,361,916,943,944,946,printabl:365,373,prior:6,8,14,20,21,23,39,41,43,136,265,917,921,priorit:39,prioriti:14,20,39,230,895,899,918,priv:48,916,privat:21,37,716,904,909,910,916,934,privileg:3,15,19,34,43,48,253,936,950,951,privsvr:300,301,342,343,privsvr_kei:340,341,prng:121,916,probabl:6,12,14,23,34,902,problem:14,23,330,899,916,934,proce:944,procedur:6,26,32,34,901,902,proceed:23,process:3,4,6,8,9,10,14,15,20,21,23,24,25,34,38,43,46,48,136,154,169,355,414,895,898,899,916,919,920,923,926,927,928,929,931,933,940,951,procur:37,917,produc:6,21,23,46,104,124,903,913,920,923,929,941,943,product:34,917,prof_no_rel:932,profil:15,18,20,21,48,136,388,895,898,899,901,905,916,917,924,profile_module_init:932,profile_module_init_fn:932,profile_releas:262,profile_vt:932,profit:917,program:2,3,4,6,8,12,15,20,21,23,26,28,30,32,33,34,37,38,39,41,43,46,56,268,378,899,901,902,903,906,908,915,916,917,937,943,944,951,programm:943,programmat:46,progress:14,20,prohibit:3,23,917,project:0,699,904,916,917,921,951,promot:14,917,prompt2:361,prompt:2,3,5,6,23,34,46,48,260,361,717,718,719,720,868,870,900,916,920,936,937,942,944,prompter:245,260,263,275,352,868,870,875,prone:916,proof:48,937,propag:4,6,7,8,14,17,19,20,21,24,31,35,901,916,917,936,proper:12,23,37,359,902,properli:29,34,37,41,894,904,properti:21,935,propog:8,proponli:4,23,proprietari:36,protect:6,15,25,26,32,35,37,40,43,78,247,326,331,738,845,899,916,protocol:2,3,14,21,23,29,39,43,48,247,301,321,405,673,693,721,830,834,843,844,899,901,914,916,926,937,940,946,951,prototyp:901,921,prove:46,910,920,929,provid:0,3,4,10,15,21,22,23,24,26,28,29,32,34,37,38,39,41,43,46,98,229,359,372,414,894,895,902,904,916,917,919,922,925,928,932,936,944,951,provis:917,proxi:20,21,25,30,36,39,43,916,937,941,proxiabl:3,20,21,23,48,838,937,940,941,944,proxy_imperson:908,pseudo:48,901,pto:183,ptr:38,43,197,281,339,353,800,801,830,831,881,pty:901,917,publish:38,917,pull:916,punctuat:3,21,23,34,942,purg:3,6,14,916,purge_mkei:23,purgekei:14,23,37,purpos:10,15,21,26,28,34,904,917,940,947,put:4,10,34,344,806,pw_expir:6,pwchang:20,pwd:902,pwexpdat:3,23,pwexpir:3,19,23,26,pwqual:28,916,924,pwqual_plugin:933,pwservic:20,python:29,906,916,qop_req:43,qop_stat:43,qualif:21,916,qualifi:3,15,19,21,23,951,qualify_shortnam:21,38,916,qualiti:21,28,916,924,935,queri:3,21,23,39,43,46,916,question:0,20,39,48,368,371,736,737,738,874,875,934,queue:20,917,quietli:939,quit:6,32,quot:3,6,23,344,406,408,896,quux:21,r13:6,23,r18:6,23,r_address:822,rabbit:39,radiu:20,36,916,randkei:3,14,23,26,34,37,916,random:3,6,14,15,20,21,23,25,34,48,909,913,916,random_data:124,randomli:2,26,randsourc:120,rang:940,rapidli:15,rare:24,37,896,898,rassen:917,rather:3,4,5,6,10,15,20,21,23,32,38,39,56,279,404,895,902,909,922,940,raw:20,902,rc2:479,rc4:20,26,916,rcach:43,71,85,265,323,325,899,rcache2:899,916,rcmd:21,rcommand:643,rcptr:265,rctmpdir:905,rctx:46,365,366,367,368,369,370,371,372,373,875,rdata_out:323,325,326,331,354,356,360,rdn:21,33,38,43,reach:20,21,24,164,314,913,react:243,read:3,5,6,9,11,20,21,22,23,34,35,37,46,48,250,260,262,318,352,371,414,904,912,929,932,936,941,951,readabl:15,21,32,169,896,898,900,916,reader:21,24,readi:6,34,readlin:904,readm:901,903,real:21,350,385,705,944,realiti:0,realloc:44,realm1:10,realm2:10,realm3:10,realm:3,4,5,6,7,8,10,12,14,15,16,19,22,24,25,26,29,30,33,34,36,37,38,40,43,44,46,48,49,50,59,60,91,92,93,94,153,214,230,235,251,260,264,267,278,279,284,300,342,344,345,350,359,388,389,403,404,408,502,706,709,710,711,712,714,715,725,793,794,795,796,811,819,823,831,834,843,844,860,863,864,866,867,881,895,904,905,908,909,910,912,915,916,924,931,933,936,937,940,944,949,950,951,realm_try_domain:21,realmlist:214,realmnam:37,46,realmsp:230,231,reason:14,17,21,24,28,33,39,342,894,908,917,936,937,944,reboot:20,34,900,rebuild:904,906,receiv:3,4,8,9,14,20,21,23,37,39,41,43,48,223,245,273,325,326,330,331,354,356,360,363,374,375,874,919,920,929,930,933,937,951,recent:2,6,17,20,25,26,37,48,899,910,916,937,recipi:822,917,recogn:3,20,21,37,41,940,949,recognit:916,917,recommend:5,6,15,17,20,21,23,32,34,39,40,43,902,903,904,934,937,939,recomput:136,reconf:901,record:6,10,21,23,33,34,38,39,899,909,912,913,916,recov:6,23,916,920,recurs:6,23,24,916,recv_hook:380,recvauth:363,375,red:691,917,951,redhat:916,redirect:21,34,redistribut:917,reduc:14,21,33,100,103,288,290,904,redwood:917,ref:5,23,refcount:916,refer:3,5,15,19,20,22,23,39,43,45,48,87,89,138,286,307,860,916,917,925,930,944,referenc:22,908,917,referr:20,21,39,230,231,343,389,692,701,725,908,916,923,937,referral_valid_until:859,referred_realm:859,reflect:23,34,100,103,136,158,262,288,290,325,326,331,356,360,909,910,reforward:937,refrain:922,refresh:15,43,908,916,refresh_tim:908,refus:12,14,34,regard:917,regardless:6,19,21,43,regener:906,regent:917,regexp:21,region:43,114,130,295,299,825,regist:4,21,23,28,39,917,924,951,registr:21,regress:902,regul:917,regular:14,21,34,37,43,944,regularli:17,39,reiniti:148,916,reject:12,15,16,20,21,34,166,620,937,reject_bad_transit:20,rekei:14,rel:20,21,48,896,902,908,944,relai:10,relat:4,6,20,21,22,28,29,35,37,39,169,824,916,917,relationship:21,930,releas:0,3,4,6,8,14,15,16,19,20,21,23,24,25,26,33,35,37,38,39,40,41,43,46,48,68,73,77,82,84,91,93,113,125,126,154,163,176,203,209,214,230,231,265,268,282,294,314,318,344,894,895,899,909,910,912,913,916,919,920,921,922,923,925,926,927,928,929,930,940,946,951,relev:34,38,78,195,300,909,reli:15,34,reliabl:24,relianc:21,relinquish:85,reload:23,remain:3,4,6,14,20,23,43,44,245,645,894,895,912,913,916,917,927,929,944,rememb:34,37,908,remot:3,4,7,15,20,23,33,38,43,48,62,64,169,223,325,326,331,356,359,360,382,383,525,526,901,916,936,937,944,950,951,remote_addr:44,64,82,359,remote_port:84,remotehost:947,remov:2,3,6,20,23,26,28,37,38,48,155,902,916,927,936,renam:3,23,904,916,927,rename_sect:932,render:14,902,renew:3,5,6,20,21,23,48,844,882,916,928,937,940,941,944,951,renew_lif:256,838,renew_lifetim:21,renew_til:823,831,882,908,renewable_lif:940,renprinc:3,reorgan:916,rep:185,199,327,328,357,358,805,830,843,858,rep_cksum:859,rep_result:375,repeat:6,20,21,34,845,908,922,repl:357,replac:3,5,21,23,28,34,70,75,94,186,188,190,191,196,197,225,226,232,233,234,281,351,353,411,904,912,916,917,920,940,replai:21,43,48,78,323,325,326,331,354,356,359,360,521,522,873,895,897,905,911,915,916,951,repli:12,26,46,107,245,258,267,279,352,357,358,380,381,404,728,843,863,864,868,909,916,920,929,940,replic:8,34,replica:4,6,7,8,9,14,15,17,20,21,23,31,32,35,41,901,916,replica_datatran:7,34,915,replica_datatrans_hostnam:23,replica_dumpfil:8,replica_host:7,replicahostnam:8,reply_out:864,report:6,38,901,916,934,940,946,repositori:906,repres:3,21,34,43,158,883,894,898,909,represent:21,43,48,344,345,398,407,408,811,830,843,844,881,894,908,912,917,representaton:805,reproduc:917,req:21,26,37,245,329,330,359,504,844,req_pac:253,request:3,4,6,8,9,10,14,15,16,19,20,21,22,23,24,25,28,33,35,36,37,38,40,43,46,48,153,166,195,223,224,229,235,241,253,260,267,276,277,330,359,378,403,503,505,506,619,673,693,750,757,758,805,807,830,844,852,896,898,899,908,909,910,916,919,920,922,928,929,934,937,940,944,946,951,request_fini:920,request_init:920,request_tim:880,requested_principal_nam:859,requestor:659,requir:3,4,6,8,9,12,14,15,16,20,21,22,23,24,25,26,28,32,34,35,36,37,38,39,40,43,46,48,98,112,116,117,236,241,247,248,301,323,325,326,331,354,356,360,544,736,860,875,894,895,902,903,904,906,909,916,917,919,922,929,932,937,942,950,951,require_auth:3,16,916,requires_hwauth:3,23,929,requires_preauth:3,5,14,23,25,35,37,40,requires_pwchang:5,23,requisit:906,research:917,resembl:738,reserv:907,917,reset:3,9,23,35,46,157,386,916,resid:15,39,46,900,917,949,950,residu:21,39,152,317,895,899,930,932,951,resiz:407,resolut:15,33,38,43,230,916,944,resolv:15,33,48,260,317,895,904,916,941,944,resourc:43,46,902,914,916,respect:3,11,34,82,84,224,344,896,917,922,936,respond:4,48,367,368,369,370,371,372,729,736,737,738,874,875,916,929,respons:3,4,23,37,40,46,85,166,229,245,279,357,404,503,505,543,565,737,757,759,805,844,880,916,917,920,923,929,940,947,951,rest:28,904,restart:12,14,19,20,23,24,34,37,41,restor:6,17,916,restrict:3,5,14,19,21,23,48,224,917,926,928,940,944,restrict_anonymous_to_tgt:20,37,restructuredtext:0,resubmit:940,result:0,14,15,21,23,37,39,40,41,43,46,48,99,102,107,117,124,144,156,158,189,195,228,287,289,296,320,375,376,403,405,406,407,420,904,908,909,913,916,917,918,922,923,928,929,930,937,944,946,result_cod:166,382,383,result_code_str:166,382,383,result_str:166,169,382,383,resum:23,resync:4,9,23,916,resynchron:9,ret:46,347,ret_as_repli:232,233,234,ret_princ:389,ret_valu:59,60,retain:2,3,14,20,23,917,926,928,950,retir:13,23,916,retransmit:904,retri:20,36,38,39,retriev:3,6,24,41,43,44,46,48,158,271,310,366,375,400,403,874,916,917,946,return_padata:929,return_pwd:361,retval:49,50,51,53,55,56,61,62,63,64,65,66,67,68,69,71,72,73,74,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,121,124,125,126,129,130,132,133,134,135,137,139,141,142,145,147,148,149,150,151,152,153,155,156,157,158,159,160,161,162,163,164,165,166,167,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,236,238,248,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,285,286,287,288,289,290,294,295,296,298,299,300,301,302,303,304,305,306,308,310,311,313,314,315,316,317,318,319,321,322,323,324,325,326,327,328,329,330,331,332,333,335,336,337,338,339,342,344,345,347,348,349,350,352,354,355,356,357,358,359,360,361,362,363,364,373,374,375,376,377,378,382,383,384,385,387,389,390,391,392,394,395,396,397,398,400,401,402,403,404,405,406,407,408,409,410,414,921,reus:23,rev:6,23,24,revers:6,15,21,23,33,43,917,941,review:903,revis:916,917,revoc:20,21,revok:20,21,35,rfc4120:29,rfc:14,20,21,39,43,48,320,382,383,412,442,443,446,447,448,450,451,458,459,460,461,462,463,464,465,466,511,540,542,600,663,666,667,668,669,670,671,672,674,675,676,677,679,680,681,682,685,686,688,690,696,699,701,703,736,899,908,909,910,913,916,920,922,rhost:223,ricciardi:42,richard:917,ride:20,right:5,19,20,23,100,103,288,290,825,907,913,917,risk:14,26,30,46,rkt:11,rlen:91,92,93,94,rlogin:944,rnd:38,roam:21,robbi:951,robin:15,robust:916,rock:920,929,roll:23,rollback:14,rollov:6,23,root:8,12,14,15,17,19,20,21,32,34,900,904,936,944,949,950,951,rotat:26,38,round:40,916,929,rout:34,routin:21,868,royal:917,royalti:917,rpath:902,904,943,rpc:20,21,23,43,48,616,901,916,917,rpcbind:23,rsa:37,477,480,481,482,917,940,rst:906,rtime:844,rule:3,15,19,21,23,28,38,39,43,154,944,946,949,950,run:3,4,6,8,9,10,12,14,15,20,21,23,24,26,28,32,33,34,37,39,41,895,902,903,904,906,915,916,939,941,944,951,runstatedir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,runtim:915,s2kparam:48,s2kparams_out:229,s4u2proxi:20,43,908,916,s4u2self:20,43,343,916,946,s4u:916,s4uself:20,s_address:822,safe:28,48,739,894,916,safer:936,safest:937,sai:899,sake:944,sale:917,salt:2,3,6,11,15,20,23,25,48,125,126,393,838,916,salt_out:229,salt_type_afs_length:787,salt_type_no_length:787,salttyp:6,20,26,374,salttypep:394,sam:694,696,697,916,samba:28,916,same:3,4,5,10,12,15,19,20,21,23,24,28,36,39,43,52,53,91,101,105,107,136,138,151,155,171,180,228,250,270,271,275,279,307,348,349,350,362,388,845,895,899,904,916,921,922,936,940,944,946,sampl:12,15,22,34,901,917,936,937,944,947,san:20,21,916,sandia:917,sasl:3,5,20,22,23,38,43,916,sasl_authcid:3,sasl_authzid:3,sasl_mech:3,sasl_nocanon:38,sasl_realm:3,satisfactori:25,save:37,40,66,83,528,529,909,916,929,sbin:8,12,34,904,915,sbindir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,scalar:909,scenario:14,916,schedul:14,23,schema:22,24,scheme:39,sclient:12,935,938,sclogin:20,scope:5,23,screen:937,screensav:937,script:3,4,10,23,34,901,902,904,916,search:5,20,21,23,38,48,151,153,195,224,315,895,902,913,916,939,945,search_scop:5,23,searchscop:5,23,sec:48,811,834,896,second:3,10,20,21,23,28,36,37,39,43,44,52,53,105,153,223,228,266,267,322,348,349,350,361,362,385,386,388,410,743,806,822,824,844,873,883,894,896,899,908,909,912,913,921,922,937,940,944,951,second_ticket:824,844,908,secondari:34,secret:3,20,21,36,43,46,848,936,section:3,10,19,22,23,28,33,34,35,37,39,41,43,48,119,320,412,600,680,681,682,899,902,903,908,909,913,916,932,933,944,949,sector:6,23,secur:3,7,14,15,20,21,23,25,30,31,34,37,39,41,43,46,250,325,564,900,901,916,917,934,937,951,securecooki:909,securid:668,916,sed:904,see:14,15,17,22,23,24,26,28,32,34,35,36,39,43,46,97,99,100,102,103,108,113,114,130,131,168,229,262,287,288,289,290,294,295,299,320,359,393,403,412,413,414,600,736,895,896,899,900,901,902,904,906,907,908,916,917,918,919,920,921,923,924,925,926,927,928,929,930,931,932,933,934,936,937,seed:131,331,413,913,seed_length:131,413,seen:899,segment:39,select:6,14,21,23,28,43,46,48,117,296,359,369,895,904,916,922,924,940,944,949,self:21,sell:917,semant:46,semfiajf42:20,send:0,4,15,20,21,23,25,26,32,34,41,48,229,245,325,363,375,380,899,901,904,916,934,936,940,951,send_hook:381,sendauth:12,34,48,sender:325,326,331,356,360,822,sensit:250,sent:6,20,23,25,36,37,41,43,325,375,381,864,899,902,909,916,929,937,sentenc:34,separ:0,3,5,6,10,16,19,20,21,22,23,24,25,28,39,50,301,344,346,420,729,903,904,909,916,922,932,936,951,seq:873,seq_numb:806,811,seqnumb:69,74,sequenc:25,37,48,66,78,80,83,325,326,327,331,356,358,359,360,521,528,806,811,873,900,908,909,912,922,sequence_count:871,sequenti:48,314,813,seri:48,913,serial:9,43,48,405,916,serv:4,10,21,23,916,server1:5,23,server:2,3,4,5,6,7,8,9,10,12,16,18,20,21,22,23,24,25,28,29,30,31,34,36,37,38,39,43,46,48,159,166,223,224,264,267,300,301,333,342,343,359,375,382,383,414,504,617,660,728,758,805,823,824,830,834,844,881,895,898,899,901,905,908,915,916,917,918,924,925,937,943,944,946,947,949,server_kei:340,341,server_port:12,server_princ:300,301,server_str:169,serverauth:21,servic:2,3,5,8,10,12,15,16,19,20,21,22,24,28,29,31,32,33,34,43,48,166,224,235,245,260,264,267,301,329,330,363,382,414,643,644,645,736,876,895,899,901,908,916,917,918,923,931,937,940,946,949,951,service1:946,service2:946,service_loc:931,service_nam:940,service_passwd:5,23,sesam:46,699,session:3,14,15,21,23,33,34,43,46,48,224,320,325,330,354,412,439,440,811,823,824,830,831,895,899,937,941,946,951,session_enctyp:3,23,set:0,3,4,5,6,14,15,16,18,19,20,21,22,23,24,25,26,28,29,31,32,33,34,35,37,38,39,40,41,43,44,46,48,62,68,69,73,74,77,78,98,102,145,153,154,161,164,203,209,224,229,253,279,280,286,289,301,305,317,325,326,331,352,354,356,359,360,361,369,373,377,387,404,407,408,409,420,546,729,745,863,864,874,895,896,899,904,916,919,922,929,930,936,937,939,940,941,944,950,951,set_cooki:916,929,set_str:23,26,36,37,setstr:3,16,setuid:41,916,951,setup:23,34,902,916,sever:3,15,16,20,21,23,24,37,39,895,901,904,908,921,951,sfu:683,sha1:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,sha256:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,sha2:20,916,sha384:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,sha:14,20,916,shall:917,share:0,14,21,23,28,46,330,904,921,922,932,936,sharealik:917,sharp:19,she:937,950,shell:3,5,23,34,41,916,936,937,943,949,shorter:21,shortest:192,shortli:33,936,shortnam:21,916,should:0,2,3,4,5,6,10,12,14,15,17,20,21,22,23,24,25,26,28,29,32,33,34,37,38,39,43,46,71,85,144,152,223,245,249,255,269,279,308,317,325,327,330,342,359,361,365,366,404,738,858,863,864,883,894,895,896,900,902,904,908,910,916,917,918,919,920,921,922,926,927,928,929,931,932,933,936,937,940,944,946,951,show:2,6,20,41,868,895,906,915,937,941,shown:20,21,895,shrubberi:42,shutdown:24,sick:917,sid:21,638,639,659,side:23,43,363,375,899,sighup:10,41,sign1:43,sign2:43,sign:3,19,20,21,23,32,37,41,43,48,894,903,910,912,916,940,951,sign_authdata:916,sign_onli:43,signal:10,signatur:48,412,476,477,482,903,922,932,signedpath:3,20,23,916,signific:25,35,silent:941,similar:6,21,22,29,43,92,105,113,114,126,129,130,246,294,295,296,298,299,326,329,343,345,349,364,407,408,417,419,916,921,931,937,944,similarli:15,344,738,937,simpl:5,12,17,23,107,421,895,899,simplest:28,43,895,902,simpli:28,36,37,40,43,46,737,902,922,936,937,simplifi:251,916,simul:944,simultan:845,sinc:3,12,14,15,17,21,22,23,37,48,330,733,883,894,908,922,929,950,951,singl:0,3,14,15,20,21,23,24,26,28,32,34,37,39,40,43,46,48,189,320,345,409,708,895,904,916,929,944,siphash:913,site:15,23,34,39,916,937,940,950,situat:14,20,24,28,39,946,size:9,20,21,23,24,37,41,48,97,98,100,103,114,116,130,186,190,288,290,295,299,361,407,409,825,904,912,913,916,size_return:361,size_t:95,96,98,100,103,104,112,114,116,118,130,131,168,170,186,187,190,191,192,193,280,288,290,295,299,337,339,369,374,397,398,413,sizeof:43,46,932,skei:20,824,skew:48,267,356,360,929,940,skip:22,23,37,414,416,slack:39,slash:344,951,slat:921,slightli:904,slot:11,21,300,913,slotid:21,slower:14,24,small:56,smaller:21,912,smard:21,smart:20,21,916,sms:19,smtp:642,sname:389,946,sni:916,sock_dgram:931,sock_stream:931,socket:20,21,36,48,375,915,931,soft:916,softwar:14,15,21,24,25,28,42,46,904,917,934,solari:31,902,904,916,solaris9ab:42,sole:21,28,solut:34,some:2,3,6,14,20,21,23,24,28,29,31,34,37,38,39,41,46,48,99,151,154,287,389,764,895,896,899,901,902,903,904,905,913,915,916,921,922,925,932,934,936,937,940,949,951,someon:17,21,34,936,937,someth:12,14,20,38,899,sometim:23,25,38,940,somewhat:37,899,song:917,sophist:46,sort:38,sourc:0,10,22,23,28,34,39,42,43,902,903,904,914,917,921,925,932,934,944,source_cache_nam:944,source_us:944,southern:917,space:3,16,20,24,37,38,56,99,102,117,119,121,287,289,296,306,346,361,407,420,896,903,spake:20,21,25,30,916,917,spake_preauth_group:20,21,40,spake_preauth_ind:20,spake_preauth_kdc_challeng:20,40,sparc:916,spars:913,spawn:4,special:20,23,28,35,43,408,648,713,895,916,917,922,940,specif:3,4,6,8,10,14,18,19,20,21,23,24,26,34,39,43,48,49,56,155,301,315,317,363,364,410,738,895,896,898,904,906,913,916,917,921,926,931,937,specifi:3,4,5,6,7,8,9,10,11,14,15,16,18,19,20,22,23,28,29,34,36,37,39,43,46,48,92,93,99,100,102,103,113,125,129,224,227,229,235,260,264,267,287,288,289,290,294,298,310,315,318,325,326,331,344,345,356,359,360,375,383,414,750,895,899,904,909,910,916,922,929,937,939,940,941,942,943,944,945,946,951,speed:22,25,sphinx:906,sphinx_arg:906,spi:922,split:3,39,916,spnego:916,917,922,spnego_mech:917,spoof:21,25,39,sprecif:903,spuriou:916,sqlite3:6,sqlite:6,squar:20,21,28,src:22,148,902,904,906,917,src_ctx:179,src_name:43,srcdir:906,srv:21,33,34,39,916,srvtab:11,ss_lib:904,sscope:5,23,sserver:1,947,ssh:15,33,937,950,951,sshd:21,sshing:951,ssl:29,37,sspi:916,stabl:916,926,927,928,933,stage:14,909,927,stai:3,15,stale:0,21,26,stamp:6,9,stand:34,standalon:8,41,916,standard:3,6,9,14,20,23,37,41,43,898,916,917,943,start:0,3,4,6,8,10,14,15,19,20,21,23,24,26,31,37,41,48,823,831,844,882,895,900,902,910,916,937,944,start_realm:908,start_tim:235,260,275,940,starttim:882,908,startup:34,916,stash:3,5,10,14,20,22,34,41,897,915,stash_fil:6,23,stashfilenam:5,6,23,stashsrvpw:3,20,22,23,state:6,9,14,20,34,46,48,78,99,100,102,103,287,288,289,290,845,909,915,916,917,918,920,921,923,926,927,929,930,931,932,933,statement:917,statu:3,835,916,917,919,922,941,944,946,stderr:20,951,stdin:352,stdlib:932,stdout:41,352,stduser:23,step:6,14,22,23,34,37,944,steve:951,still:3,4,6,10,14,20,21,23,32,33,34,35,39,148,269,916,940,944,946,stime:834,stockholm:917,stolen:937,stop:4,10,24,921,storag:46,48,57,58,82,84,159,170,187,192,193,280,361,374,398,895,store:2,3,4,5,6,8,14,15,17,20,21,22,23,24,26,34,37,46,48,80,99,100,102,103,224,235,250,287,288,289,290,325,326,330,331,356,359,360,361,407,414,549,729,838,895,898,899,902,905,908,913,916,933,937,940,941,944,946,str:43,strategi:35,strcmp:932,strdup:932,stream:8,12,20,34,36,43,strength:916,strengthen:14,strict:917,strictli:34,string2kei:14,string:3,5,6,15,16,19,20,21,23,25,26,28,34,36,37,39,43,46,48,101,166,169,192,228,229,258,264,267,278,336,346,365,373,379,382,383,417,418,419,420,736,737,738,819,824,835,866,867,887,895,896,899,904,916,917,919,921,922,929,930,932,940,944,strip_realm:20,36,strlcpy:917,strlen:43,46,strong:16,122,stronger:14,16,21,26,strongest:26,strptime:917,struct:43,48,51,262,269,803,805,806,807,808,809,811,814,815,816,820,821,822,823,824,825,827,829,830,831,832,834,838,839,840,843,844,845,846,847,848,852,857,858,859,860,861,867,868,871,872,873,874,876,877,878,879,880,881,882,884,885,887,888,889,892,893,926,932,structur:43,46,47,48,92,100,103,135,156,169,173,182,212,221,237,240,241,242,243,244,245,249,252,253,254,255,257,258,259,269,275,280,282,288,290,322,324,334,345,355,356,365,368,371,375,389,414,416,421,538,803,809,821,824,825,834,861,881,888,894,920,921,926,928,929,931,studio:916,style:3,21,23,39,417,418,419,638,640,sub:5,21,23,901,subcommand:14,subdirectori:21,28,901,906,915,subdomain:21,39,949,subject:0,20,21,23,37,917,subjectalternativenam:21,subjectaltnam:37,subjectkeyidentifi:37,subkei:48,80,325,354,359,806,811,sublicens:917,submit:26,43,subprocess:10,subregion:43,subschema:22,subscrib:934,subsect:16,20,21,22,24,25,28,29,35,37,40,subsequ:9,10,14,24,136,275,279,404,917,subsess:26,330,440,subset:39,901,substanti:917,substhtml:906,substitut:21,34,37,917,subsystem:904,subtag:21,subtre:3,5,20,22,23,subtree_dn_list:5,23,succe:20,21,34,43,46,414,succeed:12,34,success:3,6,8,20,23,24,25,35,46,49,50,56,62,64,65,67,69,72,73,74,76,77,78,79,81,82,84,85,86,87,88,89,90,91,92,93,95,96,97,98,99,100,102,103,104,105,106,107,108,111,112,113,114,115,116,117,118,119,121,122,124,125,126,129,130,132,133,134,135,137,141,142,144,145,147,148,149,150,152,153,155,156,157,158,159,161,162,163,164,166,167,169,170,172,173,174,175,176,177,178,180,181,182,183,184,185,187,189,192,193,214,217,223,224,227,229,231,235,236,238,248,260,261,262,264,265,266,267,268,271,272,273,274,275,276,277,278,279,280,282,286,287,288,289,290,294,295,296,298,299,300,301,302,303,305,306,308,310,311,314,315,316,317,318,321,322,323,324,325,326,327,328,329,330,331,332,333,335,336,337,338,339,342,344,345,347,352,354,355,356,357,358,359,360,361,363,364,374,375,376,377,378,382,383,384,385,389,390,391,392,394,395,396,397,398,400,401,402,403,404,405,406,407,408,409,410,414,416,621,835,899,920,923,933,944,946,successfulli:3,6,12,23,35,43,46,245,301,416,863,864,sudan:917,sudden:20,suffici:3,5,14,23,24,904,suffix:21,28,38,43,904,916,951,suggest:0,245,suit:34,901,902,916,suitabl:6,902,904,916,917,937,summar:941,summari:8,9,sun:917,suncc:904,sunw_dbprop_en:23,sunw_dbprop_master_ulogs:23,sunw_dbprop_slave_pol:23,sunwaadm:42,supersed:10,14,supervisor:10,supplement:20,suppli:3,11,43,46,48,223,245,258,262,267,276,277,278,331,342,372,373,386,733,734,874,904,920,921,929,support:3,4,6,8,10,11,20,21,22,23,24,25,26,37,39,40,43,46,48,153,161,247,253,378,386,387,544,754,895,897,901,902,903,904,908,909,913,916,917,920,921,922,929,934,940,supported_enctyp:14,20,26,34,916,suppos:937,950,suppress:3,6,20,23,904,916,939,944,946,sure:3,5,12,14,15,22,23,26,33,41,936,937,940,surpris:14,surround:28,surviv:20,895,susec:834,swap:34,39,sweden:917,symbol:6,344,899,902,903,906,915,921,922,symmetri:20,synchron:9,14,15,21,24,34,41,48,271,403,728,916,929,syntact:21,syntax:20,21,37,916,synthes:381,863,synthet:380,908,syria:917,sysadv6:42,sysconfdir:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,syslog:20,21,34,921,system:3,6,14,15,19,20,21,23,24,29,32,33,34,35,36,37,38,41,43,46,48,56,136,147,169,282,382,383,385,396,692,695,698,874,895,900,901,902,903,916,917,921,930,934,936,937,939,940,950,951,systest:3,23,t_mddriver:917,tab:3,6,23,344,916,tabdump:26,916,tabl:3,6,23,48,276,307,308,313,359,363,414,848,898,901,903,904,906,913,915,916,941,tabular:6,916,tag:20,21,34,908,913,922,tail:34,take:10,14,19,20,21,23,25,26,28,32,39,41,43,46,91,124,126,325,376,729,825,896,913,916,918,927,936,937,944,taken:6,14,39,245,899,913,talk:899,tamper:43,tape:32,tar:902,903,target:19,21,34,43,895,908,916,target_nam:43,target_princip:19,target_principal_nam:944,target_us:944,target_user_login_nam:944,task:14,46,91,tcl:916,tcp:8,10,12,15,20,21,23,29,34,37,39,279,404,916,931,team:934,teardown:902,technet:42,techniqu:40,46,technolog:907,917,951,tekniska:917,telegraph:917,telephon:917,tell:4,10,936,937,943,telnet:21,643,944,temp:21,templat:901,temporari:3,21,23,34,37,898,899,915,916,951,temporarili:3,ten:33,937,tend:15,term:3,14,23,25,26,37,41,737,895,898,916,917,920,929,946,termin:4,10,48,173,195,220,230,231,240,261,325,352,354,361,366,407,901,932,944,ters:3,23,test1:3,23,896,test2:3,23,896,test3:3,23,896,test4:896,test:3,9,10,12,14,21,23,37,48,901,904,906,916,917,940,947,test_html:906,testdir:41,testus:3,23,texinfo:0,text:6,23,28,36,37,46,169,365,825,834,868,909,943,tgt:3,14,20,23,26,37,46,48,220,342,343,908,909,916,937,944,than:3,4,5,6,10,12,14,15,19,20,21,23,24,25,26,28,32,35,37,38,39,43,53,56,230,279,375,404,895,899,902,909,912,913,916,920,922,936,940,thei:3,6,9,14,15,20,21,23,28,33,34,37,38,39,41,43,46,229,325,375,729,845,894,895,898,902,904,908,916,929,936,937,948,951,them:3,14,15,20,22,23,24,25,29,32,34,37,39,41,46,82,84,253,330,344,403,729,895,902,904,916,917,921,922,932,937,939,951,themselv:6,23,theodor:917,theori:917,therebi:950,therefor:22,23,25,39,908,929,thereof:917,thi:0,2,3,4,5,6,8,9,10,11,12,14,15,17,19,20,21,22,23,24,25,26,27,28,32,33,34,35,36,37,38,39,40,41,43,46,48,49,50,55,57,58,59,60,61,62,67,68,69,71,72,73,74,76,77,78,81,82,84,85,86,87,88,89,92,93,98,99,100,101,102,103,104,105,107,113,114,116,117,119,120,122,123,124,125,126,129,130,133,136,137,139,141,144,148,150,151,153,156,157,158,159,167,169,171,172,173,174,175,177,178,180,181,182,183,192,194,195,198,199,200,201,202,203,205,206,207,208,209,212,215,216,221,228,235,236,241,243,245,246,252,253,254,258,260,261,262,264,265,266,267,270,271,272,275,276,277,278,279,287,288,289,290,294,295,296,298,299,301,308,317,320,323,324,325,326,327,329,330,331,333,334,342,343,345,352,355,356,357,358,359,360,361,363,364,368,371,373,375,376,378,380,382,383,385,386,387,389,396,400,401,403,404,407,408,410,412,414,416,417,419,726,727,728,729,733,734,735,737,830,848,882,883,894,895,899,900,901,902,903,904,908,909,913,914,915,916,917,918,920,922,924,926,927,928,929,930,932,933,934,936,937,939,940,941,943,944,946,950,951,think:38,921,936,third:21,28,36,37,908,916,917,951,thorough:39,those:3,6,14,15,19,21,23,25,26,34,39,43,46,904,906,912,916,917,920,922,925,926,929,946,950,951,though:14,902,937,thousand:24,thread:24,845,895,904,916,threadsaf:285,three:14,24,26,35,39,40,375,908,916,937,951,threeparamopen:787,through:15,16,20,21,23,24,28,29,33,34,35,39,46,230,282,386,387,416,908,913,916,927,936,937,throughput:20,24,thu:23,899,904,944,ticket:2,3,5,6,12,14,15,16,19,20,21,22,26,28,33,34,35,36,37,38,39,41,43,46,48,153,159,183,195,223,229,235,247,260,264,267,322,330,333,342,359,363,364,375,545,548,551,652,661,743,758,807,811,821,823,824,830,831,843,844,881,882,884,895,896,908,916,919,920,928,929,934,935,936,939,940,941,944,946,947,950,951,ticket_authdata:195,ticket_flag:5,23,824,908,ticket_info:822,ticket_lifetim:21,33,tied:927,tightli:14,28,32,900,till:844,time:0,2,3,5,6,9,10,14,15,19,20,21,22,23,24,26,28,34,35,36,37,39,41,43,44,48,136,158,224,228,235,245,260,275,356,359,360,398,733,750,751,806,822,823,824,830,831,844,848,882,894,895,897,899,900,904,905,908,909,913,915,916,917,922,928,936,937,940,941,944,951,time_offset:10,time_rec:43,916,time_req:43,time_t:6,883,894,timeofdai:410,timeout:14,20,36,timeret:396,timestamp:6,11,14,21,25,37,40,48,66,83,325,326,331,336,342,343,356,360,396,522,529,670,822,848,852,873,883,894,898,899,908,909,910,912,913,916,929,941,timestampp:395,titl:901,917,tkt:824,tkt_flg_anonym:787,tkt_flg_enc_pa_rep:787,tkt_flg_forward:787,tkt_flg_hw_auth:787,tkt_flg_initi:787,tkt_flg_invalid:787,tkt_flg_may_postd:787,tkt_flg_ok_as_deleg:787,tkt_flg_postdat:787,tkt_flg_pre_auth:787,tkt_flg_proxi:787,tkt_flg_proxiabl:787,tkt_flg_renew:787,tkt_flg_transit_policy_check:787,tkt_life:259,838,tktpolici:3,5,23,tls:22,tlyu:3,23,tmp:3,15,21,34,899,905,915,937,944,951,tmpbuild:902,tmpdir:899,951,tmppolici:5,23,todd:917,todo:936,togeth:15,token:16,20,21,46,368,598,727,728,729,731,734,735,911,916,922,929,940,token_flag:879,token_id:877,token_len:43,tokenid:736,tokeninfo:369,736,876,toler:21,tom:3,too:3,23,56,100,103,119,267,288,290,306,tool:6,23,901,903,916,921,toolkit:901,top:10,39,895,902,903,906,top_srcdir:906,topic:0,30,34,topolog:4,tort:917,tortiou:917,total:20,25,913,940,944,toward:0,23,tr_content:888,tr_type:888,trace:48,887,916,951,trace_log:41,track:3,6,9,23,35,899,934,trademark:917,tradit:6,35,traffic:29,trail:20,38,944,trailer:43,48,538,transact:24,951,transcript:909,transfer:4,37,transform:904,transit:20,21,24,359,541,550,673,693,831,888,937,940,941,946,transitori:14,translat:21,56,916,transmiss:17,transmit:23,43,279,404,916,929,transpar:951,transport:23,39,279,404,travers:6,23,treat:3,21,36,38,43,54,342,350,707,883,908,940,946,treatment:39,tree:0,22,23,24,34,903,904,906,922,925,932,tri:20,21,25,44,359,414,916,923,trigger:899,trillium:15,32,937,trim:99,287,trip:40,916,929,tripl:14,20,26,916,trivial:25,916,troubl:42,troubleshoot:30,34,true_principal_nam:859,truncat:913,937,trust:20,21,29,37,43,268,940,tryagain:920,tty04:20,tty:5,23,tune:22,39,tupl:3,23,turn:8,21,24,33,35,40,352,361,904,944,twice:3,23,24,34,908,927,936,942,two:3,18,20,21,23,24,26,28,34,35,37,38,48,53,361,896,908,909,912,916,918,922,930,937,940,944,txt:6,34,39,type:2,3,5,6,10,15,16,21,23,25,28,30,32,34,38,39,46,48,91,93,95,98,99,100,102,103,104,108,112,113,114,115,116,124,125,126,129,130,151,152,153,161,163,184,189,195,223,224,229,280,287,288,289,290,294,295,298,299,310,311,315,317,331,333,335,344,389,421,500,541,647,677,748,754,798,811,819,825,830,852,854,857,866,867,881,883,888,889,894,898,902,905,908,909,910,912,913,916,918,920,921,922,925,926,927,928,929,930,931,932,933,936,937,940,941,944,946,950,951,typedef:43,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,typic:4,15,20,21,26,33,38,39,43,46,98,253,906,915,918,920,921,926,927,929,933,940,946,u2u:946,ubuntu:42,916,ucb:944,udp:10,15,20,21,29,39,279,404,916,931,udp_preference_limit:21,uid:21,43,895,899,915,944,950,951,uid_t:43,uidnumb:895,uint16_t:890,uint32_t:883,891,894,uint8_t:856,uint_max:767,768,786,ulog:20,23,umich:917,unabl:17,21,23,unalloc:280,unam:28,unambigu:245,unansw:875,unauthent:32,unavail:23,34,39,unchang:3,14,15,944,unclean:24,uncommon:899,uncondition:228,904,unconfigur:39,906,undefin:944,under:3,5,6,10,20,21,22,23,38,155,159,899,902,913,916,917,underli:43,underneath:22,underscor:21,917,understand:46,undertaken:0,unenc_authdata:844,unencapsul:916,unencrypt:32,356,811,821,843,844,unescap:6,unexport:922,unfinish:929,unicod:917,unifi:0,unimpl:921,unimport:908,uninterrupt:14,uniqu:3,15,43,48,265,414,644,646,895,922,unit:896,917,937,univers:917,unix:6,15,20,21,28,31,36,43,921,922,932,unkei:46,unknown:12,38,41,616,908,946,unless:2,3,6,11,14,19,20,21,23,26,28,32,34,43,315,386,414,416,899,900,916,930,944,948,unlik:14,40,895,899,916,922,937,unlimit:917,unlink:6,23,unlock:23,35,916,unlockit:3,20,23,24,unmodifi:917,944,unnecessari:23,unpack:903,unpars:43,48,407,409,unpleas:14,unport:917,unprint:3,23,unqualifi:33,unquot:6,unrecogn:904,unrestrict:32,900,unser:43,unset:43,48,171,951,unsign:91,92,93,94,97,111,116,120,279,311,361,404,407,409,803,809,812,816,827,846,851,855,857,889,894,unspecifi:21,951,unstabl:927,unsuccess:37,unsupport:37,904,unswapp:895,untest:904,until:3,6,14,21,23,43,894,895,899,904,913,916,937,untrust:43,951,unus:149,265,352,375,916,unusu:28,37,unwrap:43,48,updat:2,4,6,8,9,14,20,21,22,24,26,34,35,99,100,102,103,224,287,288,289,290,695,698,904,909,916,925,934,update_princ_encrypt:14,23,update_rel:932,upgrad:21,23,26,34,39,916,upn:20,21,350,637,639,705,916,upon:6,8,23,944,upper:3,19,23,39,942,uppercas:21,930,951,upstream:23,904,916,upstreamhostnam:23,uri:3,5,20,21,23,33,34,39,916,url:20,24,29,39,usa:917,usabl:48,usag:20,21,37,43,99,100,102,103,108,113,114,129,130,287,288,289,290,294,295,298,299,845,894,909,910,943,944,usc:944,use:0,3,4,5,6,7,8,14,15,16,20,21,22,23,24,25,26,28,29,33,34,35,36,37,38,39,40,41,43,46,48,55,78,105,223,236,268,275,315,329,344,359,375,389,403,407,414,863,864,882,894,899,901,902,903,904,906,908,912,915,916,917,918,919,920,921,922,925,929,932,933,934,936,937,940,943,944,946,950,951,use_mkei:14,23,usec:811,822,834,873,used:2,3,4,5,6,7,8,9,10,11,12,14,15,16,18,19,20,21,22,23,24,25,26,28,34,36,37,38,39,40,41,43,46,56,81,98,100,103,121,129,144,223,224,227,228,229,235,241,247,248,254,258,260,264,267,277,288,290,298,315,321,325,326,327,329,330,331,344,345,352,356,359,360,375,403,405,414,416,738,823,845,854,864,868,883,894,895,898,899,900,901,908,909,912,913,915,916,917,919,920,921,922,923,929,932,934,937,939,940,941,942,943,944,946,948,949,951,useful:8,9,25,26,33,39,69,74,895,899,904,917,934,943,946,947,951,useless:14,user:0,3,5,6,8,14,15,16,19,20,21,22,23,25,26,33,34,35,36,37,38,39,41,43,48,56,90,136,169,224,227,326,330,331,333,361,551,641,662,728,735,868,895,896,899,901,902,904,906,914,915,916,917,920,933,934,936,937,939,940,942,944,946,949,950,951,user_dn:5,23,userconfig:21,userdata:326,331,userdata_out:356,360,userid:21,904,usernam:3,12,21,23,34,36,37,43,319,673,937,940,userok:930,userpolici:5,23,userprincipalnam:20,uses:2,3,4,14,15,18,19,20,21,22,23,24,26,28,35,36,37,39,40,43,45,101,246,329,382,383,406,417,419,883,895,899,908,909,910,912,916,922,932,942,943,951,using:3,6,11,12,14,15,16,18,19,20,21,22,23,24,25,26,28,29,33,34,36,37,38,39,40,41,43,46,48,113,117,125,129,156,228,247,250,267,279,294,298,300,325,327,331,344,354,359,366,375,378,404,618,874,895,898,903,904,906,908,910,913,916,921,922,923,929,930,936,937,940,941,944,946,947,949,950,951,usr:5,8,12,20,21,23,34,904,906,915,943,944,usual:3,10,12,20,21,23,25,35,37,39,46,99,287,895,898,904,908,921,937,946,951,utc:23,utf:46,350,365,373,707,916,917,util:22,23,34,39,47,902,904,917,939,951,uucp:20,v4_instance_convert:21,v4_realm:21,v4cred:51,v5cred:51,va_list:48,92,94,vagu:904,val:198,199,200,201,202,203,204,206,207,208,209,211,212,215,218,219,221,222,valid:20,21,23,39,43,48,66,83,109,124,129,153,160,224,235,248,260,269,275,298,301,330,333,342,343,345,350,359,365,366,408,414,882,895,896,901,908,912,916,928,937,940,946,950,951,valid_int_bit:787,valid_uint_bit:787,valu:3,5,6,10,14,15,16,19,20,21,22,23,24,25,26,28,33,34,36,37,38,39,43,46,48,66,83,117,125,126,136,151,153,156,166,224,245,248,252,263,265,269,296,301,333,368,369,371,375,386,388,397,720,726,727,729,731,736,738,794,795,796,835,839,852,863,864,883,894,895,896,898,899,904,905,906,908,909,910,912,913,916,920,922,929,930,932,937,939,940,941,943,944,949,951,valuabl:46,917,vaniti:38,vararg:91,vari:15,33,903,915,939,940,variabl:2,3,4,5,6,7,8,9,10,11,12,15,16,19,20,21,23,24,25,28,30,34,35,37,38,39,40,41,43,48,93,136,141,155,269,282,386,387,895,898,899,905,916,932,933,939,940,941,942,944,945,946,947,variad:91,417,419,variant:23,904,916,922,varieti:26,variou:14,30,43,359,901,905,916,937,vendor:736,877,943,verbatim:917,verbos:3,6,15,23,902,916,940,veri:14,20,21,23,932,verif:20,21,34,43,46,48,414,895,935,937,verifi:5,20,21,23,34,37,43,48,241,356,357,358,359,360,361,899,903,916,920,929,936,937,944,verifier_cred_handl:922,verify_ap_req_nofail:21,versa:37,916,version:0,2,3,5,6,9,10,14,15,20,23,24,26,29,38,42,43,44,48,155,228,247,310,315,363,375,616,721,819,821,843,848,881,894,898,902,903,904,906,908,910,912,913,916,917,921,927,931,941,943,944,946,947,951,verto:904,917,vesion:321,405,veto:928,via:0,3,6,8,20,21,23,34,35,46,48,274,386,402,824,916,922,924,944,950,vice:37,916,view:8,23,34,935,view_polici:23,viola:15,virtual:15,21,visibl:14,23,25,916,visit:937,vista:26,916,visual:916,vnder:14,vno:3,14,23,310,315,848,volum:916,vopt:46,vpath:902,903,vprintf:417,418,419,vtabl:920,921,929,932,vulner:14,23,32,46,916,934,wai:21,23,28,39,43,46,126,236,250,375,894,895,896,898,904,906,916,917,925,930,936,937,949,wait:8,20,23,39,wake:15,walk:6,23,936,want:3,23,28,34,545,551,902,931,936,937,944,warn:3,23,26,245,906,916,917,warranti:917,wasn:44,weak:14,20,21,26,41,web:34,895,916,week:5,23,weight:39,well:14,21,23,34,38,43,46,343,648,901,904,916,923,wellknown:37,46,502,761,went:937,were:14,15,21,34,43,414,618,895,916,917,937,what:6,14,19,20,21,23,26,38,43,899,920,921,929,933,936,937,943,whatev:39,whatsoev:917,when:3,4,6,8,9,10,12,14,15,16,17,20,21,22,23,26,28,29,33,34,36,37,38,39,40,41,43,46,49,65,67,68,72,73,76,77,78,79,85,91,92,93,111,113,115,125,126,132,136,141,143,145,150,153,154,163,164,169,172,173,174,175,176,177,178,180,181,182,183,194,195,224,227,228,229,230,231,235,236,250,254,258,260,261,265,268,272,275,280,282,286,294,310,315,317,318,321,322,324,325,326,327,328,329,330,331,332,335,338,339,344,345,352,354,355,356,357,359,360,361,363,375,389,401,403,405,406,408,736,737,738,895,898,904,906,908,913,915,916,918,922,923,927,930,932,933,934,936,937,939,940,941,943,944,946,949,951,whenev:46,where:3,4,6,7,8,14,15,17,20,21,23,25,28,39,43,46,317,389,894,895,898,899,902,903,904,909,916,921,937,940,944,951,whether:4,6,8,10,14,20,21,28,35,36,43,46,48,105,223,241,242,243,245,249,253,255,319,407,903,909,916,917,919,926,933,937,944,which:3,4,5,6,7,8,9,10,11,12,14,15,19,20,21,22,23,24,25,26,28,29,33,34,35,36,37,38,39,40,41,43,46,126,173,195,229,230,245,250,280,310,330,359,366,368,371,372,882,883,894,895,898,899,901,902,903,904,905,908,909,910,912,913,915,916,917,918,920,921,922,925,926,927,928,929,931,932,933,937,940,943,944,946,949,950,951,whichev:15,whitespac:3,20,21,23,who:0,5,16,20,23,25,34,37,936,937,whoami:921,whole:23,37,141,155,342,whom:917,936,whose:3,5,10,15,17,19,21,23,34,38,40,43,46,132,217,229,908,912,937,950,wicker:921,wicker_appear:921,wicker_brac:921,wicker_construct:921,wicker_foot:921,wicker_materi:921,wicker_slat:921,wide:21,29,36,wiki:42,902,916,wild:3,23,wildcard:19,20,916,949,willi:14,willing:20,21,26,win:917,winbind:28,winbind_krb5_loc:28,window:21,26,28,29,42,301,382,383,637,639,684,701,895,899,901,913,916,921,922,932,937,wish:16,21,34,39,43,250,902,903,904,905,917,922,933,936,937,951,with_realm:300,341,343,within:3,15,20,21,23,24,34,35,39,43,48,132,154,252,261,356,360,365,373,386,845,895,910,916,917,922,940,949,951,without:3,14,19,20,21,23,24,28,32,34,35,36,37,43,133,368,371,538,864,895,899,902,904,913,916,917,936,937,944,951,wkt:11,won:21,37,937,worcest:917,word:21,34,937,work:2,3,4,6,21,23,34,35,36,39,40,43,895,904,916,917,929,930,934,936,937,951,workdai:33,worker:10,24,workflow:14,workstat:46,worri:22,902,951,wors:21,worst:14,worth:32,would:5,6,14,16,17,20,21,23,25,28,32,34,37,38,39,40,43,46,900,916,922,936,937,943,950,951,wrap:23,48,300,320,922,wrapper:887,909,910,wrfile:14,writabl:15,34,316,932,write:0,6,8,10,11,20,21,22,23,24,28,34,35,251,352,387,895,913,916,921,932,951,writeabl:302,writer:0,written:3,4,155,848,898,913,917,wrong:35,37,917,937,944,wsgi:29,www:22,42,906,916,x11r6:902,x509:37,916,940,x509_anchor:21,940,x509_proxi:21,x509_proxy_ca:21,x509_user_ident:16,21,940,x86:904,916,x86_64:904,916,xconsortium:902,xml:906,xore:21,359,xst:3,15,xvm:14,xyz:951,yacc:904,year:45,896,916,yes:3,5,23,904,940,yet:6,21,23,26,34,37,38,895,904,925,937,yflag:904,yield:929,you:0,3,5,12,15,16,17,20,21,22,23,24,28,32,33,34,35,37,39,40,41,735,896,900,902,903,904,905,906,917,934,936,937,939,944,951,your:0,12,17,20,21,23,26,32,33,34,37,39,902,903,904,917,925,935,937,939,948,951,your_princnam:37,your_realmnam:37,yourdir:34,yourself:937,951,yymmddhhmmss:896,yyyi:896,yyyymmddhhmmss:896,zanarotti:46,zephyr:14,917,zero:3,21,24,39,43,44,48,129,130,203,241,245,260,261,284,298,299,310,738,740,863,908,909,912,913,916,921,zone:14,39,896,zonetest:14},titles:"Contributing to the MIT Kerberos Documentation","Administration  programs","k5srvutil","kadmin","kadmind","kdb5_ldap_util","kdb5_util","kprop","kpropd","kproplog","krb5kdc","ktutil","sserver","Advanced topics","Retiring DES","Application servers","Authentication indicators","Backups of secure hosts","Configuration Files","kadm5.acl","kdc.conf","krb5.conf","Configuring Kerberos with OpenLDAP back-end","Database administration","Database types","Addressing dictionary attack risks","Encryption types","Environment variables","Host configuration","HTTPS proxy configuration","For administrators","Installation guide","UNIX Application Servers","Installing and configuring UNIX client machines","Installing KDCs","Account lockout","OTP Preauthentication","PKINIT configuration","Principal names and DNS","Realm configuration decisions","SPAKE Preauthentication","Troubleshooting","Various links","Developing with GSSAPI","Differences between Heimdal and MIT Kerberos API","For application developers","Initial credentials","Principal manipulation and parsing","krb5 API","krb5_425_conv_principal -  Convert a Kerberos V4 principal to a Kerberos V5 principal.","krb5_524_conv_principal -  Convert a Kerberos V5 principal to a Kerberos V4 principal.","krb5_524_convert_creds -  Convert a Kerberos V5 credentials to a Kerberos V4 credentials.","krb5_address_compare -  Compare two Kerberos addresses.","krb5_address_order -  Return an ordering of the specified addresses.","krb5_address_search -  Search a list of addresses for a specified address.","krb5_allow_weak_crypto -  Allow the application to override the profile\u2019s allow_weak_crypto setting.","krb5_aname_to_localname -  Convert a principal name to a local name.","krb5_anonymous_principal -  Build an anonymous principal.","krb5_anonymous_realm -  Return an anonymous realm data.","krb5_appdefault_boolean -  Retrieve a boolean value from the appdefaults section of krb5.conf.","krb5_appdefault_string -  Retrieve a string value from the appdefaults section of krb5.conf.","krb5_auth_con_free -  Free a krb5_auth_context structure.","krb5_auth_con_genaddrs -  Generate auth context addresses from a connected socket.","krb5_auth_con_get_checksum_func -  Get the checksum callback from an auth context.","krb5_auth_con_getaddrs -  Retrieve address fields from an auth context.","krb5_auth_con_getauthenticator -  Retrieve the authenticator from an auth context.","krb5_auth_con_getflags -  Retrieve flags from a krb5_auth_context structure.","krb5_auth_con_getkey -  Retrieve the session key from an auth context as a keyblock.","krb5_auth_con_getkey_k -  Retrieve the session key from an auth context.","krb5_auth_con_getlocalseqnumber -  Retrieve the local sequence number from an auth context.","krb5_auth_con_getlocalsubkey","krb5_auth_con_getrcache -  Retrieve the replay cache from an auth context.","krb5_auth_con_getrecvsubkey -  Retrieve the receiving subkey from an auth context as a keyblock.","krb5_auth_con_getrecvsubkey_k -  Retrieve the receiving subkey from an auth context as a keyblock.","krb5_auth_con_getremoteseqnumber -  Retrieve the remote sequence number from an auth context.","krb5_auth_con_getremotesubkey","krb5_auth_con_getsendsubkey -  Retrieve the send subkey from an auth context as a keyblock.","krb5_auth_con_getsendsubkey_k -  Retrieve the send subkey from an auth context.","krb5_auth_con_init -  Create and initialize an authentication context.","krb5_auth_con_initivector -  Cause an auth context to use cipher state.","krb5_auth_con_set_checksum_func -  Set a checksum callback in an auth context.","krb5_auth_con_set_req_cksumtype -  Set checksum type in an an auth context.","krb5_auth_con_setaddrs -  Set the local and remote addresses in an auth context.","krb5_auth_con_setflags -  Set a flags field in a krb5_auth_context structure.","krb5_auth_con_setports -  Set local and remote port fields in an auth context.","krb5_auth_con_setrcache -  Set the replay cache in an auth context.","krb5_auth_con_setrecvsubkey -  Set the receiving subkey in an auth context with a keyblock.","krb5_auth_con_setrecvsubkey_k -  Set the receiving subkey in an auth context.","krb5_auth_con_setsendsubkey -  Set the send subkey in an auth context with a keyblock.","krb5_auth_con_setsendsubkey_k -  Set the send subkey in an auth context.","krb5_auth_con_setuseruserkey -  Set the session key in an auth context.","krb5_build_principal -  Build a principal name using null-terminated strings.","krb5_build_principal_alloc_va -  Build a principal name, using a precomputed variable argument list.","krb5_build_principal_ext -  Build a principal name using length-counted strings.","krb5_build_principal_va","krb5_c_block_size -  Return cipher block size.","krb5_c_checksum_length -  Return the length of checksums for a checksum type.","krb5_c_crypto_length -  Return a length of a message field specific to the encryption type.","krb5_c_crypto_length_iov -  Fill in lengths for header, trailer and padding in a IOV array.","krb5_c_decrypt -  Decrypt data using a key (operates on keyblock).","krb5_c_decrypt_iov -  Decrypt data in place supporting AEAD (operates on keyblock).","krb5_c_derive_prfplus -  Derive a key using some input data (via RFC 6113 PRF+).","krb5_c_encrypt -  Encrypt data using a key (operates on keyblock).","krb5_c_encrypt_iov -  Encrypt data in place supporting AEAD (operates on keyblock).","krb5_c_encrypt_length -  Compute encrypted data length.","krb5_c_enctype_compare -  Compare two encryption types.","krb5_c_free_state -  Free a cipher state previously allocated by krb5_c_init_state() .","krb5_c_fx_cf2_simple -  Compute the KRB-FX-CF2 combination of two keys and pepper strings.","krb5_c_init_state -  Initialize a new cipher state.","krb5_c_is_coll_proof_cksum -  Test whether a checksum type is collision-proof.","krb5_c_is_keyed_cksum -  Test whether a checksum type is keyed.","krb5_c_keyed_checksum_types -  Return a list of keyed checksum types usable with an encryption type.","krb5_c_keylengths -  Return length of the specified key in bytes.","krb5_c_make_checksum -  Compute a checksum (operates on keyblock).","krb5_c_make_checksum_iov -  Fill in a checksum element in IOV array (operates on keyblock)","krb5_c_make_random_key -  Generate an enctype-specific random encryption key.","krb5_c_padding_length -  Return a number of padding octets.","krb5_c_prf -  Generate enctype-specific pseudo-random bytes.","krb5_c_prf_length -  Get the output length of pseudo-random functions for an encryption type.","krb5_c_prfplus -  Generate pseudo-random bytes using RFC 6113 PRF+.","krb5_c_random_add_entropy","krb5_c_random_make_octets -  Generate pseudo-random bytes.","krb5_c_random_os_entropy","krb5_c_random_seed","krb5_c_random_to_key -  Generate an enctype-specific key from random data.","krb5_c_string_to_key -  Convert a string (such a password) to a key.","krb5_c_string_to_key_with_params -  Convert a string (such as a password) to a key with additional parameters.","krb5_c_valid_cksumtype -  Verify that specified checksum type is a valid Kerberos checksum type.","krb5_c_valid_enctype -  Verify that a specified encryption type is a valid Kerberos encryption type.","krb5_c_verify_checksum -  Verify a checksum (operates on keyblock).","krb5_c_verify_checksum_iov -  Validate a checksum element in IOV array (operates on keyblock).","krb5_calculate_checksum","krb5_cc_cache_match -  Find a credential cache with a specified client principal.","krb5_cc_close -  Close a credential cache handle.","krb5_cc_copy_creds -  Copy a credential cache.","krb5_cc_default -  Resolve the default credential cache name.","krb5_cc_default_name -  Return the name of the default credential cache.","krb5_cc_destroy -  Destroy a credential cache.","krb5_cc_dup -  Duplicate ccache handle.","krb5_cc_end_seq_get -  Finish a series of sequential processing credential cache entries.","krb5_cc_gen_new","krb5_cc_get_config -  Get a configuration value from a credential cache.","krb5_cc_get_flags -  Retrieve flags from a credential cache structure.","krb5_cc_get_full_name -  Retrieve the full name of a credential cache.","krb5_cc_get_name -  Retrieve the name, but not type of a credential cache.","krb5_cc_get_principal -  Get the default principal of a credential cache.","krb5_cc_get_type -  Retrieve the type of a credential cache.","krb5_cc_initialize -  Initialize a credential cache.","krb5_cc_move -  Move a credential cache.","krb5_cc_new_unique -  Create a new credential cache of the specified type with a unique name.","krb5_cc_next_cred -  Retrieve the next entry from the credential cache.","krb5_cc_remove_cred -  Remove credentials from a credential cache.","krb5_cc_resolve -  Resolve a credential cache name.","krb5_cc_retrieve_cred -  Retrieve a specified credentials from a credential cache.","krb5_cc_select -  Select a credential cache to use with a server principal.","krb5_cc_set_config -  Store a configuration value in a credential cache.","krb5_cc_set_default_name -  Set the default credential cache name.","krb5_cc_set_flags -  Set options flags on a credential cache.","krb5_cc_start_seq_get -  Prepare to sequentially read every credential in a credential cache.","krb5_cc_store_cred -  Store credentials in a credential cache.","krb5_cc_support_switch -  Determine whether a credential cache type supports switching.","krb5_cc_switch -  Make a credential cache the primary cache for its collection.","krb5_cccol_cursor_free -  Free a credential cache collection cursor.","krb5_cccol_cursor_new -  Prepare to iterate over the collection of known credential caches.","krb5_cccol_cursor_next -  Get the next credential cache in the collection.","krb5_cccol_have_content -  Check if the credential cache collection contains any initialized caches.","krb5_change_password -  Change a password for an existing Kerberos account.","krb5_check_clockskew -  Check if a timestamp is within the allowed clock skew of the current time.","krb5_checksum_size","krb5_chpw_message -  Get a result message for changing or setting a password.","krb5_cksumtype_to_string -  Convert a checksum type to a string.","krb5_clear_error_message -  Clear the extended error message in a context.","krb5_copy_addresses -  Copy an array of addresses.","krb5_copy_authdata -  Copy an authorization data list.","krb5_copy_authenticator -  Copy a krb5_authenticator structure.","krb5_copy_checksum -  Copy a krb5_checksum structure.","krb5_copy_context -  Copy a krb5_context structure.","krb5_copy_creds -  Copy a krb5_creds structure.","krb5_copy_data -  Copy a krb5_data object.","krb5_copy_error_message -  Copy the most recent extended error message from one context to another.","krb5_copy_keyblock -  Copy a keyblock.","krb5_copy_keyblock_contents -  Copy the contents of a keyblock.","krb5_copy_principal -  Copy a principal.","krb5_copy_ticket -  Copy a krb5_ticket structure.","krb5_decode_authdata_container -  Unwrap authorization data.","krb5_decode_ticket -  Decode an ASN.1-formatted ticket.","krb5_decrypt","krb5_deltat_to_string -  Convert a relative time value to a string.","krb5_eblock_enctype","krb5_encode_authdata_container -  Wrap authorization data in a container.","krb5_encrypt","krb5_encrypt_size","krb5_enctype_to_name -  Convert an encryption type to a name or alias.","krb5_enctype_to_string -  Convert an encryption type to a string.","krb5_expand_hostname -  Canonicalize a hostname, possibly using name service.","krb5_find_authdata -  Find authorization data elements.","krb5_finish_key","krb5_finish_random_key","krb5_free_addresses -  Free the data stored in array of addresses.","krb5_free_ap_rep_enc_part -  Free a krb5_ap_rep_enc_part structure.","krb5_free_authdata -  Free the storage assigned to array of authentication data.","krb5_free_authenticator -  Free a krb5_authenticator structure.","krb5_free_checksum -  Free a krb5_checksum structure.","krb5_free_checksum_contents -  Free the contents of a krb5_checksum structure.","krb5_free_cksumtypes -  Free an array of checksum types.","krb5_free_context -  Free a krb5 library context.","krb5_free_cred_contents -  Free the contents of a krb5_creds structure.","krb5_free_creds -  Free a krb5_creds structure.","krb5_free_data -  Free a krb5_data structure.","krb5_free_data_contents -  Free the contents of a krb5_data structure and zero the data field.","krb5_free_default_realm -  Free a default realm string returned by krb5_get_default_realm() .","krb5_free_enctypes -  Free an array of encryption types.","krb5_free_error -  Free an error allocated by krb5_read_error() or krb5_sendauth() .","krb5_free_error_message -  Free an error message generated by krb5_get_error_message() .","krb5_free_host_realm -  Free the memory allocated by krb5_get_host_realm() .","krb5_free_keyblock -  Free a krb5_keyblock structure.","krb5_free_keyblock_contents -  Free the contents of a krb5_keyblock structure.","krb5_free_keytab_entry_contents -  Free the contents of a key table entry.","krb5_free_principal -  Free the storage assigned to a principal.","krb5_free_string -  Free a string allocated by a krb5 function.","krb5_free_tgt_creds -  Free an array of credential structures.","krb5_free_ticket -  Free a ticket.","krb5_free_unparsed_name -  Free a string representation of a principal.","krb5_fwd_tgt_creds -  Get a forwarded TGT and format a KRB-CRED message.","krb5_get_credentials -  Get an additional ticket.","krb5_get_credentials_renew","krb5_get_credentials_validate","krb5_get_default_realm -  Retrieve the default realm.","krb5_get_error_message -  Get the (possibly extended) error message for a code.","krb5_get_etype_info -  Retrieve enctype, salt and s2kparams from KDC.","krb5_get_fallback_host_realm","krb5_get_host_realm -  Get the Kerberos realm names for a host.","krb5_get_in_tkt_with_keytab","krb5_get_in_tkt_with_password","krb5_get_in_tkt_with_skey","krb5_get_init_creds_keytab -  Get initial credentials using a key table.","krb5_get_init_creds_opt_alloc -  Allocate a new initial credential options structure.","krb5_get_init_creds_opt_free -  Free initial credential options.","krb5_get_init_creds_opt_get_fast_flags -  Retrieve FAST flags from initial credential options.","krb5_get_init_creds_opt_init","krb5_get_init_creds_opt_set_address_list -  Set address restrictions in initial credential options.","krb5_get_init_creds_opt_set_anonymous -  Set or unset the anonymous flag in initial credential options.","krb5_get_init_creds_opt_set_canonicalize -  Set or unset the canonicalize flag in initialcredential options.","krb5_get_init_creds_opt_set_change_password_prompt -  Set or unset change-password-prompt flag in initial credential options.","krb5_get_init_creds_opt_set_etype_list -  Set allowable encryption types in initial credential options.","krb5_get_init_creds_opt_set_expire_callback -  Set an expiration callback in initial credential options.","krb5_get_init_creds_opt_set_fast_ccache -  Set FAST armor cache in initial credential options.","krb5_get_init_creds_opt_set_fast_ccache_name -  Set location of FAST armor ccache in initial credential options.","krb5_get_init_creds_opt_set_fast_flags -  Set FAST flags in initial credential options.","krb5_get_init_creds_opt_set_forwardable -  Set or unset the forwardable flag in initial credential options.","krb5_get_init_creds_opt_set_in_ccache -  Set an input credential cache in initial credential options.","krb5_get_init_creds_opt_set_out_ccache -  Set an output credential cache in initial credential options.","krb5_get_init_creds_opt_set_pa -  Supply options for preauthentication in initial credential options.","krb5_get_init_creds_opt_set_pac_request -  Ask the KDC to include or not include a PAC in the ticket.","krb5_get_init_creds_opt_set_preauth_list -  Set preauthentication types in initial credential options.","krb5_get_init_creds_opt_set_proxiable -  Set or unset the proxiable flag in initial credential options.","krb5_get_init_creds_opt_set_renew_life -  Set the ticket renewal lifetime in initial credential options.","krb5_get_init_creds_opt_set_responder -  Set the responder function in initial credential options.","krb5_get_init_creds_opt_set_salt -  Set salt for optimistic preauthentication in initial credential options.","krb5_get_init_creds_opt_set_tkt_life -  Set the ticket lifetime in initial credential options.","krb5_get_init_creds_password -  Get initial credentials using a password.","krb5_get_permitted_enctypes -  Return a list of encryption types permitted for session keys.","krb5_get_profile -  Retrieve configuration profile from the context.","krb5_get_prompt_types -  Get prompt types array from a context.","krb5_get_renewed_creds -  Get renewed credential from KDC using an existing credential.","krb5_get_server_rcache -  Generate a replay cache object for server use and open it.","krb5_get_time_offsets -  Return the time offsets from the os context.","krb5_get_validated_creds -  Get validated credentials from the KDC.","krb5_init_context -  Create a krb5 library context.","krb5_init_context_profile -  Create a krb5 library context using a specified profile.","krb5_init_creds_free -  Free an initial credentials context.","krb5_init_creds_get -  Acquire credentials using an initial credentials context.","krb5_init_creds_get_creds -  Retrieve acquired credentials from an initial credentials context.","krb5_init_creds_get_error -  Get the last error from KDC from an initial credentials context.","krb5_init_creds_get_times -  Retrieve ticket times from an initial credentials context.","krb5_init_creds_init -  Create a context for acquiring initial credentials.","krb5_init_creds_set_keytab -  Specify a keytab to use for acquiring initial credentials.","krb5_init_creds_set_password -  Set a password for acquiring initial credentials.","krb5_init_creds_set_service -  Specify a service principal for acquiring initial credentials.","krb5_init_creds_step -  Get the next KDC request for acquiring initial credentials.","krb5_init_keyblock -  Initialize an empty krb5_keyblock .","krb5_init_random_key","krb5_init_secure_context -  Create a krb5 library context using only configuration files.","krb5_is_config_principal -  Test whether a principal is a configuration principal.","krb5_is_referral_realm -  Check for a match with KRB5_REFERRAL_REALM.","krb5_is_thread_safe -  Test whether the Kerberos library was built with multithread support.","krb5_k_create_key -  Create a krb5_key from the enctype and key data in a keyblock.","krb5_k_decrypt -  Decrypt data using a key (operates on opaque key).","krb5_k_decrypt_iov -  Decrypt data in place supporting AEAD (operates on opaque key).","krb5_k_encrypt -  Encrypt data using a key (operates on opaque key).","krb5_k_encrypt_iov -  Encrypt data in place supporting AEAD (operates on opaque key).","krb5_k_free_key -  Decrement the reference count on a key and free it if it hits zero.","krb5_k_key_enctype -  Retrieve the enctype of a krb5_key structure.","krb5_k_key_keyblock -  Retrieve a copy of the keyblock from a krb5_key structure.","krb5_k_make_checksum -  Compute a checksum (operates on opaque key).","krb5_k_make_checksum_iov -  Fill in a checksum element in IOV array (operates on opaque key)","krb5_k_prf -  Generate enctype-specific pseudo-random bytes (operates on opaque key).","krb5_k_reference_key -  Increment the reference count on a key.","krb5_k_verify_checksum -  Verify a checksum (operates on opaque key).","krb5_k_verify_checksum_iov -  Validate a checksum element in IOV array (operates on opaque key).","krb5_kdc_sign_ticket -  Sign a PAC, possibly including a ticket signature.","krb5_kdc_verify_ticket -  Verify a PAC, possibly including ticket signature.","krb5_kt_add_entry -  Add a new entry to a key table.","krb5_kt_client_default -  Resolve the default client key table.","krb5_kt_close -  Close a key table handle.","krb5_kt_default -  Resolve the default key table.","krb5_kt_default_name -  Get the default key table name.","krb5_kt_dup -  Duplicate keytab handle.","krb5_kt_end_seq_get -  Release a keytab cursor.","krb5_kt_free_entry","krb5_kt_get_entry -  Get an entry from a key table.","krb5_kt_get_name -  Get a key table name.","krb5_kt_get_type -  Return the type of a key table.","krb5_kt_have_content -  Check if a keytab exists and contains entries.","krb5_kt_next_entry -  Retrieve the next entry from the key table.","krb5_kt_read_service_key -  Retrieve a service key from a key table.","krb5_kt_remove_entry -  Remove an entry from a key table.","krb5_kt_resolve -  Get a handle for a key table.","krb5_kt_start_seq_get -  Start a sequential retrieval of key table entries.","krb5_kuserok -  Determine if a principal is authorized to log in as a local user.","krb5_make_authdata_kdc_issued -  Encode and sign AD-KDCIssued authorization data.","krb5_marshal_credentials -  Serialize a krb5_creds object.","krb5_merge_authdata -  Merge two authorization data lists into a new list.","krb5_mk_1cred -  Format a KRB-CRED message for a single set of credentials.","krb5_mk_error -  Format and encode a KRB_ERROR message.","krb5_mk_ncred -  Format a KRB-CRED message for an array of credentials.","krb5_mk_priv -  Format a KRB-PRIV message.","krb5_mk_rep -  Format and encrypt a KRB_AP_REP message.","krb5_mk_rep_dce -  Format and encrypt a KRB_AP_REP message for DCE RPC.","krb5_mk_req -  Create a KRB_AP_REQ message.","krb5_mk_req_extended -  Create a KRB_AP_REQ message using supplied credentials.","krb5_mk_safe -  Format a KRB-SAFE message.","krb5_os_localaddr -  Return all interface addresses for this host.","krb5_pac_add_buffer -  Add a buffer to a PAC handle.","krb5_pac_free -  Free a PAC handle.","krb5_pac_get_buffer -  Retrieve a buffer value from a PAC.","krb5_pac_get_client_info -  Read client information from a PAC.","krb5_pac_get_types -  Return an array of buffer types in a PAC handle.","krb5_pac_init -  Create an empty Privilege Attribute Certificate (PAC) handle.","krb5_pac_parse -  Unparse an encoded PAC into a new handle.","krb5_pac_sign","krb5_pac_sign_ext","krb5_pac_verify -  Verify a PAC.","krb5_pac_verify_ext -  Verify a PAC, possibly from a specified realm.","krb5_parse_name -  Convert a string principal name to a krb5_principal structure.","krb5_parse_name_flags -  Convert a string principal name to a krb5_principal with flags.","krb5_prepend_error_message -  Add a prefix to the message for an error code.","krb5_principal2salt -  Convert a principal name into the default salt for that principal.","krb5_principal_compare -  Compare two principals.","krb5_principal_compare_any_realm -  Compare two principals ignoring realm components.","krb5_principal_compare_flags -  Compare two principals with additional flags.","krb5_process_key","krb5_prompter_posix -  Prompt user for password.","krb5_random_key","krb5_rd_cred -  Read and validate a KRB-CRED message.","krb5_rd_error -  Decode a KRB-ERROR message.","krb5_rd_priv -  Process a KRB-PRIV message.","krb5_rd_rep -  Parse and decrypt a KRB_AP_REP message.","krb5_rd_rep_dce -  Parse and decrypt a KRB_AP_REP message for DCE RPC.","krb5_rd_req -  Parse and decrypt a KRB_AP_REQ message.","krb5_rd_safe -  Process KRB-SAFE message.","krb5_read_password -  Read a password from keyboard input.","krb5_realm_compare -  Compare the realms of two principals.","krb5_recvauth -  Server function for sendauth protocol.","krb5_recvauth_version -  Server function for sendauth protocol with version parameter.","krb5_responder_get_challenge -  Retrieve the challenge data for a given question in the responder context.","krb5_responder_list_questions -  List the question names contained in the responder context.","krb5_responder_otp_challenge_free -  Free the value returned by krb5_responder_otp_get_challenge() .","krb5_responder_otp_get_challenge -  Decode the KRB5_RESPONDER_QUESTION_OTP to a C struct.","krb5_responder_otp_set_answer -  Answer the KRB5_RESPONDER_QUESTION_OTP question.","krb5_responder_pkinit_challenge_free -  Free the value returned by krb5_responder_pkinit_get_challenge() .","krb5_responder_pkinit_get_challenge -  Decode the KRB5_RESPONDER_QUESTION_PKINIT to a C struct.","krb5_responder_pkinit_set_answer -  Answer the KRB5_RESPONDER_QUESTION_PKINIT question for one identity.","krb5_responder_set_answer -  Answer a named question in the responder context.","krb5_salttype_to_string -  Convert a salt type to a string.","krb5_sendauth -  Client function for sendauth protocol.","krb5_server_decrypt_ticket_keytab -  Decrypt a ticket using the specified key table.","krb5_set_default_realm -  Override the default realm for the specified context.","krb5_set_default_tgs_enctypes -  Set default TGS encryption types in a krb5_context structure.","krb5_set_error_message -  Set an extended error message for an error code.","krb5_set_kdc_recv_hook -  Set a KDC post-receive hook function.","krb5_set_kdc_send_hook -  Set a KDC pre-send hook function.","krb5_set_password -  Set a password for a principal using specified credentials.","krb5_set_password_using_ccache -  Set a password for a principal using cached credentials.","krb5_set_principal_realm -  Set the realm field of a principal.","krb5_set_real_time -  Set time offset field in a krb5_context structure.","krb5_set_trace_callback -  Specify a callback function for trace events.","krb5_set_trace_filename -  Specify a file name for directing trace events.","krb5_sname_match -  Test whether a principal matches a matching principal.","krb5_sname_to_principal -  Generate a full principal name from a service name.","krb5_string_to_cksumtype -  Convert a string to a checksum type.","krb5_string_to_deltat -  Convert a string to a delta time value.","krb5_string_to_enctype -  Convert a string to an encryption type.","krb5_string_to_key","krb5_string_to_salttype -  Convert a string to a salt type.","krb5_string_to_timestamp -  Convert a string to a timestamp.","krb5_timeofday -  Retrieve the current time with context specific time offset adjustment.","krb5_timestamp_to_sfstring -  Convert a timestamp to a string, with optional output padding.","krb5_timestamp_to_string -  Convert a timestamp to a string.","krb5_tkt_creds_free -  Free a TGS request context.","krb5_tkt_creds_get -  Synchronously obtain credentials using a TGS request context.","krb5_tkt_creds_get_creds -  Retrieve acquired credentials from a TGS request context.","krb5_tkt_creds_get_times -  Retrieve ticket times from a TGS request context.","krb5_tkt_creds_init -  Create a context to get credentials from a KDC\u2019s Ticket Granting Service.","krb5_tkt_creds_step -  Get the next KDC request in a TGS exchange.","krb5_unmarshal_credentials -  Deserialize a krb5_creds object.","krb5_unparse_name -  Convert a krb5_principal structure to a string representation.","krb5_unparse_name_ext -  Convert krb5_principal structure to string and length.","krb5_unparse_name_flags -  Convert krb5_principal structure to a string with flags.","krb5_unparse_name_flags_ext -  Convert krb5_principal structure to string format with flags.","krb5_us_timeofday -  Retrieve the system time of day, in sec and ms, since the epoch.","krb5_use_enctype","krb5_verify_authdata_kdc_issued -  Unwrap and verify AD-KDCIssued authorization data.","krb5_verify_checksum","krb5_verify_init_creds -  Verify initial credentials against a keytab.","krb5_verify_init_creds_opt_init -  Initialize a credential verification options structure.","krb5_verify_init_creds_opt_set_ap_req_nofail -  Set whether credential verification is required.","krb5_vprepend_error_message -  Add a prefix to the message for an error code using a va_list.","krb5_vset_error_message -  Set an extended error message for an error code using a va_list.","krb5_vwrap_error_message -  Add a prefix to a different error code\u2019s message using a va_list.","krb5_wrap_error_message -  Add a prefix to a different error code\u2019s message.","Complete reference - API and datatypes","ADDRTYPE_ADDRPORT","ADDRTYPE_CHAOS","ADDRTYPE_DDP","ADDRTYPE_INET","ADDRTYPE_INET6","ADDRTYPE_IPPORT","ADDRTYPE_ISO","ADDRTYPE_IS_LOCAL","ADDRTYPE_NETBIOS","ADDRTYPE_XNS","AD_TYPE_EXTERNAL","AD_TYPE_FIELD_TYPE_MASK","AD_TYPE_REGISTERED","AD_TYPE_RESERVED","AP_OPTS_ETYPE_NEGOTIATION","AP_OPTS_MUTUAL_REQUIRED","AP_OPTS_RESERVED","AP_OPTS_USE_SESSION_KEY","AP_OPTS_USE_SUBKEY","AP_OPTS_WIRE_MASK","CKSUMTYPE_CMAC_CAMELLIA128","CKSUMTYPE_CMAC_CAMELLIA256","CKSUMTYPE_CRC32","CKSUMTYPE_DESCBC","CKSUMTYPE_HMAC_MD5_ARCFOUR","CKSUMTYPE_HMAC_SHA1_96_AES128","CKSUMTYPE_HMAC_SHA1_96_AES256","CKSUMTYPE_HMAC_SHA1_DES3","CKSUMTYPE_HMAC_SHA256_128_AES128","CKSUMTYPE_HMAC_SHA384_192_AES256","CKSUMTYPE_MD5_HMAC_ARCFOUR","CKSUMTYPE_NIST_SHA","CKSUMTYPE_RSA_MD4","CKSUMTYPE_RSA_MD4_DES","CKSUMTYPE_RSA_MD5","CKSUMTYPE_RSA_MD5_DES","CKSUMTYPE_SHA1","ENCTYPE_AES128_CTS_HMAC_SHA1_96","ENCTYPE_AES128_CTS_HMAC_SHA256_128","ENCTYPE_AES256_CTS_HMAC_SHA1_96","ENCTYPE_AES256_CTS_HMAC_SHA384_192","ENCTYPE_ARCFOUR_HMAC","ENCTYPE_ARCFOUR_HMAC_EXP","ENCTYPE_CAMELLIA128_CTS_CMAC","ENCTYPE_CAMELLIA256_CTS_CMAC","ENCTYPE_DES3_CBC_ENV","ENCTYPE_DES3_CBC_RAW","ENCTYPE_DES3_CBC_SHA","ENCTYPE_DES3_CBC_SHA1","ENCTYPE_DES_CBC_CRC","ENCTYPE_DES_CBC_MD4","ENCTYPE_DES_CBC_MD5","ENCTYPE_DES_CBC_RAW","ENCTYPE_DES_HMAC_SHA1","ENCTYPE_DSA_SHA1_CMS","ENCTYPE_MD5_RSA_CMS","ENCTYPE_NULL","ENCTYPE_RC2_CBC_ENV","ENCTYPE_RSA_ENV","ENCTYPE_RSA_ES_OAEP_ENV","ENCTYPE_SHA1_RSA_CMS","ENCTYPE_UNKNOWN","KDC_OPT_ALLOW_POSTDATE","KDC_OPT_CANONICALIZE","KDC_OPT_CNAME_IN_ADDL_TKT","KDC_OPT_DISABLE_TRANSITED_CHECK","KDC_OPT_ENC_TKT_IN_SKEY","KDC_OPT_FORWARDABLE","KDC_OPT_FORWARDED","KDC_OPT_POSTDATED","KDC_OPT_PROXIABLE","KDC_OPT_PROXY","KDC_OPT_RENEW","KDC_OPT_RENEWABLE","KDC_OPT_RENEWABLE_OK","KDC_OPT_REQUEST_ANONYMOUS","KDC_OPT_VALIDATE","KDC_TKT_COMMON_MASK","KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE","KRB5_ANONYMOUS_PRINCSTR","KRB5_ANONYMOUS_REALMSTR","KRB5_AP_REP","KRB5_AP_REQ","KRB5_AS_REP","KRB5_AS_REQ","KRB5_AUTHDATA_AND_OR","KRB5_AUTHDATA_AP_OPTIONS","KRB5_AUTHDATA_AUTH_INDICATOR","KRB5_AUTHDATA_CAMMAC","KRB5_AUTHDATA_ETYPE_NEGOTIATION","KRB5_AUTHDATA_FX_ARMOR","KRB5_AUTHDATA_IF_RELEVANT","KRB5_AUTHDATA_INITIAL_VERIFIED_CAS","KRB5_AUTHDATA_KDC_ISSUED","KRB5_AUTHDATA_MANDATORY_FOR_KDC","KRB5_AUTHDATA_OSF_DCE","KRB5_AUTHDATA_SESAME","KRB5_AUTHDATA_SIGNTICKET","KRB5_AUTHDATA_WIN2K_PAC","KRB5_AUTH_CONTEXT_DO_SEQUENCE","KRB5_AUTH_CONTEXT_DO_TIME","KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR","KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR","KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR","KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR","KRB5_AUTH_CONTEXT_PERMIT_ALL","KRB5_AUTH_CONTEXT_RET_SEQUENCE","KRB5_AUTH_CONTEXT_RET_TIME","KRB5_AUTH_CONTEXT_USE_SUBKEY","KRB5_CRED","KRB5_CRYPTO_TYPE_CHECKSUM","KRB5_CRYPTO_TYPE_DATA","KRB5_CRYPTO_TYPE_EMPTY","KRB5_CRYPTO_TYPE_HEADER","KRB5_CRYPTO_TYPE_PADDING","KRB5_CRYPTO_TYPE_SIGN_ONLY","KRB5_CRYPTO_TYPE_STREAM","KRB5_CRYPTO_TYPE_TRAILER","KRB5_CYBERSAFE_SECUREID","KRB5_DOMAIN_X500_COMPRESS","KRB5_ENCPADATA_REQ_ENC_PA_REP","KRB5_ERROR","KRB5_FAST_REQUIRED","KRB5_GC_CACHED","KRB5_GC_CANONICALIZE","KRB5_GC_CONSTRAINED_DELEGATION","KRB5_GC_FORWARDABLE","KRB5_GC_NO_STORE","KRB5_GC_NO_TRANSIT_CHECK","KRB5_GC_USER_USER","KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST","KRB5_GET_INIT_CREDS_OPT_ANONYMOUS","KRB5_GET_INIT_CREDS_OPT_CANONICALIZE","KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT","KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST","KRB5_GET_INIT_CREDS_OPT_FORWARDABLE","KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST","KRB5_GET_INIT_CREDS_OPT_PROXIABLE","KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE","KRB5_GET_INIT_CREDS_OPT_SALT","KRB5_GET_INIT_CREDS_OPT_TKT_LIFE","KRB5_INIT_CONTEXT_KDC","KRB5_INIT_CONTEXT_SECURE","KRB5_INIT_CREDS_STEP_FLAG_CONTINUE","KRB5_INT16_MAX","KRB5_INT16_MIN","KRB5_INT32_MAX","KRB5_INT32_MIN","KRB5_KEYUSAGE_AD_ITE","KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM","KRB5_KEYUSAGE_AD_MTE","KRB5_KEYUSAGE_AD_SIGNEDPATH","KRB5_KEYUSAGE_APP_DATA_CKSUM","KRB5_KEYUSAGE_APP_DATA_ENCRYPT","KRB5_KEYUSAGE_AP_REP_ENCPART","KRB5_KEYUSAGE_AP_REQ_AUTH","KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM","KRB5_KEYUSAGE_AS_REP_ENCPART","KRB5_KEYUSAGE_AS_REQ","KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS","KRB5_KEYUSAGE_CAMMAC","KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT","KRB5_KEYUSAGE_ENC_CHALLENGE_KDC","KRB5_KEYUSAGE_FAST_ENC","KRB5_KEYUSAGE_FAST_FINISHED","KRB5_KEYUSAGE_FAST_REP","KRB5_KEYUSAGE_FAST_REQ_CHKSUM","KRB5_KEYUSAGE_GSS_TOK_MIC","KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG","KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV","KRB5_KEYUSAGE_IAKERB_FINISHED","KRB5_KEYUSAGE_KDC_REP_TICKET","KRB5_KEYUSAGE_KRB_CRED_ENCPART","KRB5_KEYUSAGE_KRB_ERROR_CKSUM","KRB5_KEYUSAGE_KRB_PRIV_ENCPART","KRB5_KEYUSAGE_KRB_SAFE_CKSUM","KRB5_KEYUSAGE_PA_AS_FRESHNESS","KRB5_KEYUSAGE_PA_FX_COOKIE","KRB5_KEYUSAGE_PA_OTP_REQUEST","KRB5_KEYUSAGE_PA_PKINIT_KX","KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY","KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST","KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM","KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID","KRB5_KEYUSAGE_PA_SAM_RESPONSE","KRB5_KEYUSAGE_SPAKE","KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY","KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY","KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY","KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY","KRB5_KEYUSAGE_TGS_REQ_AUTH","KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM","KRB5_KPASSWD_ACCESSDENIED","KRB5_KPASSWD_AUTHERROR","KRB5_KPASSWD_BAD_VERSION","KRB5_KPASSWD_HARDERROR","KRB5_KPASSWD_INITIAL_FLAG_NEEDED","KRB5_KPASSWD_MALFORMED","KRB5_KPASSWD_SOFTERROR","KRB5_KPASSWD_SUCCESS","KRB5_LRQ_ALL_ACCT_EXPTIME","KRB5_LRQ_ALL_LAST_INITIAL","KRB5_LRQ_ALL_LAST_RENEWAL","KRB5_LRQ_ALL_LAST_REQ","KRB5_LRQ_ALL_LAST_TGT","KRB5_LRQ_ALL_LAST_TGT_ISSUED","KRB5_LRQ_ALL_PW_EXPTIME","KRB5_LRQ_NONE","KRB5_LRQ_ONE_ACCT_EXPTIME","KRB5_LRQ_ONE_LAST_INITIAL","KRB5_LRQ_ONE_LAST_RENEWAL","KRB5_LRQ_ONE_LAST_REQ","KRB5_LRQ_ONE_LAST_TGT","KRB5_LRQ_ONE_LAST_TGT_ISSUED","KRB5_LRQ_ONE_PW_EXPTIME","KRB5_NT_ENTERPRISE_PRINCIPAL","KRB5_NT_ENT_PRINCIPAL_AND_ID","KRB5_NT_MS_PRINCIPAL","KRB5_NT_MS_PRINCIPAL_AND_ID","KRB5_NT_PRINCIPAL","KRB5_NT_SMTP_NAME","KRB5_NT_SRV_HST","KRB5_NT_SRV_INST","KRB5_NT_SRV_XHST","KRB5_NT_UID","KRB5_NT_UNKNOWN","KRB5_NT_WELLKNOWN","KRB5_NT_X500_PRINCIPAL","KRB5_PAC_ATTRIBUTES_INFO","KRB5_PAC_CLIENT_CLAIMS","KRB5_PAC_CLIENT_INFO","KRB5_PAC_CREDENTIALS_INFO","KRB5_PAC_DELEGATION_INFO","KRB5_PAC_DEVICE_CLAIMS","KRB5_PAC_DEVICE_INFO","KRB5_PAC_LOGON_INFO","KRB5_PAC_PRIVSVR_CHECKSUM","KRB5_PAC_REQUESTOR","KRB5_PAC_SERVER_CHECKSUM","KRB5_PAC_TICKET_CHECKSUM","KRB5_PAC_UPN_DNS_INFO","KRB5_PADATA_AFS3_SALT","KRB5_PADATA_AP_REQ","KRB5_PADATA_AS_CHECKSUM","KRB5_PADATA_AS_FRESHNESS","KRB5_PADATA_ENCRYPTED_CHALLENGE","KRB5_PADATA_ENC_SANDIA_SECURID","KRB5_PADATA_ENC_TIMESTAMP","KRB5_PADATA_ENC_UNIX_TIME","KRB5_PADATA_ETYPE_INFO","KRB5_PADATA_ETYPE_INFO2","KRB5_PADATA_FOR_USER","KRB5_PADATA_FX_COOKIE","KRB5_PADATA_FX_ERROR","KRB5_PADATA_FX_FAST","KRB5_PADATA_GET_FROM_TYPED_DATA","KRB5_PADATA_NONE","KRB5_PADATA_OSF_DCE","KRB5_PADATA_OTP_CHALLENGE","KRB5_PADATA_OTP_PIN_CHANGE","KRB5_PADATA_OTP_REQUEST","KRB5_PADATA_PAC_OPTIONS","KRB5_PADATA_PAC_REQUEST","KRB5_PADATA_PKINIT_KX","KRB5_PADATA_PK_AS_REP","KRB5_PADATA_PK_AS_REP_OLD","KRB5_PADATA_PK_AS_REQ","KRB5_PADATA_PK_AS_REQ_OLD","KRB5_PADATA_PW_SALT","KRB5_PADATA_REDHAT_IDP_OAUTH2","KRB5_PADATA_REFERRAL","KRB5_PADATA_S4U_X509_USER","KRB5_PADATA_SAM_CHALLENGE","KRB5_PADATA_SAM_CHALLENGE_2","KRB5_PADATA_SAM_REDIRECT","KRB5_PADATA_SAM_RESPONSE","KRB5_PADATA_SAM_RESPONSE_2","KRB5_PADATA_SESAME","KRB5_PADATA_SPAKE","KRB5_PADATA_SVR_REFERRAL_INFO","KRB5_PADATA_TGS_REQ","KRB5_PADATA_USE_SPECIFIED_KVNO","KRB5_PRINCIPAL_COMPARE_CASEFOLD","KRB5_PRINCIPAL_COMPARE_ENTERPRISE","KRB5_PRINCIPAL_COMPARE_IGNORE_REALM","KRB5_PRINCIPAL_COMPARE_UTF8","KRB5_PRINCIPAL_PARSE_ENTERPRISE","KRB5_PRINCIPAL_PARSE_IGNORE_REALM","KRB5_PRINCIPAL_PARSE_NO_DEF_REALM","KRB5_PRINCIPAL_PARSE_NO_REALM","KRB5_PRINCIPAL_PARSE_REQUIRE_REALM","KRB5_PRINCIPAL_UNPARSE_DISPLAY","KRB5_PRINCIPAL_UNPARSE_NO_REALM","KRB5_PRINCIPAL_UNPARSE_SHORT","KRB5_PRIV","KRB5_PROMPT_TYPE_NEW_PASSWORD","KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN","KRB5_PROMPT_TYPE_PASSWORD","KRB5_PROMPT_TYPE_PREAUTH","KRB5_PVNO","KRB5_REALM_BRANCH_CHAR","KRB5_RECVAUTH_BADAUTHVERS","KRB5_RECVAUTH_SKIP_VERSION","KRB5_REFERRAL_REALM","KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN","KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN","KRB5_RESPONDER_OTP_FLAGS_NEXTOTP","KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN","KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC","KRB5_RESPONDER_OTP_FORMAT_DECIMAL","KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL","KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW","KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY","KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED","KRB5_RESPONDER_QUESTION_OTP","KRB5_RESPONDER_QUESTION_PASSWORD","KRB5_RESPONDER_QUESTION_PKINIT","KRB5_SAFE","KRB5_SAM_MUST_PK_ENCRYPT_SAD","KRB5_SAM_SEND_ENCRYPTED_SAD","KRB5_SAM_USE_SAD_AS_KEY","KRB5_TC_MATCH_2ND_TKT","KRB5_TC_MATCH_AUTHDATA","KRB5_TC_MATCH_FLAGS","KRB5_TC_MATCH_FLAGS_EXACT","KRB5_TC_MATCH_IS_SKEY","KRB5_TC_MATCH_KTYPE","KRB5_TC_MATCH_SRV_NAMEONLY","KRB5_TC_MATCH_TIMES","KRB5_TC_MATCH_TIMES_EXACT","KRB5_TC_NOTICKET","KRB5_TC_OPENCLOSE","KRB5_TC_SUPPORTED_KTYPES","KRB5_TGS_NAME","KRB5_TGS_NAME_SIZE","KRB5_TGS_REP","KRB5_TGS_REQ","KRB5_TKT_CREDS_STEP_FLAG_CONTINUE","KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL","KRB5_WELLKNOWN_NAMESTR","LR_TYPE_INTERPRETATION_MASK","LR_TYPE_THIS_SERVER_ONLY","MAX_KEYTAB_NAME_LEN","MSEC_DIRBIT","MSEC_VAL_MASK","SALT_TYPE_AFS_LENGTH","SALT_TYPE_NO_LENGTH","THREEPARAMOPEN","TKT_FLG_ANONYMOUS","TKT_FLG_ENC_PA_REP","TKT_FLG_FORWARDABLE","TKT_FLG_FORWARDED","TKT_FLG_HW_AUTH","TKT_FLG_INITIAL","TKT_FLG_INVALID","TKT_FLG_MAY_POSTDATE","TKT_FLG_OK_AS_DELEGATE","TKT_FLG_POSTDATED","TKT_FLG_PRE_AUTH","TKT_FLG_PROXIABLE","TKT_FLG_PROXY","TKT_FLG_RENEWABLE","TKT_FLG_TRANSIT_POLICY_CHECKED","VALID_INT_BITS","VALID_UINT_BITS","krb5 simple macros","krb524_convert_creds_kdc","krb524_init_ets","krb5_const","krb5_princ_component","krb5_princ_name","krb5_princ_realm","krb5_princ_set_realm","krb5_princ_set_realm_data","krb5_princ_set_realm_length","krb5_princ_size","krb5_princ_type","krb5_roundup","krb5_x","krb5_xc","krb5 types and structures","krb5_address","krb5_addrtype","krb5_ap_rep","krb5_ap_rep_enc_part","krb5_ap_req","krb5_auth_context","krb5_authdata","krb5_authdatatype","krb5_authenticator","krb5_boolean","krb5_cc_cursor","krb5_ccache","krb5_cccol_cursor","krb5_checksum","krb5_cksumtype","krb5_const_pointer","krb5_const_principal","krb5_context","krb5_cred","krb5_cred_enc_part","krb5_cred_info","krb5_creds","krb5_crypto_iov","krb5_cryptotype","krb5_data","krb5_deltat","krb5_enc_data","krb5_enc_kdc_rep_part","krb5_enc_tkt_part","krb5_encrypt_block","krb5_enctype","krb5_error","krb5_error_code","krb5_expire_callback_func","krb5_flags","krb5_get_init_creds_opt","krb5_gic_opt_pa_data","krb5_init_creds_context","krb5_int16","krb5_int32","krb5_kdc_rep","krb5_kdc_req","krb5_key","krb5_keyblock","krb5_keytab","krb5_keytab_entry","krb5_keyusage","krb5_kt_cursor","krb5_kvno","krb5_last_req_entry","krb5_magic","krb5_mk_req_checksum_func","krb5_msgtype","krb5_octet","krb5_pa_data","krb5_pa_pac_req","krb5_pa_server_referral_data","krb5_pa_svr_referral_data","krb5_pac","krb5_pointer","krb5_post_recv_fn","krb5_pre_send_fn","krb5_preauthtype","krb5_principal","krb5_principal_data","krb5_prompt","krb5_prompt_type","krb5_prompter_fct","krb5_pwd_data","krb5_rcache","krb5_replay_data","krb5_responder_context","krb5_responder_fn","krb5_responder_otp_challenge","krb5_responder_otp_tokeninfo","krb5_responder_pkinit_challenge","krb5_responder_pkinit_identity","krb5_response","krb5_ticket","krb5_ticket_times","krb5_timestamp","krb5_tkt_authent","krb5_tkt_creds_context","krb5_trace_callback","krb5_trace_info","krb5_transited","krb5_typed_data","krb5_ui_2","krb5_ui_4","krb5_verify_init_creds_opt","passwd_phrase_element","Year 2038 considerations for uses of krb5_timestamp","Credential cache","Supported date and time formats","Kerberos V5 concepts","keytab","replay cache","stash file","Organization of the source directory","Doing the build","Building Kerberos V5","Options to <em>configure</em>","osconf.hin","How to build this documentation from the source","Copyright","Credential cache file format","KDC cookie format","PKINIT freshness tokens","Protocols and file formats","Keytab file format","Replay cache file format","MIT Kerberos Documentation (1.20.1)","MIT Kerberos defaults","MIT Kerberos features","MIT Kerberos License information","Credential cache selection interface (ccselect)","PKINIT certificate authorization interface (certauth)","Client preauthentication interface (clpreauth)","General plugin concepts","GSSAPI mechanism interface","Host-to-realm interface (hostrealm)","For plugin module developers","Internal pluggable interfaces","kadmin authorization interface (kadm5_auth)","KADM5 hook interface (kadm5_hook)","KDC policy interface (kdcpolicy)","KDC preauthentication interface (kdcpreauth)","Local authorization interface (localauth)","Server location interface (locate)","Configuration interface (profile)","Password quality interface (pwqual)","Resources","For users","Password management","Ticket management","User commands","kdestroy","kinit","klist","kpasswd","krb5-config","ksu","kswitch","kvno","sclient","User config files",".k5identity",".k5login","kerberos",titleterms:{"boolean":59,"byte":112,117,119,121,296,"default":14,28,36,135,136,145,156,210,227,303,305,306,347,377,378,895,898,899,915,"export":43,"function":118,219,257,363,364,375,380,381,386,"import":43,"new":108,149,236,302,322,339,944,"null":91,"public":48,787,802,"return":53,58,95,96,97,111,112,116,136,210,261,266,312,332,337,367,370,"switch":34,160,"while":41,Adding:14,15,23,DES:14,DNS:15,38,Doing:902,For:30,45,924,935,One:46,TGS:378,399,400,401,402,404,THE:944,The:14,32,36,Using:15,902,abbrevi:896,about:23,32,absolut:896,acceptor:43,access:936,account:35,166,936,acl:19,34,acquir:15,271,272,275,276,277,278,279,401,ad_type_extern:432,ad_type_field_type_mask:433,ad_type_regist:434,ad_type_reserv:435,add:34,302,333,346,417,419,420,add_entri:11,add_mkei:6,add_polici:3,23,add_princip:3,23,addit:31,126,224,350,address:25,52,53,54,62,64,82,172,198,240,332,addrtype_addrport:422,addrtype_chao:423,addrtype_ddp:424,addrtype_inet6:426,addrtype_inet:425,addrtype_ipport:427,addrtype_is_loc:429,addrtype_iso:428,addrtype_netbio:430,addrtype_xn:431,adjust:396,admin:39,41,administr:1,23,30,34,advanc:13,advic:32,38,aead:43,100,103,288,290,against:414,alia:192,all:332,alloc:106,212,214,219,236,allow:55,167,244,allow_weak_crypto:55,also:2,3,4,5,6,7,8,9,10,11,12,19,20,21,939,940,941,942,943,944,945,946,947,949,950,951,alter:895,ani:165,anonym:37,46,57,58,241,anoth:179,answer:369,372,373,ap_opts_etype_negoti:436,ap_opts_mutual_requir:437,ap_opts_reserv:438,ap_opts_use_session_kei:439,ap_opts_use_subkei:440,ap_opts_wire_mask:441,api:44,48,421,906,appdefault:21,59,60,applic:14,15,32,38,45,55,archiv:934,argument:92,ark:6,armor:246,247,arrai:98,114,130,172,198,200,204,211,220,263,295,299,325,337,ask:253,asn:185,assign:200,218,attack:25,attribut:43,338,auth:62,63,64,65,67,68,69,71,72,73,74,76,77,79,80,81,82,84,85,86,87,88,89,90,authdata:925,authent:16,23,41,65,78,200,944,author:28,37,173,184,189,195,319,320,322,412,919,925,926,930,944,951,autoconf:902,avail:23,awai:26,back:17,22,background:0,899,backup:17,behavior:19,38,berkelei:24,between:44,binari:902,block:95,buffer:333,335,337,bug:951,build:57,91,92,93,902,903,906,built:285,cach:71,85,132,133,134,135,136,137,139,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,246,250,251,265,383,895,899,908,913,918,call:48,callback:46,63,80,245,386,cannot:41,canonic:38,194,242,capath:21,caus:79,ccach:138,247,895,ccselect:21,918,cert:41,certauth:21,919,certif:37,41,338,919,cf2:107,chain:41,challeng:365,chang:23,166,169,243,936,change_password:3,23,channel:934,check:165,167,284,313,checksum:63,80,81,96,109,110,111,113,114,127,129,130,170,204,294,295,298,299,390,choos:26,cipher:79,95,106,108,cksumtype_cmac_camellia128:442,cksumtype_cmac_camellia256:443,cksumtype_crc32:444,cksumtype_descbc:445,cksumtype_hmac_md5_arcfour:446,cksumtype_hmac_sha1_96_aes128:447,cksumtype_hmac_sha1_96_aes256:448,cksumtype_hmac_sha1_des3:449,cksumtype_hmac_sha256_128_aes128:450,cksumtype_hmac_sha384_192_aes256:451,cksumtype_md5_hmac_arcfour:452,cksumtype_nist_sha:453,cksumtype_rsa_md4:454,cksumtype_rsa_md4_d:455,cksumtype_rsa_md5:456,cksumtype_rsa_md5_d:457,cksumtype_sha1:458,clean:902,clear:171,clear_list:11,client:15,29,33,37,132,303,336,375,898,920,clock:15,167,close:133,304,clpreauth:21,920,code:228,346,379,417,418,419,420,collect:161,162,163,164,165,895,collis:109,combin:107,command:3,5,6,11,938,common:12,commonli:904,compar:52,105,348,349,350,362,compat:26,complet:421,compon:349,comput:104,107,113,294,concept:897,921,conf:20,21,34,59,60,config:943,948,configur:15,18,22,26,28,29,33,34,35,36,37,39,141,155,262,282,283,904,908,932,connect:41,62,consider:36,894,constrain:43,contain:165,189,313,366,content:18,31,181,203,206,209,216,217,903,924,context:62,63,64,65,67,68,69,71,72,73,74,76,77,78,79,80,81,82,84,85,86,87,88,89,90,171,179,205,262,263,266,268,269,270,271,272,273,274,275,282,365,366,373,377,396,399,400,401,402,403,944,contribut:0,conveni:48,convert:49,50,51,56,125,126,170,187,192,193,344,345,347,374,390,391,392,394,395,397,398,406,407,408,409,cooki:909,copi:134,172,173,174,175,176,177,178,179,180,181,182,183,293,copyright:907,correct:15,count:93,291,297,creat:5,6,23,34,37,41,78,149,268,269,275,282,286,329,330,338,403,944,create_polici:5,cred:223,323,325,354,credenti:15,41,43,46,51,132,133,134,135,136,137,139,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,220,235,236,237,238,240,241,243,244,245,246,247,248,249,250,251,252,254,255,256,257,258,259,260,264,267,270,271,272,273,274,275,276,277,278,279,323,325,330,382,383,400,401,403,414,415,416,895,908,918,cross:23,current:167,396,cursor:162,308,daemon:34,dai:410,data:58,99,100,101,102,103,104,124,173,184,189,195,198,200,209,286,287,288,289,290,320,322,365,412,925,databas:3,14,17,23,24,34,39,925,datatyp:421,date:23,896,db2:24,dbdefault:20,dbmodul:20,dce:328,358,decis:39,declar:803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,decod:185,355,368,371,decrement:291,decrypt:99,100,287,288,357,358,359,376,defin:36,del_str:3,deleg:43,delet:23,delete_entri:11,delete_polici:3,23,delete_princip:3,23,delta:391,deprec:48,787,deriv:101,descript:2,3,4,5,6,7,8,9,10,11,12,19,939,940,941,942,943,944,945,946,947,949,950,951,deseri:405,destroi:5,6,23,137,937,destroy_polici:5,determin:160,319,develop:43,45,924,dictionari:25,differ:23,44,419,420,direct:387,directli:48,directori:901,902,904,discoveri:39,document:0,896,906,914,domain_realm:21,dump:6,23,duplic:138,307,durat:896,dure:41,each:34,edit:34,effect:944,element:114,130,195,295,299,empti:280,338,encod:320,324,339,encrypt:20,26,41,97,102,103,104,105,111,115,118,128,192,193,211,244,261,289,290,327,328,378,392,enctyp:26,115,117,124,229,286,292,296,enctype_aes128_cts_hmac_sha1_96:459,enctype_aes128_cts_hmac_sha256_128:460,enctype_aes256_cts_hmac_sha1_96:461,enctype_aes256_cts_hmac_sha384_192:462,enctype_arcfour_hmac:463,enctype_arcfour_hmac_exp:464,enctype_camellia128_cts_cmac:465,enctype_camellia256_cts_cmac:466,enctype_des3_cbc_env:467,enctype_des3_cbc_raw:468,enctype_des3_cbc_sha1:470,enctype_des3_cbc_sha:469,enctype_des_cbc_crc:471,enctype_des_cbc_md4:472,enctype_des_cbc_md5:473,enctype_des_cbc_raw:474,enctype_des_hmac_sha1:475,enctype_dsa_sha1_cm:476,enctype_md5_rsa_cm:477,enctype_nul:478,enctype_rc2_cbc_env:479,enctype_rsa_env:480,enctype_rsa_es_oaep_env:481,enctype_sha1_rsa_cm:482,enctype_unknown:483,end:22,entri:139,150,217,302,310,313,314,316,318,908,912,environ:2,3,4,5,6,7,8,9,10,11,12,27,904,939,940,941,942,944,945,946,947,951,epoch:410,error:12,41,171,179,212,213,228,273,346,355,379,417,418,419,420,etc:38,event:386,387,everi:158,exampl:10,11,15,19,23,46,904,943,949,950,exchang:41,404,execut:944,exist:166,264,313,expans:21,expir:41,245,extend:171,179,228,379,418,extens:43,fact:916,fail:34,41,fast:238,246,247,248,featur:904,916,field:64,83,84,97,209,384,385,file:8,18,20,21,23,32,33,34,282,387,900,908,911,912,913,939,940,941,945,946,948,fill:98,114,295,find:132,195,fine:904,finish:139,firewal:15,flag:66,83,142,157,238,241,242,243,248,249,255,345,350,408,409,format:23,185,223,323,324,325,326,327,328,331,409,896,908,909,911,912,913,forward:223,249,free:61,106,162,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,237,270,291,334,367,370,399,frequent:41,48,fresh:37,910,from:14,15,23,26,59,60,62,63,64,65,66,67,68,69,71,72,73,74,76,77,124,141,142,150,151,153,179,229,238,262,263,264,266,267,272,273,274,286,293,310,314,315,316,335,336,343,361,389,401,402,403,906,921,full:143,389,gener:37,62,115,117,119,121,124,213,265,296,389,915,921,get:15,41,46,63,118,141,145,164,169,223,224,228,231,235,260,263,264,267,273,279,306,310,311,317,403,404,get_init_cr:46,get_polici:3,23,get_princip:3,23,get_str:3,getdat:896,given:365,grant:403,936,gssapi:28,43,922,guid:31,handl:133,138,304,307,317,333,334,337,338,339,has:41,header:98,908,heimdal:44,hin:905,histori:3,14,23,951,hit:291,hook:380,381,927,host:17,28,32,34,41,231,332,923,hostnam:39,194,hostrealm:21,923,how:906,http:29,ident:21,372,ignor:349,includ:253,300,301,increment:23,34,297,indic:16,inform:15,21,23,336,899,917,initi:41,43,46,78,108,147,165,235,236,237,238,240,241,243,244,245,246,247,248,249,250,251,252,254,255,256,257,258,259,260,270,271,272,273,274,275,276,277,278,279,280,414,415,initialcredenti:242,input:101,250,361,instal:31,33,34,902,904,944,instanc:36,instruct:944,interact:46,interfac:21,48,332,918,919,920,922,923,925,926,927,928,929,930,931,932,933,intern:802,925,interoper:916,interpos:922,iov:43,98,114,130,295,299,irc:934,iter:163,its:161,k5ident:949,k5login:950,k5srvutil:2,kadm5:19,927,kadm5_auth:21,926,kadm5_hook:21,927,kadmin:3,23,926,kadmind:4,921,kdb5_ldap_util:5,kdb5_util:6,kdb:925,kdc:14,20,28,34,35,37,39,41,229,253,264,267,273,279,380,381,403,404,909,915,921,928,929,kdc_opt_allow_postd:484,kdc_opt_canonic:485,kdc_opt_cname_in_addl_tkt:486,kdc_opt_disable_transited_check:487,kdc_opt_enc_tkt_in_skei:488,kdc_opt_forward:489,490,kdc_opt_postd:491,kdc_opt_proxi:492,493,kdc_opt_renew:494,495,kdc_opt_renewable_ok:496,kdc_opt_request_anonym:497,kdc_opt_valid:498,kdc_tkt_common_mask:499,kdcdefault:20,kdcissu:320,412,kdcpolici:928,kdcpreauth:21,929,kdestroi:937,939,kei:14,23,26,67,68,90,99,101,102,107,110,111,112,115,124,125,126,217,235,261,286,287,288,289,290,291,294,295,296,297,298,299,302,303,304,305,306,310,311,312,314,315,316,317,318,376,912,kerbero:0,15,17,22,23,34,39,44,49,50,51,52,127,128,166,231,285,897,903,914,915,916,917,925,937,951,keyblock:67,72,73,76,86,88,99,100,102,103,113,114,129,130,180,181,286,293,keyboard:361,keysalt:20,keytab:15,32,34,38,276,307,308,313,414,898,912,kinit:937,940,kldap:24,klist:937,941,klmdb:24,known:163,kpasswd:942,kprop:7,41,kpropd:8,kproplog:9,krb524_convert_creds_kdc:788,krb524_init_et:789,krb5:21,34,48,59,60,205,219,268,269,282,787,802,943,krb5_425_conv_princip:49,krb5_524_conv_princip:50,krb5_524_convert_cr:51,krb5_address:803,krb5_address_compar:52,krb5_address_ord:53,krb5_address_search:54,krb5_addrtyp:804,krb5_allow_weak_crypto:55,krb5_altauth_att_challenge_respons:500,krb5_aname_to_localnam:56,krb5_anonymous_princip:57,krb5_anonymous_princstr:501,krb5_anonymous_realm:58,krb5_anonymous_realmstr:502,krb5_ap_rep:503,805,krb5_ap_rep_enc_part:199,806,krb5_ap_req:504,807,krb5_appdefault_boolean:59,krb5_appdefault_str:60,krb5_as_rep:505,krb5_as_req:506,krb5_auth_con_fre:61,krb5_auth_con_genaddr:62,krb5_auth_con_get_checksum_func:63,krb5_auth_con_getaddr:64,krb5_auth_con_getauthent:65,krb5_auth_con_getflag:66,krb5_auth_con_getkei:67,krb5_auth_con_getkey_k:68,krb5_auth_con_getlocalseqnumb:69,krb5_auth_con_getlocalsubkei:70,krb5_auth_con_getrcach:71,krb5_auth_con_getrecvsubkei:72,krb5_auth_con_getrecvsubkey_k:73,krb5_auth_con_getremoteseqnumb:74,krb5_auth_con_getremotesubkei:75,krb5_auth_con_getsendsubkei:76,krb5_auth_con_getsendsubkey_k:77,krb5_auth_con_init:78,krb5_auth_con_initivector:79,krb5_auth_con_set_checksum_func:80,krb5_auth_con_set_req_cksumtyp:81,krb5_auth_con_setaddr:82,krb5_auth_con_setflag:83,krb5_auth_con_setport:84,krb5_auth_con_setrcach:85,krb5_auth_con_setrecvsubkei:86,krb5_auth_con_setrecvsubkey_k:87,krb5_auth_con_setsendsubkei:88,krb5_auth_con_setsendsubkey_k:89,krb5_auth_con_setuseruserkei:90,krb5_auth_context:61,66,83,808,krb5_auth_context_do_sequ:521,krb5_auth_context_do_tim:522,krb5_auth_context_generate_local_addr:523,krb5_auth_context_generate_local_full_addr:524,krb5_auth_context_generate_remote_addr:525,krb5_auth_context_generate_remote_full_addr:526,krb5_auth_context_permit_al:527,krb5_auth_context_ret_sequ:528,krb5_auth_context_ret_tim:529,krb5_auth_context_use_subkei:530,krb5_authdata:809,krb5_authdata_and_or:507,krb5_authdata_ap_opt:508,krb5_authdata_auth_ind:509,krb5_authdata_cammac:510,krb5_authdata_etype_negoti:511,krb5_authdata_fx_armor:512,krb5_authdata_if_relev:513,krb5_authdata_initial_verified_ca:514,krb5_authdata_kdc_issu:515,krb5_authdata_mandatory_for_kdc:516,krb5_authdata_osf_dc:517,krb5_authdata_sesam:518,krb5_authdata_signticket:519,krb5_authdata_win2k_pac:520,krb5_authdatatyp:810,krb5_authent:174,201,811,krb5_boolean:812,krb5_build_princip:91,krb5_build_principal_alloc_va:92,krb5_build_principal_ext:93,krb5_build_principal_va:94,krb5_c_block_siz:95,krb5_c_checksum_length:96,krb5_c_crypto_length:97,krb5_c_crypto_length_iov:98,krb5_c_decrypt:99,krb5_c_decrypt_iov:100,krb5_c_derive_prfplu:101,krb5_c_encrypt:102,krb5_c_encrypt_iov:103,krb5_c_encrypt_length:104,krb5_c_enctype_compar:105,krb5_c_free_stat:106,krb5_c_fx_cf2_simpl:107,krb5_c_init_st:106,108,krb5_c_is_coll_proof_cksum:109,krb5_c_is_keyed_cksum:110,krb5_c_keyed_checksum_typ:111,krb5_c_keylength:112,krb5_c_make_checksum:113,krb5_c_make_checksum_iov:114,krb5_c_make_random_kei:115,krb5_c_padding_length:116,krb5_c_prf:117,krb5_c_prf_length:118,krb5_c_prfplu:119,krb5_c_random_add_entropi:120,krb5_c_random_make_octet:121,krb5_c_random_os_entropi:122,krb5_c_random_se:123,krb5_c_random_to_kei:124,krb5_c_string_to_kei:125,krb5_c_string_to_key_with_param:126,krb5_c_valid_cksumtyp:127,krb5_c_valid_enctyp:128,krb5_c_verify_checksum:129,krb5_c_verify_checksum_iov:130,krb5_calculate_checksum:131,krb5_cc_cache_match:132,krb5_cc_close:133,krb5_cc_copy_cr:134,krb5_cc_cursor:813,krb5_cc_default:135,krb5_cc_default_nam:136,krb5_cc_destroi:137,krb5_cc_dup:138,krb5_cc_end_seq_get:139,krb5_cc_gen_new:140,krb5_cc_get_config:141,krb5_cc_get_flag:142,krb5_cc_get_full_nam:143,krb5_cc_get_nam:144,krb5_cc_get_princip:145,krb5_cc_get_typ:146,krb5_cc_initi:147,krb5_cc_move:148,krb5_cc_new_uniqu:149,krb5_cc_next_cr:150,krb5_cc_remove_cr:151,krb5_cc_resolv:152,krb5_cc_retrieve_cr:153,krb5_cc_select:154,krb5_cc_set_config:155,krb5_cc_set_default_nam:156,krb5_cc_set_flag:157,krb5_cc_start_seq_get:158,krb5_cc_store_cr:159,krb5_cc_support_switch:160,krb5_cc_switch:161,krb5_ccach:814,krb5_cccol_cursor:815,krb5_cccol_cursor_fre:162,krb5_cccol_cursor_new:163,krb5_cccol_cursor_next:164,krb5_cccol_have_cont:165,krb5_change_password:166,krb5_check_clockskew:167,krb5_checksum:175,202,203,816,krb5_checksum_s:168,krb5_chpw_messag:169,krb5_cksumtyp:817,krb5_cksumtype_to_str:170,krb5_clear_error_messag:171,krb5_const:790,krb5_const_point:818,krb5_const_princip:819,krb5_context:176,378,385,820,krb5_copy_address:172,krb5_copy_authdata:173,krb5_copy_authent:174,krb5_copy_checksum:175,krb5_copy_context:176,krb5_copy_cr:177,krb5_copy_data:178,krb5_copy_error_messag:179,krb5_copy_keyblock:180,krb5_copy_keyblock_cont:181,krb5_copy_princip:182,krb5_copy_ticket:183,krb5_cred:177,206,207,321,405,531,821,824,krb5_cred_enc_part:822,krb5_cred_info:823,krb5_crypto_iov:825,krb5_crypto_type_checksum:532,krb5_crypto_type_data:533,krb5_crypto_type_empti:534,krb5_crypto_type_head:535,krb5_crypto_type_pad:536,krb5_crypto_type_sign_onli:537,krb5_crypto_type_stream:538,krb5_crypto_type_trail:539,krb5_cryptotyp:826,krb5_cybersafe_secureid:540,krb5_data:178,208,209,827,krb5_decode_authdata_contain:184,krb5_decode_ticket:185,krb5_decrypt:186,krb5_deltat:828,krb5_deltat_to_str:187,krb5_domain_x500_compress:541,krb5_eblock_enctyp:188,krb5_enc_data:829,krb5_enc_kdc_rep_part:830,krb5_enc_tkt_part:831,krb5_encode_authdata_contain:189,krb5_encpadata_req_enc_pa_rep:542,krb5_encrypt:190,krb5_encrypt_block:832,krb5_encrypt_s:191,krb5_enctyp:833,krb5_enctype_to_nam:192,krb5_enctype_to_str:193,krb5_error:543,834,krb5_error_cod:835,krb5_expand_hostnam:194,krb5_expire_callback_func:836,krb5_fast_requir:544,krb5_find_authdata:195,krb5_finish_kei:196,krb5_finish_random_kei:197,krb5_flag:837,krb5_free_address:198,krb5_free_ap_rep_enc_part:199,krb5_free_authdata:200,krb5_free_authent:201,krb5_free_checksum:202,krb5_free_checksum_cont:203,krb5_free_cksumtyp:204,krb5_free_context:205,krb5_free_cr:207,krb5_free_cred_cont:206,krb5_free_data:208,krb5_free_data_cont:209,krb5_free_default_realm:210,krb5_free_enctyp:211,krb5_free_error:212,krb5_free_error_messag:213,krb5_free_host_realm:214,krb5_free_keyblock:215,krb5_free_keyblock_cont:216,krb5_free_keytab_entry_cont:217,krb5_free_princip:218,krb5_free_str:219,krb5_free_tgt_cr:220,krb5_free_ticket:221,krb5_free_unparsed_nam:222,krb5_fwd_tgt_cred:223,krb5_gc_cach:545,krb5_gc_canonic:546,krb5_gc_constrained_deleg:547,krb5_gc_forward:548,krb5_gc_no_stor:549,krb5_gc_no_transit_check:550,krb5_gc_user_us:551,krb5_get_credenti:224,krb5_get_credentials_renew:225,krb5_get_credentials_valid:226,krb5_get_default_realm:210,227,krb5_get_error_messag:213,228,krb5_get_etype_info:229,krb5_get_fallback_host_realm:230,krb5_get_host_realm:214,231,krb5_get_in_tkt_with_keytab:232,krb5_get_in_tkt_with_password:233,krb5_get_in_tkt_with_skei:234,krb5_get_init_creds_keytab:235,krb5_get_init_creds_opt:838,krb5_get_init_creds_opt_address_list:552,krb5_get_init_creds_opt_alloc:236,krb5_get_init_creds_opt_anonym:553,krb5_get_init_creds_opt_canonic:554,krb5_get_init_creds_opt_chg_pwd_prmpt:555,krb5_get_init_creds_opt_etype_list:556,krb5_get_init_creds_opt_forward:557,krb5_get_init_creds_opt_fre:237,krb5_get_init_creds_opt_get_fast_flag:238,krb5_get_init_creds_opt_init:239,krb5_get_init_creds_opt_preauth_list:558,krb5_get_init_creds_opt_proxi:559,krb5_get_init_creds_opt_renew_lif:560,krb5_get_init_creds_opt_salt:561,krb5_get_init_creds_opt_set_address_list:240,krb5_get_init_creds_opt_set_anonym:241,krb5_get_init_creds_opt_set_canonic:242,krb5_get_init_creds_opt_set_change_password_prompt:243,krb5_get_init_creds_opt_set_etype_list:244,krb5_get_init_creds_opt_set_expire_callback:245,krb5_get_init_creds_opt_set_fast_ccach:246,krb5_get_init_creds_opt_set_fast_ccache_nam:247,krb5_get_init_creds_opt_set_fast_flag:248,krb5_get_init_creds_opt_set_forward:249,krb5_get_init_creds_opt_set_in_ccach:250,krb5_get_init_creds_opt_set_out_ccach:251,krb5_get_init_creds_opt_set_pa:252,krb5_get_init_creds_opt_set_pac_request:253,krb5_get_init_creds_opt_set_preauth_list:254,krb5_get_init_creds_opt_set_proxi:255,krb5_get_init_creds_opt_set_renew_lif:256,krb5_get_init_creds_opt_set_respond:257,krb5_get_init_creds_opt_set_salt:258,krb5_get_init_creds_opt_set_tkt_lif:259,krb5_get_init_creds_opt_tkt_lif:562,krb5_get_init_creds_password:260,krb5_get_permitted_enctyp:261,krb5_get_profil:262,krb5_get_prompt_typ:263,krb5_get_renewed_cr:264,krb5_get_server_rcach:265,krb5_get_time_offset:266,krb5_get_validated_cr:267,krb5_gic_opt_pa_data:839,krb5_init_context:268,krb5_init_context_kdc:563,krb5_init_context_profil:269,krb5_init_context_secur:564,krb5_init_creds_context:840,krb5_init_creds_fre:270,krb5_init_creds_get:271,krb5_init_creds_get_cr:272,krb5_init_creds_get_error:273,krb5_init_creds_get_tim:274,krb5_init_creds_init:275,krb5_init_creds_set_keytab:276,krb5_init_creds_set_password:277,krb5_init_creds_set_servic:278,krb5_init_creds_step:279,krb5_init_creds_step_flag_continu:565,krb5_init_keyblock:280,krb5_init_random_kei:281,krb5_init_secure_context:282,krb5_int16:841,krb5_int16_max:566,krb5_int16_min:567,krb5_int32:842,krb5_int32_max:568,krb5_int32_min:569,krb5_is_config_princip:283,krb5_is_referral_realm:284,krb5_is_thread_saf:285,krb5_k_create_kei:286,krb5_k_decrypt:287,krb5_k_decrypt_iov:288,krb5_k_encrypt:289,krb5_k_encrypt_iov:290,krb5_k_free_kei:291,krb5_k_key_enctyp:292,krb5_k_key_keyblock:293,krb5_k_make_checksum:294,krb5_k_make_checksum_iov:295,krb5_k_prf:296,krb5_k_reference_kei:297,krb5_k_verify_checksum:298,krb5_k_verify_checksum_iov:299,krb5_kdc_rep:843,krb5_kdc_req:844,krb5_kdc_sign_ticket:300,krb5_kdc_verify_ticket:301,krb5_kei:286,292,293,845,krb5_keyblock:215,216,280,846,krb5_keytab:847,krb5_keytab_entri:848,krb5_keyusag:849,krb5_keyusage_ad_it:570,krb5_keyusage_ad_kdcissued_cksum:571,krb5_keyusage_ad_mt:572,krb5_keyusage_ad_signedpath:573,krb5_keyusage_ap_rep_encpart:576,krb5_keyusage_ap_req_auth:577,krb5_keyusage_ap_req_auth_cksum:578,krb5_keyusage_app_data_cksum:574,krb5_keyusage_app_data_encrypt:575,krb5_keyusage_as_rep_encpart:579,krb5_keyusage_as_req:580,krb5_keyusage_as_req_pa_enc_t:581,krb5_keyusage_cammac:582,krb5_keyusage_enc_challenge_cli:583,krb5_keyusage_enc_challenge_kdc:584,krb5_keyusage_fast_enc:585,krb5_keyusage_fast_finish:586,krb5_keyusage_fast_rep:587,krb5_keyusage_fast_req_chksum:588,krb5_keyusage_gss_tok_m:589,krb5_keyusage_gss_tok_wrap_integ:590,krb5_keyusage_gss_tok_wrap_priv:591,krb5_keyusage_iakerb_finish:592,krb5_keyusage_kdc_rep_ticket:593,krb5_keyusage_krb_cred_encpart:594,krb5_keyusage_krb_error_cksum:595,krb5_keyusage_krb_priv_encpart:596,krb5_keyusage_krb_safe_cksum:597,krb5_keyusage_pa_as_fresh:598,krb5_keyusage_pa_fx_cooki:599,krb5_keyusage_pa_otp_request:600,krb5_keyusage_pa_pkinit_kx:601,krb5_keyusage_pa_s4u_x509_user_repli:602,krb5_keyusage_pa_s4u_x509_user_request:603,krb5_keyusage_pa_sam_challenge_cksum:604,krb5_keyusage_pa_sam_challenge_trackid:605,krb5_keyusage_pa_sam_respons:606,krb5_keyusage_spak:607,krb5_keyusage_tgs_rep_encpart_sesskei:608,krb5_keyusage_tgs_rep_encpart_subkei:609,krb5_keyusage_tgs_req_ad_sesskei:610,krb5_keyusage_tgs_req_ad_subkei:611,krb5_keyusage_tgs_req_auth:612,krb5_keyusage_tgs_req_auth_cksum:613,krb5_kpasswd_accessdeni:614,krb5_kpasswd_autherror:615,krb5_kpasswd_bad_vers:616,krb5_kpasswd_harderror:617,krb5_kpasswd_initial_flag_need:618,krb5_kpasswd_malform:619,krb5_kpasswd_softerror:620,krb5_kpasswd_success:621,krb5_kt_add_entri:302,krb5_kt_client_default:303,krb5_kt_close:304,krb5_kt_cursor:850,krb5_kt_default:305,krb5_kt_default_nam:306,krb5_kt_dup:307,krb5_kt_end_seq_get:308,krb5_kt_free_entri:309,krb5_kt_get_entri:310,krb5_kt_get_nam:311,krb5_kt_get_typ:312,krb5_kt_have_cont:313,krb5_kt_next_entri:314,krb5_kt_read_service_kei:315,krb5_kt_remove_entri:316,krb5_kt_resolv:317,krb5_kt_start_seq_get:318,krb5_kuserok:319,krb5_kvno:851,krb5_last_req_entri:852,krb5_lrq_all_acct_exptim:622,krb5_lrq_all_last_initi:623,krb5_lrq_all_last_renew:624,krb5_lrq_all_last_req:625,krb5_lrq_all_last_tgt:626,krb5_lrq_all_last_tgt_issu:627,krb5_lrq_all_pw_exptim:628,krb5_lrq_none:629,krb5_lrq_one_acct_exptim:630,krb5_lrq_one_last_initi:631,krb5_lrq_one_last_renew:632,krb5_lrq_one_last_req:633,krb5_lrq_one_last_tgt:634,krb5_lrq_one_last_tgt_issu:635,krb5_lrq_one_pw_exptim:636,krb5_magic:853,krb5_make_authdata_kdc_issu:320,krb5_marshal_credenti:321,krb5_merge_authdata:322,krb5_mk_1cred:323,krb5_mk_error:324,krb5_mk_ncred:325,krb5_mk_priv:326,krb5_mk_rep:327,krb5_mk_rep_dc:328,krb5_mk_req:329,krb5_mk_req_checksum_func:854,krb5_mk_req_extend:330,krb5_mk_safe:331,krb5_msgtype:855,krb5_nt_ent_principal_and_id:638,krb5_nt_enterprise_princip:637,krb5_nt_ms_princip:639,krb5_nt_ms_principal_and_id:640,krb5_nt_princip:641,krb5_nt_smtp_name:642,krb5_nt_srv_hst:643,krb5_nt_srv_inst:644,krb5_nt_srv_xhst:645,krb5_nt_uid:646,krb5_nt_unknown:647,krb5_nt_wellknown:648,krb5_nt_x500_princip:649,krb5_octet:856,krb5_os_localaddr:332,krb5_pa_data:857,krb5_pa_pac_req:858,krb5_pa_server_referral_data:859,krb5_pa_svr_referral_data:860,krb5_pac:861,krb5_pac_add_buff:333,krb5_pac_attributes_info:650,krb5_pac_client_claim:651,krb5_pac_client_info:652,krb5_pac_credentials_info:653,krb5_pac_delegation_info:654,krb5_pac_device_claim:655,krb5_pac_device_info:656,krb5_pac_fre:334,krb5_pac_get_buff:335,krb5_pac_get_client_info:336,krb5_pac_get_typ:337,krb5_pac_init:338,krb5_pac_logon_info:657,krb5_pac_pars:339,krb5_pac_privsvr_checksum:658,krb5_pac_requestor:659,krb5_pac_server_checksum:660,krb5_pac_sign:340,krb5_pac_sign_ext:341,krb5_pac_ticket_checksum:661,krb5_pac_upn_dns_info:662,krb5_pac_verifi:342,krb5_pac_verify_ext:343,krb5_padata_afs3_salt:663,krb5_padata_ap_req:664,krb5_padata_as_checksum:665,krb5_padata_as_fresh:666,krb5_padata_enc_sandia_securid:668,krb5_padata_enc_timestamp:669,krb5_padata_enc_unix_tim:670,krb5_padata_encrypted_challeng:667,krb5_padata_etype_info2:672,krb5_padata_etype_info:671,krb5_padata_for_us:673,krb5_padata_fx_cooki:674,krb5_padata_fx_error:675,krb5_padata_fx_fast:676,krb5_padata_get_from_typed_data:677,krb5_padata_non:678,krb5_padata_osf_dc:679,krb5_padata_otp_challeng:680,krb5_padata_otp_pin_chang:681,krb5_padata_otp_request:682,krb5_padata_pac_opt:683,krb5_padata_pac_request:684,krb5_padata_pk_as_rep:686,krb5_padata_pk_as_rep_old:687,krb5_padata_pk_as_req:688,krb5_padata_pk_as_req_old:689,krb5_padata_pkinit_kx:685,krb5_padata_pw_salt:690,krb5_padata_redhat_idp_oauth2:691,krb5_padata_referr:692,krb5_padata_s4u_x509_us:693,krb5_padata_sam_challeng:694,krb5_padata_sam_challenge_2:695,krb5_padata_sam_redirect:696,krb5_padata_sam_respons:697,krb5_padata_sam_response_2:698,krb5_padata_sesam:699,krb5_padata_spak:700,krb5_padata_svr_referral_info:701,krb5_padata_tgs_req:702,krb5_padata_use_specified_kvno:703,krb5_parse_nam:344,krb5_parse_name_flag:345,krb5_pointer:862,krb5_post_recv_fn:863,krb5_pre_send_fn:864,krb5_preauthtyp:865,krb5_prepend_error_messag:346,krb5_princ_compon:791,krb5_princ_nam:792,krb5_princ_realm:793,krb5_princ_set_realm:794,krb5_princ_set_realm_data:795,krb5_princ_set_realm_length:796,krb5_princ_siz:797,krb5_princ_typ:798,krb5_princip:344,345,406,407,408,409,866,krb5_principal2salt:347,krb5_principal_compar:348,krb5_principal_compare_any_realm:349,krb5_principal_compare_casefold:704,krb5_principal_compare_enterpris:705,krb5_principal_compare_flag:350,krb5_principal_compare_ignore_realm:706,krb5_principal_compare_utf8:707,krb5_principal_data:867,krb5_principal_parse_enterpris:708,krb5_principal_parse_ignore_realm:709,krb5_principal_parse_no_def_realm:710,krb5_principal_parse_no_realm:711,krb5_principal_parse_require_realm:712,krb5_principal_unparse_displai:713,krb5_principal_unparse_no_realm:714,krb5_principal_unparse_short:715,krb5_priv:716,krb5_process_kei:351,krb5_prompt:868,krb5_prompt_typ:869,krb5_prompt_type_new_password:717,krb5_prompt_type_new_password_again:718,krb5_prompt_type_password:719,krb5_prompt_type_preauth:720,krb5_prompter_fct:870,krb5_prompter_posix:352,krb5_pvno:721,krb5_pwd_data:871,krb5_random_kei:353,krb5_rcach:872,krb5_rd_cred:354,krb5_rd_error:355,krb5_rd_priv:356,krb5_rd_rep:357,krb5_rd_rep_dc:358,krb5_rd_req:359,krb5_rd_safe:360,krb5_read_error:212,krb5_read_password:361,krb5_realm_branch_char:722,krb5_realm_compar:362,krb5_recvauth:363,krb5_recvauth_badauthv:723,krb5_recvauth_skip_vers:724,krb5_recvauth_vers:364,krb5_referral_realm:284,725,krb5_replay_data:873,krb5_responder_context:874,krb5_responder_fn:875,krb5_responder_get_challeng:365,krb5_responder_list_quest:366,krb5_responder_otp_challeng:876,krb5_responder_otp_challenge_fre:367,krb5_responder_otp_flags_collect_pin:726,krb5_responder_otp_flags_collect_token:727,krb5_responder_otp_flags_nextotp:728,krb5_responder_otp_flags_separate_pin:729,krb5_responder_otp_format_alphanumer:730,krb5_responder_otp_format_decim:731,krb5_responder_otp_format_hexadecim:732,krb5_responder_otp_get_challeng:367,368,krb5_responder_otp_set_answ:369,krb5_responder_otp_tokeninfo:877,krb5_responder_pkinit_challeng:878,krb5_responder_pkinit_challenge_fre:370,krb5_responder_pkinit_flags_token_user_pin_count_low:733,krb5_responder_pkinit_flags_token_user_pin_final_tri:734,krb5_responder_pkinit_flags_token_user_pin_lock:735,krb5_responder_pkinit_get_challeng:370,371,krb5_responder_pkinit_ident:879,krb5_responder_pkinit_set_answ:372,krb5_responder_question_otp:368,369,736,krb5_responder_question_password:737,krb5_responder_question_pkinit:371,372,738,krb5_responder_set_answ:373,krb5_respons:880,krb5_roundup:799,krb5_safe:739,krb5_salttype_to_str:374,krb5_sam_must_pk_encrypt_sad:740,krb5_sam_send_encrypted_sad:741,krb5_sam_use_sad_as_kei:742,krb5_sendauth:212,375,krb5_server_decrypt_ticket_keytab:376,krb5_set_default_realm:377,krb5_set_default_tgs_enctyp:378,krb5_set_error_messag:379,krb5_set_kdc_recv_hook:380,krb5_set_kdc_send_hook:381,krb5_set_password:382,krb5_set_password_using_ccach:383,krb5_set_principal_realm:384,krb5_set_real_tim:385,krb5_set_trace_callback:386,krb5_set_trace_filenam:387,krb5_sname_match:388,krb5_sname_to_princip:389,krb5_string_to_cksumtyp:390,krb5_string_to_deltat:391,krb5_string_to_enctyp:392,krb5_string_to_kei:393,krb5_string_to_salttyp:394,krb5_string_to_timestamp:395,krb5_tc_match_2nd_tkt:743,krb5_tc_match_authdata:744,krb5_tc_match_flag:745,krb5_tc_match_flags_exact:746,krb5_tc_match_is_skei:747,krb5_tc_match_ktyp:748,krb5_tc_match_srv_nameonli:749,krb5_tc_match_tim:750,krb5_tc_match_times_exact:751,krb5_tc_noticket:752,krb5_tc_openclos:753,krb5_tc_supported_ktyp:754,krb5_tgs_name:755,krb5_tgs_name_s:756,krb5_tgs_rep:757,krb5_tgs_req:758,krb5_ticket:183,881,krb5_ticket_tim:882,krb5_timeofdai:396,krb5_timestamp:883,894,krb5_timestamp_to_sfstr:397,krb5_timestamp_to_str:398,krb5_tkt_authent:884,krb5_tkt_creds_context:885,krb5_tkt_creds_fre:399,krb5_tkt_creds_get:400,krb5_tkt_creds_get_cr:401,krb5_tkt_creds_get_tim:402,krb5_tkt_creds_init:403,krb5_tkt_creds_step:404,krb5_tkt_creds_step_flag_continu:759,krb5_trace_callback:886,krb5_trace_info:887,krb5_transit:888,krb5_typed_data:889,krb5_ui_2:890,krb5_ui_4:891,krb5_unmarshal_credenti:405,krb5_unparse_nam:406,krb5_unparse_name_ext:407,krb5_unparse_name_flag:408,krb5_unparse_name_flags_ext:409,krb5_us_timeofdai:410,krb5_use_enctyp:411,krb5_verify_authdata_kdc_issu:412,krb5_verify_checksum:413,krb5_verify_init_cr:414,krb5_verify_init_creds_opt:892,krb5_verify_init_creds_opt_ap_req_nofail:760,krb5_verify_init_creds_opt_init:415,krb5_verify_init_creds_opt_set_ap_req_nofail:416,krb5_vprepend_error_messag:417,krb5_vset_error_messag:418,krb5_vwrap_error_messag:419,krb5_wellknown_namestr:761,krb5_wrap_error_messag:420,krb5_x:800,krb5_xc:801,krb5kdc:10,krb:107,223,323,325,326,331,354,355,356,360,krb_ap_rep:327,328,357,358,krb_ap_req:329,330,359,krb_error:324,krbtgt:14,23,ksu:944,kswitch:945,ktadd:3,15,ktremov:3,15,ktutil:11,kvno:946,last:273,ldap:23,24,ldapsearch:38,legaci:14,48,length:93,96,97,98,104,112,118,407,lib:901,libdefault:21,librari:205,268,269,282,285,licens:917,lifetim:256,259,lightn:24,like:915,line:5,6,link:42,list:5,11,20,23,41,54,92,111,173,261,322,366,916,934,list_mkei:6,list_polici:3,5,23,list_princip:3,23,list_request:3,11,lndir:902,load:6,local:56,69,82,84,319,930,localauth:21,930,locat:28,247,931,lock:3,lockout:35,log:20,41,319,921,login:28,lr_type_interpretation_mask:762,lr_type_this_server_onli:763,machin:33,macro:787,mail:934,make:161,man:906,manag:936,937,manipul:47,map:24,39,master:14,23,match:284,388,max_keytab_name_len:764,mechan:28,922,member:803,805,806,807,809,811,816,819,821,822,823,824,825,827,829,830,831,832,834,838,839,843,844,846,848,852,857,858,859,860,866,867,868,871,873,876,877,878,879,880,881,882,884,887,888,889,892,893,memori:24,214,merg:322,messag:12,43,97,169,171,179,213,223,228,323,324,325,326,327,328,329,330,331,346,354,355,356,357,358,359,360,379,417,418,419,420,mic:43,migrat:26,mismatch:38,mit:0,23,44,914,915,916,917,modifi:5,23,modify_polici:3,5,23,modify_princip:3,23,modul:19,24,28,921,922,924,most:179,904,move:148,msec_dirbit:765,msec_val_mask:766,multithread:285,name:38,39,43,56,91,92,93,135,136,143,144,149,152,156,192,194,231,306,311,344,345,347,366,373,387,389,895,899,904,negoex:922,next:150,164,279,314,404,note:939,number:69,74,116,object:23,178,265,321,405,obtain:400,903,937,octet:116,offset:266,385,396,older:26,one:179,372,onli:282,onto:39,opaqu:287,288,289,290,294,295,296,298,299,open:265,openldap:22,38,oper:23,99,100,102,103,113,114,129,130,287,288,289,290,294,295,296,298,299,optimist:258,option:3,4,5,6,7,8,9,10,20,21,23,46,157,236,237,238,240,241,242,243,244,245,246,247,248,249,250,251,252,254,255,256,257,258,259,397,415,904,939,940,941,942,943,944,945,946,order:53,organ:901,osconf:905,other:36,otp:20,36,output:118,251,397,over:163,overrid:38,55,377,overview:23,pac:253,300,301,333,334,335,336,337,338,339,342,343,packag:904,906,pad:98,116,397,page:906,934,paramet:21,126,364,pars:47,357,358,359,passwd_phrase_el:893,password:23,46,125,126,166,169,243,260,277,352,361,382,383,933,936,path:915,pepper:107,perform:35,permit:261,pin:46,pkinit:20,21,37,46,910,919,place:100,103,288,290,pluggabl:925,plugin:21,28,921,924,polici:23,928,port:39,84,possibl:194,228,300,301,343,post:380,pre:381,preauthent:36,40,252,254,258,920,929,precomput:92,prefix:346,417,419,420,prepar:158,163,prerequisit:903,previous:106,prf:101,119,primari:34,161,princip:15,23,34,35,38,47,49,50,56,57,91,92,93,132,145,154,182,218,222,278,283,319,344,345,347,348,349,350,362,382,383,384,388,389,908,priv:326,356,privileg:23,338,procedur:14,process:139,356,360,profil:28,55,262,269,932,program:1,904,prompt:243,263,352,prompter:46,proof:109,propag:23,34,39,915,properti:937,protocol:363,364,375,911,provis:38,proxi:29,proxiabl:255,pseudo:117,118,119,121,296,purge_mkei:6,purgekei:3,pwqual:21,933,qualiti:933,936,question:46,365,366,369,372,373,quick:916,quit:3,11,random:115,117,118,119,121,124,296,rare:48,read:158,336,354,361,read_kt:11,realm:20,21,23,28,39,58,210,227,231,343,349,362,377,384,923,receiv:72,73,86,87,380,recent:179,refer:31,291,297,421,906,refus:41,reject:41,rel:187,releas:308,906,remot:74,82,84,remov:14,15,151,316,rename_princip:3,renew:256,264,replai:71,85,265,899,913,replic:35,replica:34,39,915,represent:222,406,request:26,279,399,400,401,402,404,requir:416,944,resolv:135,152,303,305,resourc:934,respond:46,257,365,366,373,restor:23,restrict:240,951,result:169,retir:14,retriev:23,59,60,64,65,66,67,68,69,71,72,73,74,76,77,142,143,144,146,150,153,227,229,238,262,272,274,292,293,314,315,318,335,365,396,401,402,410,revers:38,rfc:101,119,risk:25,rout:41,rpc:328,358,s2kparam:229,s4u:43,safe:331,360,salt:229,258,347,374,394,salt_type_afs_length:767,salt_type_no_length:768,sampl:20,21,sclient:947,search:54,sec:410,section:20,21,59,60,secur:17,32,38,909,944,see:2,3,4,5,6,7,8,9,10,11,12,19,20,21,939,940,941,942,943,944,945,946,947,949,950,951,seen:41,select:26,154,918,send:76,77,88,89,381,sendauth:41,363,364,375,separ:902,sequenc:69,74,sequenti:139,158,318,seri:139,serial:321,server:14,15,32,41,154,265,363,364,931,servic:14,23,26,38,39,194,278,315,389,403,session:26,67,68,90,261,set:55,80,81,82,83,84,85,86,87,88,89,90,156,157,169,240,241,242,243,244,245,246,247,248,249,250,251,254,255,256,257,258,259,277,323,378,379,380,381,382,383,384,385,416,418,set_str:3,setup:35,shell:38,944,should:48,side:944,sign:300,320,signatur:300,301,simpl:787,906,sinc:410,singl:323,902,site:906,size:95,skew:15,167,socket:62,softwar:903,some:32,101,sourc:901,906,spake:40,909,specif:38,97,115,117,124,296,396,specifi:21,53,54,112,127,128,132,149,153,269,276,278,343,376,377,382,386,387,sserver:12,ssh:38,start:34,318,stash:6,23,900,stashsrvpw:5,state:35,79,106,108,storag:200,218,store:43,155,159,198,string:60,91,93,107,125,126,170,187,193,210,219,222,344,345,374,390,391,392,394,395,397,398,406,407,408,409,strong:14,struct:368,371,structur:20,21,61,66,83,142,174,175,176,177,183,199,201,202,203,206,207,208,209,215,216,220,236,292,293,344,378,385,406,407,408,409,415,802,subkei:72,73,76,77,86,87,88,89,sun:23,suppli:252,330,support:14,41,100,103,160,285,288,290,896,synchron:400,synopsi:2,3,4,5,6,7,8,9,10,11,12,939,940,941,942,943,944,945,946,947,syntax:19,system:410,904,915,tabdump:6,tabl:217,235,302,303,304,305,306,310,311,312,314,315,316,317,318,376,tarbal:906,target:944,termin:91,test:35,109,110,283,285,388,902,tgt:223,thi:332,896,906,threeparamopen:769,ticket:23,185,221,224,253,256,259,274,300,301,376,402,403,937,time:46,167,187,266,274,385,391,396,402,410,896,timestamp:167,395,397,398,tkt_flg_anonym:770,tkt_flg_enc_pa_rep:771,tkt_flg_forward:772,773,tkt_flg_hw_auth:774,tkt_flg_initi:775,tkt_flg_invalid:776,tkt_flg_may_postd:777,tkt_flg_ok_as_deleg:778,tkt_flg_postdat:779,tkt_flg_pre_auth:780,tkt_flg_proxi:782,tkt_flg_proxiabl:781,tkt_flg_renew:783,tkt_flg_transit_policy_check:784,token:36,37,43,910,tool:895,topic:13,trace:41,386,387,trailer:98,tree:902,trivial:909,troubleshoot:41,42,tune:904,tutori:42,two:52,105,107,322,348,349,350,362,type:14,20,24,26,36,41,43,81,96,97,105,109,110,111,118,127,128,144,146,149,160,170,192,193,204,211,244,254,261,263,312,337,374,378,390,392,394,802,895,899,904,uniqu:149,unix:32,33,915,unlock:3,unpars:339,unset:241,242,243,249,255,unwrap:184,412,updat:23,906,update_princ_encrypt:6,upgrad:14,usabl:111,usag:14,use:79,154,265,276,895,use_mkei:6,used:48,896,904,user:46,319,352,935,938,948,uses:894,using:91,92,93,99,101,102,119,194,235,260,264,269,271,282,287,289,330,376,382,383,400,417,418,419,902,util:901,va_list:417,418,419,valid:127,128,130,267,299,354,valid_int_bit:785,valid_uint_bit:786,valu:59,60,141,155,187,335,367,370,391,variabl:26,27,92,904,951,variou:42,verif:41,415,416,936,verifi:46,127,128,129,298,301,342,343,412,414,version:364,909,via:101,view:5,937,view_polici:5,web:906,934,whether:109,110,160,283,285,388,416,whitepap:42,wiki:934,within:167,902,without:906,work:15,wrap:43,189,write_kt:11,year:894,your:15,936,zero:209,291}})
\ No newline at end of file

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/index.html Changed

@@ -12,7 +12,7 @@
     <script type="text/javascript">
       var DOCUMENTATION_OPTIONS = {
         URL_ROOT:    '../',
-        VERSION:     '1.19.2',
+        VERSION:     '1.20.1',
         COLLAPSE_INDEX: false,
         FILE_SUFFIX: '.html',
         HAS_SOURCE:  true,
@@ -27,7 +27,7 @@
     <link rel="search" title="Search" href="../search.html" />
     <link rel="copyright" title="Copyright" href="../copyright.html" />
     <link rel="next" title="Password management" href="pwd_mgmt.html" />
-    <link rel="prev" title="MIT Kerberos Documentation (1.19.2)" href="../index.html" /> 
+    <link rel="prev" title="MIT Kerberos Documentation (1.20.1)" href="../index.html" /> 
   </head>
   <body>
     <div class="header-wrapper">
@@ -40,7 +40,7 @@
                 
         <a href="../index.html" title="Full Table of Contents"
             accesskey="C">Contents</a> |
-        <a href="../index.html" title="MIT Kerberos Documentation (1.19.2)"
+        <a href="../index.html" title="MIT Kerberos Documentation (1.20.1)"
             accesskey="P">previous</a> |
         <a href="pwd_mgmt.html" title="Password management"
             accesskey="N">next</a> |
@@ -149,14 +149,14 @@
 
     <div class="footer-wrapper">
         <div class="footer" >
-            <div class="right" ><i>Release: 1.19.2</i><br />
-                &copy; <a href="../copyright.html">Copyright</a> 1985-2021, MIT.
+            <div class="right" ><i>Release: 1.20.1</i><br />
+                &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
             </div>
             <div class="left">
                 
         <a href="../index.html" title="Full Table of Contents"
             >Contents</a> |
-        <a href="../index.html" title="MIT Kerberos Documentation (1.19.2)"
+        <a href="../index.html" title="MIT Kerberos Documentation (1.20.1)"
             >previous</a> |
         <a href="pwd_mgmt.html" title="Password management"
             >next</a> |

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/pwd_mgmt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/pwd_mgmt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/tkt_mgmt.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/tkt_mgmt.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/kdestroy.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/kdestroy.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/kinit.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/kinit.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/klist.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/klist.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/kpasswd.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/kpasswd.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/krb5-config.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/krb5-config.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/ksu.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/ksu.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/kswitch.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/kswitch.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/kvno.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/kvno.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_commands/sclient.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_commands/sclient.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_config/index.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_config/index.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_config/k5identity.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_config/k5identity.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_config/k5login.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_config/k5login.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/html/user/user_config/kerberos.html -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/html/user/user_config/kerberos.html Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/mitK5features.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/mitK5features.rst Changed

@@ -19,8 +19,8 @@
 License - :ref:`mitK5license`
 
 Releases:
-    - Latest stable: https://web.mit.edu/kerberos/krb5-1.18/
-    - Supported: https://web.mit.edu/kerberos/krb5-1.17/
+    - Latest stable: https://web.mit.edu/kerberos/krb5-1.20/
+    - Supported: https://web.mit.edu/kerberos/krb5-1.19/
     - Release cycle: approximately 12 months
 
 Supported platforms \/ OS distributions:
@@ -594,6 +594,55 @@
   - Added kvno flags --out-cache, --no-store, and --cached-only
     (inspired by Heimdal's kgetcred).
 
+Release 1.20
+
+* Administrator experience:
+
+  - Added a "disable_pac" realm relation to suppress adding PAC
+    authdata to tickets, for realms which do not need to support S4U
+    requests.
+
+  - Most credential cache types will use atomic replacement when a
+    cache is reinitialized using kinit or refreshed from the client
+    keytab.
+
+  - kprop can now propagate databases with a dump size larger than
+    4GB, if both the client and server are upgraded.
+
+  - kprop can now work over NATs that change the destination IP
+    address, if the client is upgraded.
+
+* Developer experience:
+
+  - Updated the KDB interface.  The sign_authdata() method is replaced
+    with the issue_pac() method, allowing KDB modules to add logon
+    info and other buffers to the PAC issued by the KDC.
+
+  - Host-based initiator names are better supported in the GSS krb5
+    mechanism.
+
+* Protocol evolution:
+
+  - Replaced AD-SIGNEDPATH authdata with minimal PACs.
+
+  - To avoid spurious replay errors, password change requests will not
+    be attempted over UDP until the attempt over TCP fails.
+
+  - PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
+
+* Code quality:
+
+  - Updated all code using OpenSSL to be compatible with OpenSSL 3.
+
+  - Reorganized the libk5crypto build system to allow the OpenSSL
+    back-end to pull in material from the builtin back-end depending
+    on the OpenSSL version.
+
+  - Simplified the PRNG logic to always use the platform PRNG.
+
+  - Converted the remaining Tcl tests to Python.
+
+
 `Pre-authentication mechanisms`
 
 - PW-SALT                                         :rfc:`4120#section-5.2.7.3`
@@ -606,10 +655,3 @@
 - S4U-X509-USER                (release 1.8)      https://msdn.microsoft.com/en-us/library/cc246091
 - OTP                          (release 1.12)     :ref:`otp_preauth`
 - SPAKE                        (release 1.17)     :ref:`spake`
-
-`PRNG`
-
-- modularity       (release 1.9)
-- Yarrow PRNG      (release < 1.10)
-- Fortuna PRNG     (release 1.9)       https://www.schneier.com/book-practical.html
-- OS PRNG          (release 1.10)      OS's native PRNG

_service:tar_scm:krb5-1.19.2.tar.gz/doc/notice.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/notice.rst Changed

@@ -1,4 +1,4 @@
-Copyright |copy| 1985-2021 by the Massachusetts Institute of Technology.
+Copyright |copy| 1985-2022 by the Massachusetts Institute of Technology.
 
 All rights reserved.
 
@@ -727,36 +727,6 @@
 
 -------------------
 
-Portions of the implementation of the Fortuna-like PRNG are subject to
-the following notice:
-
-    | Copyright |copy| 2005 Marko Kreen
-    | All rights reserved.
-
-    Redistribution and use in source and binary forms, with or without
-    modification, are permitted provided that the following conditions
-    are met:
-
-    1.  Redistributions of source code must retain the above copyright
-        notice, this list of conditions and the following disclaimer.
-    2.  Redistributions in binary form must reproduce the above copyright
-        notice, this list of conditions and the following disclaimer in the
-        documentation and/or other materials provided with the distribution.
-
-    THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" AND
-    ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-    ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-    FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-    DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-    OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-    LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-    OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-    SUCH DAMAGE.
-
-..
-
     Copyright |copy| 1994 by the University of Southern California
 
         EXPORT OF THIS SOFTWARE from the United States of America may
@@ -950,16 +920,6 @@
 
 -------------------
 
-The following notice applies to SWIG-generated code in
-``src/util/profile/profile_tcl.c``:
-
-    Copyright |copy| 1999-2000, The University of Chicago
-
-    This file may be freely redistributed without license or fee provided
-    this copyright message remains intact.
-
--------------------
-
 The following notice applies to portiions of ``src/lib/rpc`` and
 ``src/include/gssrpc``:

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/admin.pdf -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/admin.pdf Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/admin.tex -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/admin.tex Changed

@@ -55,7 +55,7 @@
 
 \title{Kerberos Administration Guide}
 \date{ }
-\release{1.19.2}
+\release{1.20.1}
 \author{MIT}
 \newcommand{\sphinxlogo}{\vbox{}}
 \renewcommand{\releasename}{Release}
@@ -1453,15 +1453,12 @@
 
 \paragraph{{}domain\_realm{}}
 \label{\detokenize{admin/conf_files/krb5_conf:id3}}\label{\detokenize{admin/conf_files/krb5_conf:domain-realm}}
-The {}domain\_realm{} section provides a translation from a domain name
-or hostname to a Kerberos realm name.  The tag name can be a host name
-or domain name, where domain names are indicated by a prefix of a
-period (\sphinxcode{.}).  The value of the relation is the Kerberos realm name
-for that particular host or domain.  A host name relation implicitly
-provides the corresponding domain name relation, unless an explicit domain
-name relation is provided.  The Kerberos realm may be
+The {}domain\_realm{} section provides a translation from hostnames to
+Kerberos realms.  Each tag is a domain name, providing the mapping for
+that domain and all subdomains.  If the tag begins with a period
+(\sphinxcode{.}) then it applies only to subdomains.  The Kerberos realm may be
 identified either in the {\hyperref\detokenize{admin/conf_files/krb5_conf:realms}{\sphinxcrossref{realms}}} section or using DNS SRV records.
-Host names and domain names should be in lower case.  For example:
+Tag names should be in lower case.  For example:
 
 \fvset{hllines={, ,}}%
 \begin{sphinxVerbatim}commandchars=\\\{\}
@@ -2518,6 +2515,12 @@
 if there is no policy assigned to the principal, no dictionary
 checks of passwords will be performed.
 
+\item{\sphinxstylestrong{disable\_pac}} \leavevmode
+(Boolean value.)  If true, the KDC will not issue PACs for this
+realm, and S4U2Self and S4U2Proxy operations will be disabled.
+The default is false, which will permit the KDC to issue PACs.
+New in release 1.20.
+
 \item{\sphinxstylestrong{encrypted\_challenge\_indicator}} \leavevmode
 (String.)  Specifies the authentication indicator value that the KDC
 asserts into tickets obtained using FAST encrypted challenge
@@ -6330,7 +6333,7 @@
 \item {} 
 Make sure the LDAP server is using local authentication
 (\sphinxcode{ldapi://}) or TLS (\sphinxcode{ldaps}).  See
-\sphinxurl{https://www.openldap.org/doc/admin24/tls.html} for instructions on
+\sphinxurl{https://www.openldap.org/doc/admin/tls.html} for instructions on
 configuring TLS support in OpenLDAP.
 
 \item {} 
@@ -6456,7 +6459,7 @@
 \item {} 
 Add an \sphinxcode{eq} index for \sphinxcode{krbPrincipalName} to speed up principal
 lookup operations.  See
-\sphinxurl{https://www.openldap.org/doc/admin24/tuning.html\#Indexes} for
+\sphinxurl{https://www.openldap.org/doc/admin/tuning.html\#Indexes} for
 details.
 
 \end{enumerate}
@@ -7828,6 +7831,15 @@
 krb5-1.10 or later.
 
 
+\subsection{OpenLDAP (ldapsearch, etc.)}
+\label{\detokenize{admin/princ_dns:openldap-ldapsearch-etc}}
+OpenLDAP’s SASL implementation performs reverse DNS lookup in order to
+canonicalize service principal names, even if \sphinxstylestrong{rdns} is set to
+\sphinxcode{false} in the Kerberos configuration.  To disable this behavior,
+add \sphinxcode{SASL\_NOCANON on} to \sphinxcode{ldap.conf}, or set the
+\sphinxcode{LDAPSASL\_NOCANON} environment variable.
+
+
 \chapter{Encryption types}
 \label{\detokenize{admin/enctypes:enctypes}}\label{\detokenize{admin/enctypes::doc}}\label{\detokenize{admin/enctypes:encryption-types}}
 Kerberos can use a variety of cipher algorithms to protect data.  A
@@ -10952,7 +10964,7 @@
 \PYG{n}{ktutil}\PYG{p}{:}  \PYG{n}{add\PYGZus{}entry} \PYG{o}{\PYGZhy{}}\PYG{n}{password} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{l+m+mi}{1} \PYG{o}{\PYGZhy{}}\PYG{n}{e}
     \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}
 \PYG{n}{Password} \PYG{k}{for} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:}
-\PYG{n}{ktutil}\PYG{p}{:}  \PYG{n}{write\PYGZus{}kt} \PYG{n}{keytab}
+\PYG{n}{ktutil}\PYG{p}{:}  \PYG{n}{write\PYGZus{}kt} \PYG{n}{alice}\PYG{o}{.}\PYG{n}{keytab}
 \PYG{n}{ktutil}\PYG{p}{:}
 \end{sphinxVerbatim}
 \end{quote}

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/appdev.pdf -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/appdev.pdf Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/appdev.tex -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/appdev.tex Changed

@@ -55,7 +55,7 @@
 
 \title{Kerberos Application Developer Guide}
 \date{ }
-\release{1.19.2}
+\release{1.20.1}
 \author{MIT}
 \newcommand{\sphinxlogo}{\vbox{}}
 \renewcommand{\releasename}{Release}
@@ -334,10 +334,8 @@
 \item {} 
 \sphinxstylestrong{ccache}: For acquiring initiator credentials, the name of the
 \DUrole{xref,std,std-ref}{credential cache} to which the handle will
-refer.  For storing credentials, the name of the cache where the
-credentials should be stored.  If a collection name is given, the
-primary cache of the collection will be used; this behavior may
-change in future releases to select a cache from the collection.
+refer.  For storing credentials, the name of the cache or collection
+where the credentials will be stored (see below).
 
 \item {} 
 \sphinxstylestrong{client\_keytab}: For acquiring initiator credentials, the name of
@@ -374,6 +372,15 @@
 
 \end{itemize}
 
+In release 1.20 or later, if a collection name is specified for
+\sphinxstylestrong{cache} in a call to gss\_store\_cred\_into(), an existing cache for
+the client principal within the collection will be selected, or a new
+cache will be created within the collection.  If \sphinxstyleemphasis{overwrite\_cred} is
+false and the selected credential cache already exists, a
+\sphinxstylestrong{GSS\_S\_DUPLICATE\_ELEMENT} error will be returned.  If \sphinxstyleemphasis{default\_cred}
+is true, the primary cache of the collection will be switched to the
+selected cache.
+
 
 \section{Importing and exporting credentials}
 \label{\detokenize{appdev/gssapi:importing-and-exporting-credentials}}
@@ -1359,6 +1366,8 @@
 
 Call {\hyperref\detokenize{appdev/refs/api/krb5_free_principal:c.krb5_free_principal}{\sphinxcrossref{\sphinxcode{krb5\_free\_principal()}}}} to free \sphinxstyleemphasis{princ} when it is no longer needed.
 
+Beginning with release 1.20, the name type of the principal will be inferred as \sphinxstylestrong{KRB5\_NT\_SRV\_INST} or \sphinxstylestrong{KRB5\_NT\_WELLKNOWN} based on the principal name. The type will be \sphinxstylestrong{KRB5\_NT\_PRINCIPAL} if a type cannot be inferred.
+
 \begin{sphinxadmonition}{note}{Note:}
 {\hyperref\detokenize{appdev/refs/api/krb5_build_principal:c.krb5_build_principal}{\sphinxcrossref{\sphinxcode{krb5\_build\_principal()}}}} and {\hyperref\detokenize{appdev/refs/api/krb5_build_principal_alloc_va:c.krb5_build_principal_alloc_va}{\sphinxcrossref{\sphinxcode{krb5\_build\_principal\_alloc\_va()}}}} perform the same task. {\hyperref\detokenize{appdev/refs/api/krb5_build_principal:c.krb5_build_principal}{\sphinxcrossref{\sphinxcode{krb5\_build\_principal()}}}} takes variadic arguments. {\hyperref\detokenize{appdev/refs/api/krb5_build_principal_alloc_va:c.krb5_build_principal_alloc_va}{\sphinxcrossref{\sphinxcode{krb5\_build\_principal\_alloc\_va()}}}} takes a pre-computed \sphinxstyleemphasis{varargs} pointer.
 \end{sphinxadmonition}
@@ -1439,6 +1448,8 @@
 
 This function creates a principal from a length-counted string and a variable-length list of length-counted components. The list of components ends with the first 0 length argument (so it is not possible to specify an empty component with this function). Call {\hyperref\detokenize{appdev/refs/api/krb5_free_principal:c.krb5_free_principal}{\sphinxcrossref{\sphinxcode{krb5\_free\_principal()}}}} to free allocated memory for principal when it is no longer needed.
 
+Beginning with release 1.20, the name type of the principal will be inferred as \sphinxstylestrong{KRB5\_NT\_SRV\_INST} or \sphinxstylestrong{KRB5\_NT\_WELLKNOWN} based on the principal name. The type will be \sphinxstylestrong{KRB5\_NT\_PRINCIPAL} if a type cannot be inferred.
+
 
 \subsubsection{krb5\_cc\_close -  Close a credential cache handle.}
 \label{\detokenize{appdev/refs/api/krb5_cc_close:krb5-cc-close-close-a-credential-cache-handle}}\label{\detokenize{appdev/refs/api/krb5_cc_close::doc}}\index{krb5\_cc\_close (C function)}
@@ -2334,8 +2345,8 @@
 This function may be used to request anonymous credentials from the KDC by setting \sphinxstyleemphasis{anonymous} to non-zero. Note that anonymous credentials are only a request; clients must verify that credentials are anonymous if that is a requirement.
 
 
-\subsubsection{krb5\_get\_init\_creds\_opt\_set\_canonicalize -  Set or unset the canonicalize flag in initial credential options.}
-\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize:krb5-get-init-creds-opt-set-canonicalize-set-or-unset-the-canonicalize-flag-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_canonicalize (C function)}
+\subsubsection{krb5\_get\_init\_creds\_opt\_set\_canonicalize -  Set or unset the canonicalize flag in initialcredential options.}
+\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize:krb5-get-init-creds-opt-set-canonicalize-set-or-unset-the-canonicalize-flag-in-initialcredential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_canonicalize (C function)}
 
 \begin{fulllineitems}
 \phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize:c.krb5_get_init_creds_opt_set_canonicalize}}\pysiglinewithargsret{void \sphinxbfcode{krb5\_get\_init\_creds\_opt\_set\_canonicalize}}{{\hyperref\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}{\sphinxcrossref{krb5\_get\_init\_creds\_opt}}} *\sphinxstyleemphasis{ opt}, int\sphinxstyleemphasis{ canonicalize}}{}
@@ -3378,6 +3389,8 @@
 
 To use the slash and @ symbols as part of a component (quoted) instead of using them as a component separator or as a realm prefix), put a backslash () character in front of the symbol. Similarly, newline, tab, backspace, and NULL characters can be included in a component by using \sphinxstylestrong{n} , \sphinxstylestrong{t} , \sphinxstylestrong{b} or \sphinxstylestrong{0} , respectively.
 
+Beginning with release 1.20, the name type of the principal will be inferred as \sphinxstylestrong{KRB5\_NT\_SRV\_INST} or \sphinxstylestrong{KRB5\_NT\_WELLKNOWN} based on the principal name. The type will be \sphinxstylestrong{KRB5\_NT\_PRINCIPAL} if a type cannot be inferred.
+
 Use {\hyperref\detokenize{appdev/refs/api/krb5_free_principal:c.krb5_free_principal}{\sphinxcrossref{\sphinxcode{krb5\_free\_principal()}}}} to free \sphinxstyleemphasis{principal\_out} when it is no longer needed.
 
 \begin{sphinxadmonition}{note}{Note:}
@@ -4506,9 +4519,14 @@
 \begin{quote}\begin{description}
 \item{retval} \leavevmode\begin{itemize}
 \item {} 
-0   The two addresses are the same
+0   if The two addresses are the same
+
+\item {} 
+\textless{}   0 First address is less than second
 
 \item {} 
+\textgreater{}   0 First address is greater than second
+
 \end{itemize}
 
 \end{description}\end{quote}
@@ -6318,8 +6336,8 @@
 \end{sphinxadmonition}
 
 
-\subsubsection{krb5\_cccol\_have\_content -  Check if the credential cache collection contains any credentials.}
-\label{\detokenize{appdev/refs/api/krb5_cccol_have_content:krb5-cccol-have-content-check-if-the-credential-cache-collection-contains-any-credentials}}\label{\detokenize{appdev/refs/api/krb5_cccol_have_content::doc}}\index{krb5\_cccol\_have\_content (C function)}
+\subsubsection{krb5\_cccol\_have\_content -  Check if the credential cache collection contains any initialized caches.}
+\label{\detokenize{appdev/refs/api/krb5_cccol_have_content:krb5-cccol-have-content-check-if-the-credential-cache-collection-contains-any-initialized-caches}}\label{\detokenize{appdev/refs/api/krb5_cccol_have_content::doc}}\index{krb5\_cccol\_have\_content (C function)}
 
 \begin{fulllineitems}
 \phantomsection\label{\detokenize{appdev/refs/api/krb5_cccol_have_content:c.krb5_cccol_have_content}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_cccol\_have\_content}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}}{}
@@ -6333,10 +6351,10 @@
 \begin{quote}\begin{description}
 \item{retval} \leavevmode\begin{itemize}
 \item {} 
-0   Credentials are available in the collection
+0   At least one initialized cache is present in the collection
 
 \item {} 
-KRB5\_CC\_NOTFOUND   The collection contains no credentials
+KRB5\_CC\_NOTFOUND   The collection contains no caches
 
 \end{itemize}
 
@@ -7628,6 +7646,92 @@
 \end{description}\end{quote}
 
 
+\subsubsection{krb5\_kdc\_sign\_ticket -  Sign a PAC, possibly including a ticket signature.}
+\label{\detokenize{appdev/refs/api/krb5_kdc_sign_ticket:krb5-kdc-sign-ticket-sign-a-pac-possibly-including-a-ticket-signature}}\label{\detokenize{appdev/refs/api/krb5_kdc_sign_ticket::doc}}\index{krb5\_kdc\_sign\_ticket (C function)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/api/krb5_kdc_sign_ticket:c.krb5_kdc_sign_ticket}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_kdc\_sign\_ticket}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, {\hyperref\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}{\sphinxcrossref{krb5\_enc\_tkt\_part}}} *\sphinxstyleemphasis{ enc\_tkt}, const {\hyperref\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}{\sphinxcrossref{krb5\_pac}}}\sphinxstyleemphasis{ pac}, {\hyperref\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}{\sphinxcrossref{krb5\_const\_principal}}}\sphinxstyleemphasis{ server\_princ}, {\hyperref\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}{\sphinxcrossref{krb5\_const\_principal}}}\sphinxstyleemphasis{ client\_princ}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ server}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ privsvr}, {\hyperref\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}{\sphinxcrossref{krb5\_boolean}}}\sphinxstyleemphasis{ with\_realm}}{}
+\end{fulllineitems}
+
+\begin{quote}\begin{description}
+\item{param} \leavevmode
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{enc\_tkt} - The ticket for the signature
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{pac} - PAC handle
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{server\_princ} - Canonical ticket server name
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{client\_princ} - PAC\_CLIENT\_INFO principal (or NULL)
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{server} - Key for server checksum
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{privsvr} - Key for KDC and ticket checksum
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{with\_realm} - If true, include the realm of \sphinxstyleemphasis{principal}
+
+\end{description}\end{quote}
+\begin{quote}\begin{description}
+\item{retval} \leavevmode\begin{itemize}
+\item {} 
+0   on success, otherwise - Kerberos error codes
+
+\end{itemize}
+
+\end{description}\end{quote}
+
+Sign \sphinxstyleemphasis{pac} using the keys \sphinxstyleemphasis{server} and \sphinxstyleemphasis{privsvr} . Include a ticket signature over \sphinxstyleemphasis{enc\_tkt} if \sphinxstyleemphasis{server\_princ} is not a TGS or kadmin/changepw principal name. Add the signed PAC’s encoding to the authorization data of \sphinxstyleemphasis{enc\_tkt} in the first slot, wrapped in an AD-IF-RELEVANT container. If \sphinxstyleemphasis{client\_princ} is non-null, add a PAC\_CLIENT\_INFO buffer, including the realm if \sphinxstyleemphasis{with\_realm} is true.
+
+\begin{sphinxadmonition}{note}{Note:}
+New in 1.20
+\end{sphinxadmonition}
+
+
+\subsubsection{krb5\_kdc\_verify\_ticket -  Verify a PAC, possibly including ticket signature.}
+\label{\detokenize{appdev/refs/api/krb5_kdc_verify_ticket:krb5-kdc-verify-ticket-verify-a-pac-possibly-including-ticket-signature}}\label{\detokenize{appdev/refs/api/krb5_kdc_verify_ticket::doc}}\index{krb5\_kdc\_verify\_ticket (C function)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/api/krb5_kdc_verify_ticket:c.krb5_kdc_verify_ticket}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_kdc\_verify\_ticket}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, const {\hyperref\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}{\sphinxcrossref{krb5\_enc\_tkt\_part}}} *\sphinxstyleemphasis{ enc\_tkt}, {\hyperref\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}{\sphinxcrossref{krb5\_const\_principal}}}\sphinxstyleemphasis{ server\_princ}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ server}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ privsvr}, {\hyperref\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}{\sphinxcrossref{krb5\_pac}}} *\sphinxstyleemphasis{ pac\_out}}{}
+\end{fulllineitems}
+
+\begin{quote}\begin{description}
+\item{param} \leavevmode
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{enc\_tkt} - Ticket enc-part, possibly containing a PAC
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{server\_princ} - Canonicalized name of ticket server
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{server} - Key to validate server checksum (or NULL)
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{privsvr} - Key to validate KDC checksum (or NULL)
+
+\sphinxstylestrong{{}out{}} \sphinxstylestrong{pac\_out} - Verified PAC (NULL if no PAC included)
+
+\end{description}\end{quote}
+\begin{quote}\begin{description}
+\item{retval} \leavevmode\begin{itemize}
+\item {} 
+0   Success; otherwise - Kerberos error codes
+
+\end{itemize}
+
+\end{description}\end{quote}
+
+If a PAC is present in \sphinxstyleemphasis{enc\_tkt} , verify its signatures. If \sphinxstyleemphasis{privsvr} is not NULL and \sphinxstyleemphasis{server\_princ} is not a krbtgt or kadmin/changepw service, require a ticket signature over \sphinxstyleemphasis{enc\_tkt} in addition to the KDC signature. Place the verified PAC in \sphinxstyleemphasis{pac\_out} . If an invalid PAC signature is found, return an error matching the Windows KDC protocol code for that condition as closely as possible.
+
+If no PAC is present in \sphinxstyleemphasis{enc\_tkt} , set \sphinxstyleemphasis{pac\_out} to NULL and return successfully.
+
+\begin{sphinxadmonition}{note}{Note:}
+This function does not validate the PAC\_CLIENT\_INFO buffer. If a specific value is expected, the caller can make a separate call to {\hyperref\detokenize{appdev/refs/api/krb5_pac_verify_ext:c.krb5_pac_verify_ext}{\sphinxcrossref{\sphinxcode{krb5\_pac\_verify\_ext()}}}} with a principal but no keys.
+\end{sphinxadmonition}
+
+\begin{sphinxadmonition}{note}{Note:}
+New in 1.20
+\end{sphinxadmonition}
+
+
 \subsubsection{krb5\_kt\_add\_entry -  Add a new entry to a key table.}
 \label{\detokenize{appdev/refs/api/krb5_kt_add_entry:krb5-kt-add-entry-add-a-new-entry-to-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_add_entry::doc}}\index{krb5\_kt\_add\_entry (C function)}
 
@@ -7950,6 +8054,36 @@
 This function wraps a list of authorization data entries \sphinxstyleemphasis{authdata} in an AD-KDCIssued container (see RFC 4120 section 5.2.6.2) signed with \sphinxstyleemphasis{key} . The result is returned in \sphinxstyleemphasis{ad\_kdcissued} as a single-element list.
 
 
+\subsubsection{krb5\_marshal\_credentials -  Serialize a krb5\_creds object.}
+\label{\detokenize{appdev/refs/api/krb5_marshal_credentials:krb5-marshal-credentials-serialize-a-krb5-creds-object}}\label{\detokenize{appdev/refs/api/krb5_marshal_credentials::doc}}\index{krb5\_marshal\_credentials (C function)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/api/krb5_marshal_credentials:c.krb5_marshal_credentials}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_marshal\_credentials}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, {\hyperref\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}{\sphinxcrossref{krb5\_creds}}} *\sphinxstyleemphasis{ in\_creds}, {\hyperref\detokenize{appdev/refs/types/krb5_data:c.krb5_data}{\sphinxcrossref{krb5\_data}}} **\sphinxstyleemphasis{ data\_out}}{}
+\end{fulllineitems}
+
+\begin{quote}\begin{description}
+\item{param} \leavevmode
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{in\_creds} - The credentials object to serialize
+
+\sphinxstylestrong{{}out{}} \sphinxstylestrong{data\_out} - The serialized credentials
+
+\end{description}\end{quote}
+\begin{quote}\begin{description}
+\item{retval} \leavevmode\begin{itemize}
+\item {} 
+0   Success; otherwise - Kerberos error codes
+
+\end{itemize}
+
+\end{description}\end{quote}
+
+Serialize \sphinxstyleemphasis{creds} in the format used by the FILE ccache format (vesion 4) and KCM ccache protocol.
+
+Use {\hyperref\detokenize{appdev/refs/api/krb5_free_data:c.krb5_free_data}{\sphinxcrossref{\sphinxcode{krb5\_free\_data()}}}} to free \sphinxstyleemphasis{data\_out} when it is no longer needed.
+
+
 \subsubsection{krb5\_merge\_authdata -  Merge two authorization data lists into a new list.}
 \label{\detokenize{appdev/refs/api/krb5_merge_authdata:krb5-merge-authdata-merge-two-authorization-data-lists-into-a-new-list}}\label{\detokenize{appdev/refs/api/krb5_merge_authdata::doc}}\index{krb5\_merge\_authdata (C function)}
 
@@ -8576,8 +8710,8 @@
 Use {\hyperref\detokenize{appdev/refs/api/krb5_pac_free:c.krb5_pac_free}{\sphinxcrossref{\sphinxcode{krb5\_pac\_free()}}}} to free \sphinxstyleemphasis{pac} when it is no longer needed.
 
 
-\subsubsection{krb5\_pac\_sign -  Sign a PAC.}
-\label{\detokenize{appdev/refs/api/krb5_pac_sign:krb5-pac-sign-sign-a-pac}}\label{\detokenize{appdev/refs/api/krb5_pac_sign::doc}}\index{krb5\_pac\_sign (C function)}
+\subsubsection{krb5\_pac\_sign}
+\label{\detokenize{appdev/refs/api/krb5_pac_sign:krb5-pac-sign}}\label{\detokenize{appdev/refs/api/krb5_pac_sign::doc}}\index{krb5\_pac\_sign (C function)}
 
 \begin{fulllineitems}
 \phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_sign:c.krb5_pac_sign}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_pac\_sign}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, {\hyperref\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}{\sphinxcrossref{krb5\_pac}}}\sphinxstyleemphasis{ pac}, {\hyperref\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}{\sphinxcrossref{krb5\_timestamp}}}\sphinxstyleemphasis{ authtime}, {\hyperref\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}{\sphinxcrossref{krb5\_const\_principal}}}\sphinxstyleemphasis{ principal}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ server\_key}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ privsvr\_key}, {\hyperref\detokenize{appdev/refs/types/krb5_data:c.krb5_data}{\sphinxcrossref{krb5\_data}}} *\sphinxstyleemphasis{ data}}{}
@@ -8585,31 +8719,27 @@
 
 \begin{quote}\begin{description}
 \item{param} \leavevmode
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
+\sphinxstylestrong{context}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{pac} - PAC handle
+\sphinxstylestrong{pac}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{authtime} - Expected timestamp
+\sphinxstylestrong{authtime}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{principal} - Expected principal name (or NULL)
+\sphinxstylestrong{principal}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{server\_key} - Key for server checksum
+\sphinxstylestrong{server\_key}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{privsvr\_key} - Key for KDC checksum
+\sphinxstylestrong{privsvr\_key}
 
-\sphinxstylestrong{{}out{}} \sphinxstylestrong{data} - Signed PAC encoding
+\sphinxstylestrong{data}
 
 \end{description}\end{quote}
 
-This function signs \sphinxstyleemphasis{pac} using the keys \sphinxstyleemphasis{server\_key} and \sphinxstyleemphasis{privsvr\_key} and returns the signed encoding in \sphinxstyleemphasis{data} . \sphinxstyleemphasis{pac} is modified to include the server and KDC checksum buffers. Use {\hyperref\detokenize{appdev/refs/api/krb5_free_data_contents:c.krb5_free_data_contents}{\sphinxcrossref{\sphinxcode{krb5\_free\_data\_contents()}}}} to free \sphinxstyleemphasis{data} when it is no longer needed.
+DEPRECATED Use krb5\_kdc\_sign\_ticket() instead.
 
-\begin{sphinxadmonition}{note}{Note:}
-New in 1.10
-\end{sphinxadmonition}
 
-
-\subsubsection{krb5\_pac\_sign\_ext -  Sign a PAC, possibly with a specified realm.}
-\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext:krb5-pac-sign-ext-sign-a-pac-possibly-with-a-specified-realm}}\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext::doc}}\index{krb5\_pac\_sign\_ext (C function)}
+\subsubsection{krb5\_pac\_sign\_ext}
+\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext:krb5-pac-sign-ext}}\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext::doc}}\index{krb5\_pac\_sign\_ext (C function)}
 
 \begin{fulllineitems}
 \phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext:c.krb5_pac_sign_ext}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_pac\_sign\_ext}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, {\hyperref\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}{\sphinxcrossref{krb5\_pac}}}\sphinxstyleemphasis{ pac}, {\hyperref\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}{\sphinxcrossref{krb5\_timestamp}}}\sphinxstyleemphasis{ authtime}, {\hyperref\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}{\sphinxcrossref{krb5\_const\_principal}}}\sphinxstyleemphasis{ principal}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ server\_key}, const {\hyperref\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}{\sphinxcrossref{krb5\_keyblock}}} *\sphinxstyleemphasis{ privsvr\_key}, {\hyperref\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}{\sphinxcrossref{krb5\_boolean}}}\sphinxstyleemphasis{ with\_realm}, {\hyperref\detokenize{appdev/refs/types/krb5_data:c.krb5_data}{\sphinxcrossref{krb5\_data}}} *\sphinxstyleemphasis{ data}}{}
@@ -8617,29 +8747,25 @@
 
 \begin{quote}\begin{description}
 \item{param} \leavevmode
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
+\sphinxstylestrong{context}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{pac} - PAC handle
+\sphinxstylestrong{pac}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{authtime} - Expected timestamp
+\sphinxstylestrong{authtime}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{principal} - Principal name (or NULL)
+\sphinxstylestrong{principal}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{server\_key} - Key for server checksum
+\sphinxstylestrong{server\_key}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{privsvr\_key} - Key for KDC checksum
+\sphinxstylestrong{privsvr\_key}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{with\_realm} - If true, include the realm of \sphinxstyleemphasis{principal}
+\sphinxstylestrong{with\_realm}
 
-\sphinxstylestrong{{}out{}} \sphinxstylestrong{data} - Signed PAC encoding
+\sphinxstylestrong{data}
 
 \end{description}\end{quote}
 
-This function is similar to {\hyperref\detokenize{appdev/refs/api/krb5_pac_sign:c.krb5_pac_sign}{\sphinxcrossref{\sphinxcode{krb5\_pac\_sign()}}}} , but adds a parameter \sphinxstyleemphasis{with\_realm} . If \sphinxstyleemphasis{with\_realm} is true, the PAC\_CLIENT\_INFO field of the signed PAC will include the realm of \sphinxstyleemphasis{principal} as well as the name. This flag is necessary to generate PACs for cross-realm S4U2Self referrals.
-
-\begin{sphinxadmonition}{note}{Note:}
-New in 1.17
-\end{sphinxadmonition}
+DEPRECATED Use krb5\_kdc\_sign\_ticket() instead.
 
 
 \subsubsection{krb5\_pac\_verify -  Verify a PAC.}
@@ -8714,8 +8840,8 @@
 \end{sphinxadmonition}
 
 
-\subsubsection{krb5\_pac\_get\_client\_info}
-\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info:krb5-pac-get-client-info}}\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info::doc}}\index{krb5\_pac\_get\_client\_info (C function)}
+\subsubsection{krb5\_pac\_get\_client\_info -  Read client information from a PAC.}
+\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info::doc}}\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info:krb5-pac-get-client-info-read-client-information-from-a-pac}}\index{krb5\_pac\_get\_client\_info (C function)}
 
 \begin{fulllineitems}
 \phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info:c.krb5_pac_get_client_info}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_pac\_get\_client\_info}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, const {\hyperref\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}{\sphinxcrossref{krb5\_pac}}}\sphinxstyleemphasis{ pac}, {\hyperref\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}{\sphinxcrossref{krb5\_timestamp}}} *\sphinxstyleemphasis{ authtime\_out}, char **\sphinxstyleemphasis{ princname\_out}}{}
@@ -8723,15 +8849,29 @@
 
 \begin{quote}\begin{description}
 \item{param} \leavevmode
-\sphinxstylestrong{context}
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
 
-\sphinxstylestrong{pac}
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{pac} - PAC handle
 
-\sphinxstylestrong{authtime\_out}
+\sphinxstylestrong{{}out{}} \sphinxstylestrong{authtime\_out} - Authentication timestamp (NULL if not needed)
 
-\sphinxstylestrong{princname\_out}
+\sphinxstylestrong{{}out{}} \sphinxstylestrong{princname\_out} - Client account name
 
 \end{description}\end{quote}
+\begin{quote}\begin{description}
+\item{retval} \leavevmode\begin{itemize}
+\item {} 
+0   on success, ENOENT if no PAC\_CLIENT\_INFO buffer is present in pac , ERANGE if the buffer contains invalid lengths.
+
+\end{itemize}
+
+\end{description}\end{quote}
+
+Read the PAC\_CLIENT\_INFO buffer in \sphinxstyleemphasis{pac} . Place the client account name as a string in \sphinxstyleemphasis{princname\_out} . If \sphinxstyleemphasis{authtime\_out} is not NULL, place the initial authentication timestamp in \sphinxstyleemphasis{authtime\_out} .
+
+\begin{sphinxadmonition}{note}{Note:}
+New in 1.18
+\end{sphinxadmonition}
 
 
 \subsubsection{krb5\_prepend\_error\_message -  Add a prefix to the message for an error code.}
@@ -9707,6 +9847,36 @@
 \end{sphinxadmonition}
 
 
+\subsubsection{krb5\_unmarshal\_credentials -  Deserialize a krb5\_creds object.}
+\label{\detokenize{appdev/refs/api/krb5_unmarshal_credentials::doc}}\label{\detokenize{appdev/refs/api/krb5_unmarshal_credentials:krb5-unmarshal-credentials-deserialize-a-krb5-creds-object}}\index{krb5\_unmarshal\_credentials (C function)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/api/krb5_unmarshal_credentials:c.krb5_unmarshal_credentials}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_unmarshal\_credentials}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, const {\hyperref\detokenize{appdev/refs/types/krb5_data:c.krb5_data}{\sphinxcrossref{krb5\_data}}} *\sphinxstyleemphasis{ data}, {\hyperref\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}{\sphinxcrossref{krb5\_creds}}} **\sphinxstyleemphasis{ creds\_out}}{}
+\end{fulllineitems}
+
+\begin{quote}\begin{description}
+\item{param} \leavevmode
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
+
+\sphinxstylestrong{{}in{}} \sphinxstylestrong{data} - The serialized credentials
+
+\sphinxstylestrong{{}out{}} \sphinxstylestrong{creds\_out} - The resulting creds object
+
+\end{description}\end{quote}
+\begin{quote}\begin{description}
+\item{retval} \leavevmode\begin{itemize}
+\item {} 
+0   Success; otherwise - Kerberos error codes
+
+\end{itemize}
+
+\end{description}\end{quote}
+
+Deserialize \sphinxstyleemphasis{data} to credentials in the format used by the FILE ccache format (vesion 4) and KCM ccache protocol.
+
+Use {\hyperref\detokenize{appdev/refs/api/krb5_free_creds:c.krb5_free_creds}{\sphinxcrossref{\sphinxcode{krb5\_free\_creds()}}}} to free \sphinxstyleemphasis{creds\_out} when it is no longer needed.
+
+
 \subsubsection{krb5\_verify\_init\_creds -  Verify initial credentials against a keytab.}
 \label{\detokenize{appdev/refs/api/krb5_verify_init_creds:krb5-verify-init-creds-verify-initial-credentials-against-a-keytab}}\label{\detokenize{appdev/refs/api/krb5_verify_init_creds::doc}}\index{krb5\_verify\_init\_creds (C function)}
 
@@ -10662,8 +10832,8 @@
 \end{description}\end{quote}
 
 
-\subsubsection{krb5\_c\_random\_add\_entropy -  Add entropy to the pseudo-random number generator.}
-\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy::doc}}\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy:krb5-c-random-add-entropy-add-entropy-to-the-pseudo-random-number-generator}}\index{krb5\_c\_random\_add\_entropy (C function)}
+\subsubsection{krb5\_c\_random\_add\_entropy}
+\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy::doc}}\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy:krb5-c-random-add-entropy}}\index{krb5\_c\_random\_add\_entropy (C function)}
 
 \begin{fulllineitems}
 \phantomsection\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy:c.krb5_c_random_add_entropy}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_c\_random\_add\_entropy}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, unsigned int\sphinxstyleemphasis{ randsource}, const {\hyperref\detokenize{appdev/refs/types/krb5_data:c.krb5_data}{\sphinxcrossref{krb5\_data}}} *\sphinxstyleemphasis{ data}}{}
@@ -10671,23 +10841,15 @@
 
 \begin{quote}\begin{description}
 \item{param} \leavevmode
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
-
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{randsource} - Entropy source (see KRB5\_RANDSOURCE types)
+\sphinxstylestrong{context}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{data} - Data
+\sphinxstylestrong{randsource}
 
-\end{description}\end{quote}
-\begin{quote}\begin{description}
-\item{retval} \leavevmode\begin{itemize}
-\item {} 
-0   Success; otherwise - Kerberos error codes
-
-\end{itemize}
+\sphinxstylestrong{data}
 
 \end{description}\end{quote}
 
-Contribute entropy to the PRNG used by krb5 crypto operations. This may or may not affect the output of the next crypto operation requiring random data.
+DEPRECATED This call is no longer necessary.
 
 
 \subsubsection{krb5\_c\_random\_make\_octets -  Generate pseudo-random bytes.}
@@ -10716,8 +10878,8 @@
 Fills in \sphinxstyleemphasis{data} with bytes from the PRNG used by krb5 crypto operations. The caller must preinitialize \sphinxstyleemphasis{data} and allocate the desired amount of space.
 
 
-\subsubsection{krb5\_c\_random\_os\_entropy -  Collect entropy from the OS if possible.}
-\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy:krb5-c-random-os-entropy-collect-entropy-from-the-os-if-possible}}\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy::doc}}\index{krb5\_c\_random\_os\_entropy (C function)}
+\subsubsection{krb5\_c\_random\_os\_entropy}
+\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy::doc}}\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy:krb5-c-random-os-entropy}}\index{krb5\_c\_random\_os\_entropy (C function)}
 
 \begin{fulllineitems}
 \phantomsection\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy:c.krb5_c_random_os_entropy}}\pysiglinewithargsret{{\hyperref\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}{\sphinxcrossref{krb5\_error\_code}}} \sphinxbfcode{krb5\_c\_random\_os\_entropy}}{{\hyperref\detokenize{appdev/refs/types/krb5_context:c.krb5_context}{\sphinxcrossref{krb5\_context}}}\sphinxstyleemphasis{ context}, int\sphinxstyleemphasis{ strong}, int *\sphinxstyleemphasis{ success}}{}
@@ -10725,23 +10887,15 @@
 
 \begin{quote}\begin{description}
 \item{param} \leavevmode
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{context} - Library context
+\sphinxstylestrong{context}
 
-\sphinxstylestrong{{}in{}} \sphinxstylestrong{strong} - Strongest available source of entropy
+\sphinxstylestrong{strong}
 
-\sphinxstylestrong{{}out{}} \sphinxstylestrong{success} - 1 if OS provides entropy, 0 otherwise
+\sphinxstylestrong{success}
 
 \end{description}\end{quote}
-\begin{quote}\begin{description}
-\item{retval} \leavevmode\begin{itemize}
-\item {} 
-0   Success; otherwise - Kerberos error codes
 
-\end{itemize}
-
-\end{description}\end{quote}
-
-If \sphinxstyleemphasis{strong} is non-zero, this function attempts to use the strongest available source of entropy. Setting this flag may cause the function to block on some operating systems. Good uses include seeding the PRNG for kadmind and realm setup.
+DEPRECATED This call is no longer necessary.
 
 
 \subsubsection{krb5\_c\_random\_to\_key -  Generate an enctype-specific key from random data.}
@@ -12040,7 +12194,7 @@
 
 \end{description}\end{quote}
 
-DEPRECATED Replaced by krb5\_c\_* API family.
+DEPRECATED This call is no longer necessary.
 
 
 \subsubsection{krb5\_calculate\_checksum}
@@ -14624,7 +14778,7 @@
 
 Hook function for inspecting or modifying messages sent to KDCs.
 
-If the hook function sets \sphinxstyleemphasis{reply\_out} , \sphinxstyleemphasis{message} will not be sent to the KDC, and the given reply will used instead.
+If the hook function sets \sphinxstyleemphasis{new\_reply\_out} , \sphinxstyleemphasis{message} will not be sent to the KDC, and the given reply will used instead.
 If the hook function sets \sphinxstyleemphasis{new\_message\_out} , the given message will be sent to the KDC in place of \sphinxstyleemphasis{message} .
 If the hook function returns successfully without setting either output, \sphinxstyleemphasis{message} will be sent to the KDC normally.
 The hook function should use {\hyperref\detokenize{appdev/refs/api/krb5_copy_data:c.krb5_copy_data}{\sphinxcrossref{\sphinxcode{krb5\_copy\_data()}}}} to construct the value for \sphinxstyleemphasis{new\_message\_out} or \sphinxstyleemphasis{reply\_out} , to ensure that it can be freed correctly by the library.
@@ -16579,6 +16733,32 @@
 \sphinxattableend\end{savenotes}
 
 
+\subsubsection{CKSUMTYPE\_SHA1}
+\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1::doc}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1:cksumtype-sha1}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1:cksumtype-sha1-data}}\index{CKSUMTYPE\_SHA1 (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1:CKSUMTYPE_SHA1}}\pysigline{\sphinxbfcode{CKSUMTYPE\_SHA1}}
+\end{fulllineitems}
+
+
+RFC 3961.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{CKSUMTYPE\_SHA1}
+&
+\sphinxcode{0x000e}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
 \subsubsection{ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96}
 \label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96:enctype-aes128-cts-hmac-sha1-96-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96::doc}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96:enctype-aes128-cts-hmac-sha1-96}}\index{ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96 (built-in variable)}
 
@@ -18073,8 +18253,6 @@
 \end{fulllineitems}
 
 
-formerly 142 in krb5 1.8
-
 
 \begin{savenotes}\sphinxattablestart
 \centering
@@ -21333,6 +21511,32 @@
 \sphinxattableend\end{savenotes}
 
 
+\subsubsection{KRB5\_PAC\_ATTRIBUTES\_INFO}
+\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO:krb5-pac-attributes-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO:krb5-pac-attributes-info}}\index{KRB5\_PAC\_ATTRIBUTES\_INFO (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO:KRB5_PAC_ATTRIBUTES_INFO}}\pysigline{\sphinxbfcode{KRB5\_PAC\_ATTRIBUTES\_INFO}}
+\end{fulllineitems}
+
+
+PAC attributes.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{KRB5\_PAC\_ATTRIBUTES\_INFO}
+&
+\sphinxcode{17}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
 \subsubsection{KRB5\_PAC\_CLIENT\_INFO}
 \label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_INFO:krb5-pac-client-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_INFO::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_INFO:krb5-pac-client-info-data}}\index{KRB5\_PAC\_CLIENT\_INFO (built-in variable)}
 
@@ -21359,6 +21563,32 @@
 \sphinxattableend\end{savenotes}
 
 
+\subsubsection{KRB5\_PAC\_CLIENT\_CLAIMS}
+\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS:krb5-pac-client-claims-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS:krb5-pac-client-claims}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS::doc}}\index{KRB5\_PAC\_CLIENT\_CLAIMS (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS:KRB5_PAC_CLIENT_CLAIMS}}\pysigline{\sphinxbfcode{KRB5\_PAC\_CLIENT\_CLAIMS}}
+\end{fulllineitems}
+
+
+Client claims information.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{KRB5\_PAC\_CLIENT\_CLAIMS}
+&
+\sphinxcode{13}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
 \subsubsection{KRB5\_PAC\_CREDENTIALS\_INFO}
 \label{\detokenize{appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO:krb5-pac-credentials-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO:krb5-pac-credentials-info-data}}\index{KRB5\_PAC\_CREDENTIALS\_INFO (built-in variable)}
 
@@ -21411,6 +21641,58 @@
 \sphinxattableend\end{savenotes}
 
 
+\subsubsection{KRB5\_PAC\_DEVICE\_CLAIMS}
+\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS:krb5-pac-device-claims}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS:krb5-pac-device-claims-data}}\index{KRB5\_PAC\_DEVICE\_CLAIMS (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS:KRB5_PAC_DEVICE_CLAIMS}}\pysigline{\sphinxbfcode{KRB5\_PAC\_DEVICE\_CLAIMS}}
+\end{fulllineitems}
+
+
+Device claims information.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{KRB5\_PAC\_DEVICE\_CLAIMS}
+&
+\sphinxcode{15}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
+\subsubsection{KRB5\_PAC\_DEVICE\_INFO}
+\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO:krb5-pac-device-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO:krb5-pac-device-info}}\index{KRB5\_PAC\_DEVICE\_INFO (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO:KRB5_PAC_DEVICE_INFO}}\pysigline{\sphinxbfcode{KRB5\_PAC\_DEVICE\_INFO}}
+\end{fulllineitems}
+
+
+Device information.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{KRB5\_PAC\_DEVICE\_INFO}
+&
+\sphinxcode{14}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
 \subsubsection{KRB5\_PAC\_LOGON\_INFO}
 \label{\detokenize{appdev/refs/macros/KRB5_PAC_LOGON_INFO:krb5-pac-logon-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_LOGON_INFO:krb5-pac-logon-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_LOGON_INFO::doc}}\index{KRB5\_PAC\_LOGON\_INFO (built-in variable)}
 
@@ -21463,6 +21745,32 @@
 \sphinxattableend\end{savenotes}
 
 
+\subsubsection{KRB5\_PAC\_REQUESTOR}
+\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR:krb5-pac-requestor}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR:krb5-pac-requestor-data}}\index{KRB5\_PAC\_REQUESTOR (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR:KRB5_PAC_REQUESTOR}}\pysigline{\sphinxbfcode{KRB5\_PAC\_REQUESTOR}}
+\end{fulllineitems}
+
+
+PAC requestor SID.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{KRB5\_PAC\_REQUESTOR}
+&
+\sphinxcode{18}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
 \subsubsection{KRB5\_PAC\_SERVER\_CHECKSUM}
 \label{\detokenize{appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM:krb5-pac-server-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM:krb5-pac-server-checksum}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM::doc}}\index{KRB5\_PAC\_SERVER\_CHECKSUM (built-in variable)}
 
@@ -21489,6 +21797,32 @@
 \sphinxattableend\end{savenotes}
 
 
+\subsubsection{KRB5\_PAC\_TICKET\_CHECKSUM}
+\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM:krb5-pac-ticket-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM:krb5-pac-ticket-checksum}}\index{KRB5\_PAC\_TICKET\_CHECKSUM (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM:KRB5_PAC_TICKET_CHECKSUM}}\pysigline{\sphinxbfcode{KRB5\_PAC\_TICKET\_CHECKSUM}}
+\end{fulllineitems}
+
+
+Ticket checksum.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{KRB5\_PAC\_TICKET\_CHECKSUM}
+&
+\sphinxcode{16}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
 \subsubsection{KRB5\_PAC\_UPN\_DNS\_INFO}
 \label{\detokenize{appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO:krb5-pac-upn-dns-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO:krb5-pac-upn-dns-info}}\index{KRB5\_PAC\_UPN\_DNS\_INFO (built-in variable)}
 
@@ -22491,6 +22825,32 @@
 \sphinxattableend\end{savenotes}
 
 
+\subsubsection{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2}
+\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2:krb5-padata-redhat-idp-oauth2-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2:krb5-padata-redhat-idp-oauth2}}\index{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2 (built-in variable)}
+
+\begin{fulllineitems}
+\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2:KRB5_PADATA_REDHAT_IDP_OAUTH2}}\pysigline{\sphinxbfcode{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2}}
+\end{fulllineitems}
+
+
+Red Hat IdP mechanism.
+
+
+\begin{savenotes}\sphinxattablestart
+\centering
+\begin{tabulary}{\linewidth}t{|T|T|}
+\hline
+
+\sphinxcode{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2}
+&
+\sphinxcode{152}
+\\
+\hline
+\end{tabulary}
+\par
+\sphinxattableend\end{savenotes}
+
+
 \subsubsection{KRB5\_PADATA\_SVR\_REFERRAL\_INFO}
 \label{\detokenize{appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO::doc}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO:krb5-padata-svr-referral-info}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO:krb5-padata-svr-referral-info-data}}\index{KRB5\_PADATA\_SVR\_REFERRAL\_INFO (built-in variable)}
 
@@ -23227,7 +23587,7 @@
 
 \fvset{hllines={, ,}}%
 \begin{sphinxVerbatim}commandchars=\\\{\}
- \PYG{p}{\PYGZob{}}
+\PYG{p}{\PYGZob{}}
     \PYG{n}{identity} \PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}} \PYG{o}{:} \PYG{n}{flags} \PYG{o}{\PYGZlt{}}\PYG{n}{number}\PYG{o}{\PYGZgt{}}\PYG{p}{,}
     \PYG{p}{.}\PYG{p}{.}\PYG{p}{.}
 \PYG{p}{\PYGZcb{}}
@@ -23237,7 +23597,7 @@
 
 \fvset{hllines={, ,}}%
 \begin{sphinxVerbatim}commandchars=\\\{\}
- \PYG{p}{\PYGZob{}}
+\PYG{p}{\PYGZob{}}
     \PYG{n}{identity} \PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}} \PYG{o}{:} \PYG{n}{password} \PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}}\PYG{p}{,}
     \PYG{p}{.}\PYG{p}{.}\PYG{p}{.}
 \PYG{p}{\PYGZcb{}}
@@ -23455,7 +23815,7 @@
 
 \fvset{hllines={, ,}}%
 \begin{sphinxVerbatim}commandchars=\\\{\}
- \PYG{p}{\PYGZob{}}
+\PYG{p}{\PYGZob{}}
   \PYG{l+s}{\PYGZdq{}}\PYG{l+s}{service}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:} \PYG{o}{\PYGZlt{}}\PYG{n}{string} \PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,}
   \PYG{l+s}{\PYGZdq{}}\PYG{l+s}{tokenInfo}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:} \PYG{p}{}
     \PYG{p}{\PYGZob{}}
@@ -23476,7 +23836,7 @@
 
 \fvset{hllines={, ,}}%
 \begin{sphinxVerbatim}commandchars=\\\{\}
- \PYG{p}{\PYGZob{}}
+\PYG{p}{\PYGZob{}}
   \PYG{l+s}{\PYGZdq{}}\PYG{l+s}{tokeninfo}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:} \PYG{o}{\PYGZlt{}}\PYG{n}{number}\PYG{o}{\PYGZgt{}}\PYG{p}{,}
   \PYG{l+s}{\PYGZdq{}}\PYG{l+s}{value}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}     \PYG{o}{\PYGZlt{}}\PYG{n}{string} \PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,}
   \PYG{l+s}{\PYGZdq{}}\PYG{l+s}{pin}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}       \PYG{o}{\PYGZlt{}}\PYG{n}{string} \PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,}

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/basic.pdf -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/basic.pdf Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/basic.tex -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/basic.tex Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/build.pdf -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/build.pdf Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/build.tex -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/build.tex Changed

@@ -55,7 +55,7 @@
 
 \title{Building MIT Kerberos}
 \date{ }
-\release{1.19.2}
+\release{1.20.1}
 \author{MIT}
 \newcommand{\sphinxlogo}{\vbox{}}
 \renewcommand{\releasename}{Release}
@@ -422,32 +422,15 @@
 \PYG{n}{make} \PYG{n}{check}
 \end{sphinxVerbatim}
 
-However, there are several prerequisites that must be satisfied first:
-\begin{itemize}
-\item {} 
-Configure and build Kerberos with Tcl support. Tcl is used to drive
-the test suite.  This often means passing \sphinxstylestrong{-}\sphinxstylestrong{-with-tcl} to
-configure to tell it the location of the Tcl configuration
-script. (See {\hyperref\detokenize{build/options2configure:options2configure}{\sphinxcrossref{\DUrole{std,std-ref}{Options to configure}}}}.)
-
-\item {} 
-In addition to Tcl, DejaGnu must be available on the system for some
-of the tests to run.  The test suite will still run the other tests
-if DejaGnu is not present, but the test coverage will be reduced
-accordingly.
-
-\item {} 
 On some operating systems, you have to run \sphinxcode{make install} before
 running \sphinxcode{make check}, or the test suite will pick up installed
-versions of Kerberos libraries rather than the newly built ones.
-You can install into a prefix that isn’t in the system library
-search path, though. Alternatively, you can configure with
-\sphinxstylestrong{-}\sphinxstylestrong{-disable-rpath}, which renders the build tree less suitable for
-installation, but allows testing without interference from
+versions of Kerberos libraries rather than the newly built ones.  You
+can install into a prefix that isn’t in the system library search
+path, though.  Alternatively, you can configure with
+\sphinxstylestrong{-}\sphinxstylestrong{-disable-rpath}, which renders the build tree less suitable
+for installation, but allows testing without interference from
 previously installed libraries.
 
-\end{itemize}
-
 There are additional regression tests available, which are not run
 by \sphinxcode{make check}.  These tests require manual setup and teardown of
 support infrastructure which is not easily automated, or require
@@ -533,12 +516,6 @@
 library or fails to pass the tests in \sphinxcode{src/tests/resolv}, you
 will need to use this option.
 
-\item{\sphinxstylestrong{-}\sphinxstylestrong{-with-tcl=}\sphinxstyleemphasis{TCLPATH}} \leavevmode
-Some of the unit-tests in the build tree rely upon using a program
-in Tcl.  The directory specified by \sphinxstyleemphasis{TCLPATH} specifies where the
-Tcl header file (TCLPATH/include/tcl.h) as well as where the Tcl
-library (TCLPATH/lib) should be found.
-
 \item{\sphinxstylestrong{-}\sphinxstylestrong{-enable-dns-for-realm}} \leavevmode
 Enable the use of DNS to look up a host’s Kerberos realm,
 if the information is not provided in
@@ -831,11 +808,6 @@
 \item{\sphinxstylestrong{-}\sphinxstylestrong{-with-lmdb}} \leavevmode
 Compile LMDB database backend module.
 
-\item{\sphinxstylestrong{-}\sphinxstylestrong{-with-tcl=}\sphinxstyleemphasis{path}} \leavevmode
-Specifies that \sphinxstyleemphasis{path} is the location of a Tcl installation.
-Tcl is needed for some of the tests run by ‘make check’; such tests
-will be skipped if this option is not set.
-
 \item{\sphinxstylestrong{-}\sphinxstylestrong{-with-vague-errors}} \leavevmode
 Do not send helpful errors to client.  For example, if the KDC
 should return only vague error codes to clients.
@@ -846,11 +818,6 @@
 implemented crypto backend is \sphinxcode{openssl}.  (See
 \DUrole{xref,std,std-ref}{mitK5features})
 
-\item{\sphinxstylestrong{-}\sphinxstylestrong{-with-prng-alg=}\sphinxstyleemphasis{ALG}} \leavevmode
-Use specified PRNG algorithm.  For example, to use the OS native
-prng specify \sphinxcode{-{-}with-prng-alg=os}.  The default is \sphinxcode{fortuna}.
-(See \DUrole{xref,std,std-ref}{mitK5features})
-
 \item{\sphinxstylestrong{-}\sphinxstylestrong{-without-libedit}} \leavevmode
 Do not compile and link against libedit.  Some utilities will no
 longer offer command history or completion in interactive mode if
@@ -858,8 +825,6 @@
 
 \item{\sphinxstylestrong{-}\sphinxstylestrong{-with-readline}} \leavevmode
 Compile and link against GNU readline, as an alternative to libedit.
-Building with readline breaks the dejagnu test suite, which is a
-subset of the tests run by ‘make check’.
 
 \item{\sphinxstylestrong{-}\sphinxstylestrong{-with-system-verto}} \leavevmode
 Use an installed version of libverto.  If the libverto header and

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/plugindev.pdf -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/plugindev.pdf Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/plugindev.tex -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/plugindev.tex Changed

@@ -55,7 +55,7 @@
 
 \title{Kerberos Plugin Module Developer Guide}
 \date{ }
-\release{1.19.2}
+\release{1.20.1}
 \author{MIT}
 \newcommand{\sphinxlogo}{\vbox{}}
 \renewcommand{\releasename}{Release}
@@ -742,13 +742,18 @@
 gss\_add\_oid\_set\_member functions.
 
 An interposer module must use the prefix \sphinxcode{gssi\_} for the GSSAPI
-functions it exports, instead of the prefix \sphinxcode{gss\_}.
+functions it exports, instead of the prefix \sphinxcode{gss\_}.  In most cases,
+unexported \sphinxcode{gssi\_} functions will result in failure from their
+corresponding \sphinxcode{gss\_} calls.
 
 An interposer module can link against the GSSAPI library in order to
 make calls to the original mechanism.  To do so, it must specify a
 special mechanism OID which is the concatention of the interposer’s
 own OID byte string and the original mechanism’s OID byte string.
 
+Functions that do not accept a mechanism argument directly require no
+special handling, with the following exceptions:
+
 Since \sphinxstylestrong{gss\_accept\_sec\_context} does not accept a mechanism argument,
 an interposer mechanism must, in order to invoke the original
 mechanism’s function, acquire a credential for the concatenated OID
@@ -777,25 +782,29 @@
 
 To re-enter the original mechanism when importing tokens for the above
 functions, the interposer module must wrap the mechanism token in the
-mechglue’s format, using the concatenated OID.  The mechglue token
-formats are:
+mechglue’s format, using the concatenated OID (except in
+\sphinxstylestrong{gss\_import\_name}).  The mechglue token formats are:
 \begin{itemize}
 \item {} 
 For \sphinxstylestrong{gss\_import\_sec\_context}, a four-byte OID length in big-endian
-order, followed by the mechanism OID, followed by the mechanism
+order, followed by the concatenated OID, followed by the mechanism
 token.
 
 \item {} 
 For \sphinxstylestrong{gss\_import\_name}, the bytes 04 01, followed by a two-byte OID
 length in big-endian order, followed by the mechanism OID, followed
-by the bytes 06, followed by the OID length as a single byte,
-followed by the mechanism OID, followed by the mechanism token.
+by a four-byte token length in big-endian order, followed by the
+mechanism token.  Unlike most uses of OIDs in the API, the mechanism
+OID encoding must include the DER tag and length for an object
+identifier (06 followed by the DER length of the OID byte string),
+and this prefix must be included in the two-byte OID length.
+input\_name\_type must also be set to GSS\_C\_NT\_EXPORT\_NAME.
 
 \item {} 
 For \sphinxstylestrong{gss\_import\_cred}, a four-byte OID length in big-endian order,
-followed by the mechanism OID, followed by a four-byte token length
-in big-endian order, followed by the mechanism token.  This sequence
-may be repeated multiple times.
+followed by the concatenated OID, followed by a four-byte token
+length in big-endian order, followed by the mechanism token.  This
+sequence may be repeated multiple times.
 
 \end{itemize}
 
@@ -843,13 +852,19 @@
 whether a client’s certificate is authorized to authenticate a client
 principal.  \sphinxstylestrong{authorize} receives the DER-encoded certificate, the
 requested client principal, and a pointer to the client’s
-krb5\_db\_entry (for modules that link against libkdb5).  It returns the
+krb5\_db\_entry (for modules that link against libkdb5).  The method
+must decode the certificate and inspect its attributes to determine if
+it should authorize PKINIT authentication.  It returns the
 authorization status and optionally outputs a list of authentication
-indicator strings to be added to the ticket.  Beginning in release
-1.19, the authorize method can request that the hardware
-authentication bit be set in the ticket by returning
-\sphinxstylestrong{KRB5\_CERTAUTH\_HWAUTH}.  A module must use its own internal or
-library-provided ASN.1 certificate decoder.
+indicator strings to be added to the ticket.
+
+Beginning in release 1.19, the authorize method can request that the
+hardware authentication bit be set in the ticket by returning
+\sphinxstylestrong{KRB5\_CERTAUTH\_HWAUTH}.  Beginning in release 1.20, the authorize
+method can return \sphinxstylestrong{KRB5\_CERTAUTH\_HWAUTH\_PASS} to request that the
+hardware authentication bit be set in the ticket but otherwise defer
+authorization to another certauth module.  A module must use its own
+internal or library-provided ASN.1 certificate decoder.
 
 A module can optionally create and destroy module data with the
 \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods.  Module data objects last for the

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/user.pdf -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/user.pdf Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/pdf/user.tex -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/pdf/user.tex Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/plugindev/certauth.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/plugindev/certauth.rst Changed

@@ -13,13 +13,19 @@
 whether a client's certificate is authorized to authenticate a client
 principal.  **authorize** receives the DER-encoded certificate, the
 requested client principal, and a pointer to the client's
-krb5_db_entry (for modules that link against libkdb5).  It returns the
+krb5_db_entry (for modules that link against libkdb5).  The method
+must decode the certificate and inspect its attributes to determine if
+it should authorize PKINIT authentication.  It returns the
 authorization status and optionally outputs a list of authentication
-indicator strings to be added to the ticket.  Beginning in release
-1.19, the authorize method can request that the hardware
-authentication bit be set in the ticket by returning
-**KRB5_CERTAUTH_HWAUTH**.  A module must use its own internal or
-library-provided ASN.1 certificate decoder.
+indicator strings to be added to the ticket.
+
+Beginning in release 1.19, the authorize method can request that the
+hardware authentication bit be set in the ticket by returning
+**KRB5_CERTAUTH_HWAUTH**.  Beginning in release 1.20, the authorize
+method can return **KRB5_CERTAUTH_HWAUTH_PASS** to request that the
+hardware authentication bit be set in the ticket but otherwise defer
+authorization to another certauth module.  A module must use its own
+internal or library-provided ASN.1 certificate decoder.
 
 A module can optionally create and destroy module data with the
 **init** and **fini** methods.  Module data objects last for the

_service:tar_scm:krb5-1.19.2.tar.gz/doc/plugindev/gssapi.rst -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/plugindev/gssapi.rst Changed

@@ -75,13 +75,18 @@
 gss_add_oid_set_member functions.
 
 An interposer module must use the prefix ``gssi_`` for the GSSAPI
-functions it exports, instead of the prefix ``gss_``.
+functions it exports, instead of the prefix ``gss_``.  In most cases,
+unexported ``gssi_`` functions will result in failure from their
+corresponding ``gss_`` calls.
 
 An interposer module can link against the GSSAPI library in order to
 make calls to the original mechanism.  To do so, it must specify a
 special mechanism OID which is the concatention of the interposer's
 own OID byte string and the original mechanism's OID byte string.
 
+Functions that do not accept a mechanism argument directly require no
+special handling, with the following exceptions:
+
 Since **gss_accept_sec_context** does not accept a mechanism argument,
 an interposer mechanism must, in order to invoke the original
 mechanism's function, acquire a credential for the concatenated OID
@@ -107,19 +112,23 @@
 
 To re-enter the original mechanism when importing tokens for the above
 functions, the interposer module must wrap the mechanism token in the
-mechglue's format, using the concatenated OID.  The mechglue token
-formats are:
+mechglue's format, using the concatenated OID (except in
+**gss_import_name**).  The mechglue token formats are:
 
 * For **gss_import_sec_context**, a four-byte OID length in big-endian
-  order, followed by the mechanism OID, followed by the mechanism
+  order, followed by the concatenated OID, followed by the mechanism
   token.
 
 * For **gss_import_name**, the bytes 04 01, followed by a two-byte OID
   length in big-endian order, followed by the mechanism OID, followed
-  by the bytes 06, followed by the OID length as a single byte,
-  followed by the mechanism OID, followed by the mechanism token.
+  by a four-byte token length in big-endian order, followed by the
+  mechanism token.  Unlike most uses of OIDs in the API, the mechanism
+  OID encoding must include the DER tag and length for an object
+  identifier (06 followed by the DER length of the OID byte string),
+  and this prefix must be included in the two-byte OID length.
+  input_name_type must also be set to GSS_C_NT_EXPORT_NAME.
 
 * For **gss_import_cred**, a four-byte OID length in big-endian order,
-  followed by the mechanism OID, followed by a four-byte token length
-  in big-endian order, followed by the mechanism token.  This sequence
-  may be repeated multiple times.
+  followed by the concatenated OID, followed by a four-byte token
+  length in big-endian order, followed by the mechanism token.  This
+  sequence may be repeated multiple times.

_service:tar_scm:krb5-1.19.2.tar.gz/doc/thread-safe.txt -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/thread-safe.txt Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/tools/__pycache__/docmodel.cpython-36.pyc -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/tools/__pycache__/docmodel.cpython-36.pyc Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/tools/__pycache__/doxybuilder_funcs.cpython-36.pyc -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/tools/__pycache__/doxybuilder_funcs.cpython-36.pyc Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/tools/__pycache__/doxybuilder_types.cpython-36.pyc -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/tools/__pycache__/doxybuilder_types.cpython-36.pyc Changed

_service:tar_scm:krb5-1.19.2.tar.gz/doc/tools/doxybuilder_types.py -> _service:tar_scm:krb5-1.20.1.tar.gz/doc/tools/doxybuilder_types.py Changed

@@ -268,38 +268,36 @@
 
     def _process_paragraph_content(self, node):
 
+        def add_text(l, s):
+            # Add a space if it wouldn't be at the start or end of a line.
+            if l and not l-1.endswith('\n') and not s.startswith('\n'):
+                l.append(' ')
+            l.append(s)
+
         result = list()
         content = node.xpath(".//text()")
         for e in content:
-            if node is e.getparent():
-                result.append(e.strip())
+            if e.is_tail or node is e.getparent():
+                add_text(result, e.strip())
             elif e.getparent().tag == 'ref':
-                if e.is_tail:
-                    result.append(e.strip())
-                elif e.strip().find('(') > 0:
-                    result.append(':c:func:`%s`' % e.strip())
+                if e.strip().find('(') > 0:
+                    add_text(result, ':c:func:`%s`' % e.strip())
                 elif e.isupper():
-                    result.append(':c:data:`%s`' % e.strip())
+                    add_text(result, ':c:data:`%s`' % e.strip())
                 else:
-                    result.append(':c:type:`%s`' % e.strip())
+                    add_text(result, ':c:type:`%s`' % e.strip())
             elif e.getparent().tag == 'emphasis':
-                if e.is_tail:
-                    result.append(e.strip())
-                else:
-                    result.append('*%s*' % e.strip())
+                add_text(result, '*%s*' % e.strip())
             elif e.getparent().tag == 'computeroutput':
-                if e.is_tail:
-                    result.append(e.strip())
-                else:
-                    result.append('*%s*' % e.strip())
-            elif  e.getparent().tag == 'defname':
-                result.append('%s, ' % e.strip())
+                add_text(result, '*%s*' % e.strip())
+            elif e.getparent().tag == 'defname':
+                add_text(result, '%s, ' % e.strip())
             elif e.getparent().tag == 'verbatim':
-                result.append('\n::\n\n')
-                result.append(textwrap.indent(e, '    ', lambda x: True))
-                result.append('\n')
+                add_text(result, '\n::\n\n')
+                add_text(result, textwrap.indent(e, '    ', lambda x: True))
+                add_text(result, '\n')
 
-        result = ' '.join(result)
+        result = ''.join(result)
 
         return result

_service:tar_scm:krb5-1.19.2.tar.gz/src/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/aclocal.m4 -> _service:tar_scm:krb5-1.20.1.tar.gz/src/aclocal.m4 Changed

@@ -95,9 +95,9 @@
 dnl want to use automake right now.
 AC_DEFUN(KRB5_AC_MAINTAINER_MODE,
 AC_ARG_ENABLE(maintainer-mode,
-AC_HELP_STRING(--enable-maintainer-mode,enable rebuilding of source files, Makefiles, etc),
-USE_MAINTAINER_MODE=$enableval,
-USE_MAINTAINER_MODE=no)
+  AS_HELP_STRING(--enable-maintainer-mode,
+    enable rebuilding of source files, Makefiles, etc),
+  USE_MAINTAINER_MODE=$enableval, USE_MAINTAINER_MODE=no)
 if test "$USE_MAINTAINER_MODE" = yes; then
   MAINTAINER_MODE_TRUE=
   MAINTAINER_MODE_FALSE='#'
@@ -116,7 +116,9 @@
 AC_DEFUN(KRB5_AC_INITFINI,
 dnl Do we want initialization at load time?
 AC_ARG_ENABLE(delayed-initialization,
-AC_HELP_STRING(--disable-delayed-initialization,initialize library code when loaded @<:@delay until first use@:>@), , enable_delayed_initialization=yes)
+  AS_HELP_STRING(--disable-delayed-initialization,
+    initialize library code when loaded @<:@delay until first use@:>@),
+  , enable_delayed_initialization=yes)
 case "$enable_delayed_initialization" in
   yes)
     AC_DEFINE(DELAY_INITIALIZER,1,Define if library initialization should be delayed until first use) ;;
@@ -156,7 +158,9 @@
 dnl Hack for now.
 AC_DEFUN(KRB5_AC_ENABLE_THREADS,
 AC_ARG_ENABLE(thread-support,
-AC_HELP_STRING(--disable-thread-support,don't enable thread support @<:@enabled@:>@), , enable_thread_support=yes)
+  AS_HELP_STRING(--disable-thread-support,
+    don't enable thread support @<:@enabled@:>@),
+  , enable_thread_support=yes)
 if test "$enable_thread_support" = yes ; then
   AC_MSG_NOTICE(enabling thread support)
   AC_DEFINE(ENABLE_THREADS,1,Define if thread support enabled)
@@ -238,9 +242,13 @@
 dnl
 AC_DEFUN(DECLARE_SYS_ERRLIST,
 AC_CACHE_CHECK(for sys_errlist declaration, krb5_cv_decl_sys_errlist,
-AC_TRY_COMPILE(#include <stdio.h>
-#include <errno.h>, 1+sys_nerr;,
-krb5_cv_decl_sys_errlist=yes, krb5_cv_decl_sys_errlist=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <stdio.h>
+      #include <errno.h>
+    ,
+    1+sys_nerr;),
+  krb5_cv_decl_sys_errlist=yes, krb5_cv_decl_sys_errlist=no))
 # assume sys_nerr won't be declared w/o being in libc
 if test $krb5_cv_decl_sys_errlist = yes; then
   AC_DEFINE(SYS_ERRLIST_DECLARED,1,Define if sys_errlist is defined in errno.h)
@@ -249,8 +257,11 @@
   # This means that sys_errlist is not declared in errno.h, but may still
   # be in libc.
   AC_CACHE_CHECK(for sys_errlist in libc, krb5_cv_var_sys_errlist,
-  AC_TRY_LINK(extern int sys_nerr;, if (1+sys_nerr < 0) return 1;,
-  krb5_cv_var_sys_errlist=yes, krb5_cv_var_sys_errlist=no;))
+  AC_LINK_IFELSE(
+    AC_LANG_PROGRAM(
+      extern int sys_nerr;,
+      if (1+sys_nerr < 0) return 1;),
+    krb5_cv_var_sys_errlist=yes, krb5_cv_var_sys_errlist=no))
   if test $krb5_cv_var_sys_errlist = yes; then
     AC_DEFINE(HAVE_SYS_ERRLIST,1,Define if sys_errlist in libc)
     # Do this cruft for backwards compatibility for now.
@@ -266,10 +277,18 @@
 AC_DEFUN(CHECK_SIGPROCMASK,
 AC_MSG_CHECKING(for use of sigprocmask)
 AC_CACHE_VAL(krb5_cv_func_sigprocmask_use,
-AC_TRY_LINK(#include <signal.h>, sigprocmask(SIG_SETMASK,0,0);,
- krb5_cv_func_sigprocmask_use=yes,
-AC_TRY_LINK(#include <signal.h>, sigmask(1);, 
- krb5_cv_func_sigprocmask_use=no, krb5_cv_func_sigprocmask_use=yes)))
+AC_LINK_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <signal.h>
+    ,
+    sigprocmask(SIG_SETMASK, 0, 0);),
+  krb5_cv_func_sigprocmask_use=yes,
+  AC_LINK_IFELSE(
+    AC_LANG_PROGRAM(
+      #include <signal.h>
+      ,
+      sigmask(1);),
+    krb5_cv_func_sigprocmask_use=no, krb5_cv_func_sigprocmask_use=yes)))
 AC_MSG_RESULT($krb5_cv_func_sigprocmask_use)
 if test $krb5_cv_func_sigprocmask_use = yes; then
  AC_DEFINE(USE_SIGPROCMASK,1,Define if sigprocmask should be used)
@@ -289,17 +308,23 @@
 AC_MSG_CHECKING(if argument to wait is int *)
 AC_CACHE_VAL(krb5_cv_struct_wait,
 dnl Test for prototype clash - if there is none - then assume int * works
-AC_TRY_COMPILE(#include <sys/types.h>
-#include <sys/wait.h>
-extern pid_t wait(int *);,, krb5_cv_struct_wait=no,dnl
-dnl Else fallback on old stuff
-AC_TRY_COMPILE(
-#include <sys/wait.h>, union wait i;
-#ifdef WEXITSTATUS
-  WEXITSTATUS (i);
-#endif
-, 
-	krb5_cv_struct_wait=yes, krb5_cv_struct_wait=no)))
+AC_COMPILE_IFELSE(
+  AC_LANG_SOURCE(
+    #include <sys/types.h>
+      #include <sys/wait.h>
+      extern pid_t wait(int *);),
+  krb5_cv_struct_wait=no,
+  dnl Else fallback on old stuff
+  AC_COMPILE_IFELSE(
+    AC_LANG_PROGRAM(
+      #include <sys/wait.h>
+      ,
+      union wait i;
+        #ifdef WEXITSTATUS
+        WEXITSTATUS (i);
+        #endif
+      ),
+    krb5_cv_struct_wait=yes, krb5_cv_struct_wait=no)))
 AC_MSG_RESULT($krb5_cv_struct_wait)
 if test $krb5_cv_struct_wait = no; then
 	AC_DEFINE(WAIT_USES_INT,1,Define if wait takes int as a argument)
@@ -312,53 +337,30 @@
 AC_CHECK_FUNC(sigprocmask,
 AC_MSG_CHECKING(for sigset_t and POSIX_SIGNALS)
 AC_CACHE_VAL(krb5_cv_type_sigset_t,
-AC_TRY_COMPILE(
-#include <signal.h>,
-sigset_t x,
-krb5_cv_type_sigset_t=yes, krb5_cv_type_sigset_t=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <signal.h>
+    ,
+    sigset_t x),
+  krb5_cv_type_sigset_t=yes, krb5_cv_type_sigset_t=no))
 AC_MSG_RESULT($krb5_cv_type_sigset_t)
 if test $krb5_cv_type_sigset_t = yes; then
   AC_DEFINE(POSIX_SIGNALS,1,Define if POSIX signal handling is used)
 fi
 ))dnl
 dnl
-dnl check for signal type
-dnl
-dnl AC_RETSIGTYPE isn't quite right, but almost.
-AC_DEFUN(KRB5_SIGTYPE,
-AC_MSG_CHECKING(POSIX signal handlers)
-AC_CACHE_VAL(krb5_cv_has_posix_signals,
-AC_TRY_COMPILE(
-#include <sys/types.h>
-#include <signal.h>
-#ifdef signal
-#undef signal
-#endif
-extern void (*signal ()) ();, ,
-krb5_cv_has_posix_signals=yes, krb5_cv_has_posix_signals=no))
-AC_MSG_RESULT($krb5_cv_has_posix_signals)
-if test $krb5_cv_has_posix_signals = yes; then
-   stype=void
-   AC_DEFINE(POSIX_SIGTYPE, 1, Define if POSIX signal handlers are used)
-else
-  if test $ac_cv_type_signal = void; then
-     stype=void
-  else
-     stype=int
-  fi
-fi
-AC_DEFINE_UNQUOTED(krb5_sigtype, $stype, Define krb5_sigtype to type of signal handler)dnl
-)dnl
-dnl
 dnl check for POSIX setjmp/longjmp -- CHECK_SETJMP
 dnl
 AC_DEFUN(CHECK_SETJMP,
 AC_CHECK_FUNC(sigsetjmp,
 AC_MSG_CHECKING(for sigjmp_buf)
 AC_CACHE_VAL(krb5_cv_struct_sigjmp_buf,
-AC_TRY_COMPILE(
-#include <setjmp.h>,sigjmp_buf x,
-krb5_cv_struct_sigjmp_buf=yes,krb5_cv_struct_sigjmp_buf=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <setjmp.h>
+    ,
+    sigjmp_buf x),
+  krb5_cv_struct_sigjmp_buf=yes, krb5_cv_struct_sigjmp_buf=no))
 AC_MSG_RESULT($krb5_cv_struct_sigjmp_buf)
 if test $krb5_cv_struct_sigjmp_buf = yes; then
   AC_DEFINE(POSIX_SETJMP,1,Define if setjmp indicates POSIX interface)
@@ -375,12 +377,15 @@
 dnl a macro
 AC_MSG_CHECKING(for getaddrinfo)
 AC_CACHE_VAL(ac_cv_func_getaddrinfo,
-AC_TRY_LINK(#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif,
-struct addrinfo *ai;
-getaddrinfo("kerberos.mit.edu", "echo", 0, &ai);
-, ac_cv_func_getaddrinfo=yes, ac_cv_func_getaddrinfo=no))
+AC_LINK_IFELSE(
+  AC_LANG_PROGRAM(
+    #ifdef HAVE_NETDB_H
+      #include <netdb.h>
+      #endif
+    ,
+    struct addrinfo *ai;
+      getaddrinfo("kerberos.mit.edu", "echo", 0, &ai);),
+  ac_cv_func_getaddrinfo=yes, ac_cv_func_getaddrinfo=no))
 AC_MSG_RESULT($ac_cv_func_getaddrinfo)
 if test $ac_cv_func_getaddrinfo = yes; then
   AC_DEFINE(HAVE_GETADDRINFO,1,Define if you have the getaddrinfo function)
@@ -392,18 +397,19 @@
 if test "$ac_cv_func_inet_ntop" != "yes" ; then
   krb5_cv_inet6=no
 else
-AC_TRY_COMPILE(
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netdb.h>
-,
-  struct sockaddr_in6 in;
-  AF_INET6;
-  IN6_IS_ADDR_LINKLOCAL (&in.sin6_addr);
-,krb5_cv_inet6=yes,krb5_cv_inet6=no))
+  AC_COMPILE_IFELSE(
+    AC_LANG_PROGRAM(
+      #ifdef HAVE_SYS_TYPES_H
+        #include <sys/types.h>
+        #endif
+        #include <sys/socket.h>
+        #include <netinet/in.h>
+        #include <netdb.h>
+      ,
+      struct sockaddr_in6 in;
+        AF_INET6;
+        IN6_IS_ADDR_LINKLOCAL(&in.sin6_addr);),
+    krb5_cv_inet6=yes, krb5_cv_inet6=no))
 fi
 AC_MSG_RESULT($krb5_cv_inet6)
 if test "$krb5_cv_inet6" = no && test "$ac_cv_func_inet_ntop" = yes; then
@@ -411,18 +417,19 @@
 AC_CACHE_VAL(krb5_cv_inet6_with_dinet6,
 old_CC="$CC"
 CC="$CC -DINET6"
-AC_TRY_COMPILE(
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netdb.h>
-,
-  struct sockaddr_in6 in;
-  AF_INET6;
-  IN6_IS_ADDR_LINKLOCAL (&in.sin6_addr);
-,krb5_cv_inet6_with_dinet6=yes,krb5_cv_inet6_with_dinet6=no)
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #ifdef HAVE_SYS_TYPES_H
+      #include <sys/types.h>
+      #endif
+      #include <sys/socket.h>
+      #include <netinet/in.h>
+      #include <netdb.h>
+    ,
+    struct sockaddr_in6 in;
+      AF_INET6;
+      IN6_IS_ADDR_LINKLOCAL (&in.sin6_addr);),
+  krb5_cv_inet6_with_dinet6=yes, krb5_cv_inet6_with_dinet6=no)
 CC="$old_CC")
 AC_MSG_RESULT($krb5_cv_inet6_with_dinet6)
 fi
@@ -446,10 +453,13 @@
   cachevar=`echo "krb5_cv_cc_flag_$1" | sed -e s/=/_eq_/g -e s/-/_dash_/g -e s/^a-zA-Z0-9_/_/g`
   AC_CACHE_CHECK(if C compiler supports $1, $cachevar,
   # first try without, then with
-  AC_TRY_COMPILE(, 1;,
+  AC_COMPILE_IFELSE(
+    AC_LANG_PROGRAM(, 1;),
     old_cflags="$CFLAGS"
      CFLAGS="$CFLAGS $cflags_warning_test_flags $1"
-     AC_TRY_COMPILE(, 1;, eval $cachevar=yes, eval $cachevar=no)
+     AC_COMPILE_IFELSE(
+       AC_LANG_PROGRAM(, 1;),
+       eval $cachevar=yes, eval $cachevar=no)
      CFLAGS="$old_cflags",
     AC_MSG_ERROR(compiling simple test program with $CFLAGS failed)))
   if eval test '"${'$cachevar'}"' = yes; then
@@ -585,10 +595,6 @@
       CFLAGS="$CFLAGS -fno-common"
       ;;
     esac
-    case "$LD $LDFLAGS" in
-    *-Wl,-search_paths_first*) ;;
-    *) LDFLAGS="${LDFLAGS} -Wl,-search_paths_first" ;;
-    esac
   fi
 else
   if test "`uname -s`" = AIX ; then
@@ -638,28 +644,6 @@
 AC_SUBST(WARN_CXXFLAGS)
 )dnl
 dnl
-dnl
-dnl check for yylineno -- HAVE_YYLINENO
-dnl
-AC_DEFUN(HAVE_YYLINENO,dnl
-AC_REQUIRE_CPP()AC_REQUIRE(AC_PROG_LEX)dnl
-AC_MSG_CHECKING(for yylineno declaration)
-AC_CACHE_VAL(krb5_cv_type_yylineno,
-# some systems have yylineno, others don't...
-  echo '%%
-%%' | ${LEX} -t > conftest.out
-  if egrep yylineno conftest.out >/dev/null 2>&1; then
-	krb5_cv_type_yylineno=yes
-  else
-	krb5_cv_type_yylineno=no
-  fi
-  rm -f conftest.out)
-  AC_MSG_RESULT($krb5_cv_type_yylineno)
-  if test $krb5_cv_type_yylineno = no; then
-	AC_DEFINE(NO_YYLINENO, 1, Define if lex produes code with yylineno)
-  fi
-)dnl
-dnl
 dnl K5_GEN_MAKEFILE(dir, frags)
 dnl
 AC_DEFUN(K5_GEN_MAKEFILE,dnl
@@ -669,7 +653,7 @@
 dnl _K5_GEN_MAKEFILE(dir, frags)
 dnl  dir must be present in this case
 dnl  Note: Be careful in quoting. 
-dnl        The ac_foreach generates the list of fragments to include
+dnl        The m4_foreach_w generates the list of fragments to include
 dnl        or "" if $2 is empty
 AC_DEFUN(_K5_GEN_MAKEFILE,dnl
 AC_CONFIG_FILES($1/Makefile:$srcdir/K5_TOPDIR/config/pre.in:$1/Makefile.in:$1/deps:$srcdir/K5_TOPDIR/config/post.in)
@@ -691,7 +675,7 @@
 dnl
 define(_V5_AC_OUTPUT_MAKEFILE,
 ifelse($2, , ,AC_CONFIG_FILES($2))
-AC_FOREACH(DIR, $1,dnl
+m4_foreach_w(DIR, $1,dnl
  AC_CONFIG_FILES(DIR/Makefile:$srcdir/K5_TOPDIR/config/pre.in:DIR/Makefile.in:DIR/deps:$srcdir/K5_TOPDIR/config/post.in))
 K5_AC_OUTPUT)dnl
 dnl
@@ -710,7 +694,7 @@
 dnl
 AC_DEFUN(WITH_NETLIB,
 AC_ARG_WITH(netlib,
-AC_HELP_STRING(--with-netlib=LIBS, use user defined resolver library),
+  AS_HELP_STRING(--with-netlib=LIBS, use user defined resolver library),
   if test "$withval" = yes -o "$withval" = no ; then
 	AC_MSG_RESULT("netlib will link with C library resolver only")
   else
@@ -738,13 +722,15 @@
 dnl regcomp is present but non-functional on Solaris 2.4
 dnl
 AC_MSG_CHECKING(for working regcomp)
-AC_CACHE_VAL(ac_cv_func_regcomp,
-AC_TRY_RUN(
-#include <sys/types.h>
-#include <regex.h>
-regex_t x; regmatch_t m;
-int main() { return regcomp(&x,"pat.*",0) || regexec(&x,"pattern",1,&m,0); }
-, ac_cv_func_regcomp=yes, ac_cv_func_regcomp=no, AC_MSG_ERROR(Cannot test regcomp when cross compiling)))
+AC_CACHE_VAL(ac_cv_func_regcomp,
+AC_RUN_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <sys/types.h>
+      #include <regex.h>
+      regex_t x; regmatch_t m;,
+    return regcomp(&x,"pat.*",0) || regexec(&x,"pattern",1,&m,0);),
+  ac_cv_func_regcomp=yes, ac_cv_func_regcomp=no,
+  AC_MSG_ERROR(Cannot test regcomp when cross compiling)))
 AC_MSG_RESULT($ac_cv_func_regcomp)
 test $ac_cv_func_regcomp = yes && AC_DEFINE(HAVE_REGCOMP,1,Define if regcomp exists and functions)
 dnl
@@ -773,237 +759,13 @@
 AC_REQUIRE(KRB5_AC_NEED_LIBGEN)dnl
 )dnl
 dnl
-dnl AC_KRB5_TCL_FIND_CONFIG (uses tcl_dir)
-dnl
-AC_DEFUN(AC_KRB5_TCL_FIND_CONFIG,
-AC_REQUIRE(KRB5_LIB_AUX)dnl
-AC_MSG_CHECKING(for tclConfig.sh)
-dnl On Debian, we might be given --with-tcl=/usr, or tclsh might
-dnl point us to /usr/lib/tcl8.4; either way, we need to find
-dnl /usr/lib/tcl8.4/tclConfig.sh.
-dnl On NetBSD, we might be given --with-tcl=/usr/pkg, or tclsh
-dnl might point us to /usr/pkg/lib/tcl8.4; we need to find
-dnl /usr/pkg/lib/tclConfig.sh.
-if test -r "$tcl_dir/lib/tclConfig.sh" ; then
-  tcl_conf="$tcl_dir/lib/tclConfig.sh"
-elif test -r "$tcl_dir/tclConfig.sh" ; then
-  tcl_conf="$tcl_dir/tclConfig.sh"
-elif test -r "$tcl_dir/../tclConfig.sh" ; then
-  tcl_conf="$tcl_dir/../tclConfig.sh"
-else
-  tcl_conf=
-  lib="$tcl_dir/lib"
-  changequote(<<,>>)dnl
-  for d in "$lib" "$lib"/tcl7.0-9 "$lib"/tcl8.0-9 ; do
-    if test -r "$d/tclConfig.sh" ; then
-      tcl_conf="$tcl_conf $d/tclConfig.sh"
-    fi
-  done
-  changequote(,)dnl
-fi
-if test -n "$tcl_conf" ; then
-  AC_MSG_RESULT($tcl_conf)
-else
-  AC_MSG_RESULT(not found)
-fi
-tcl_ok_conf=
-tcl_vers_maj=
-tcl_vers_min=
-old_CPPFLAGS=$CPPFLAGS
-old_LIBS=$LIBS
-old_LDFLAGS=$LDFLAGS
-if test -n "$tcl_conf" ; then
-  for file in $tcl_conf ; do
-    TCL_MAJOR_VERSION=x ; TCL_MINOR_VERSION=x
-    AC_MSG_CHECKING(Tcl info in $file)
-    . $file
-    v=$TCL_MAJOR_VERSION.$TCL_MINOR_VERSION
-    if test -z "$tcl_vers_maj" \
-	|| test "$tcl_vers_maj" -lt "$TCL_MAJOR_VERSION" \
-	|| test "$tcl_vers_maj" = "$TCL_MAJOR_VERSION" -a "$tcl_vers_min" -lt "$TCL_MINOR_VERSION" ; then
-      for incdir in "$TCL_PREFIX/include/tcl$v" "$TCL_PREFIX/include" ; do
-	if test -r "$incdir/tcl.h" -o -r "$incdir/tcl/tcl.h" ; then
-	  CPPFLAGS="$old_CPPFLAGS -I$incdir"
-	  break
-	fi
-      done
-      LIBS="$old_LIBS `eval echo x $TCL_LIB_SPEC $TCL_LIBS | sed 's/^x//'`"
-      LDFLAGS="$old_LDFLAGS $TCL_LD_FLAGS"
-      AC_TRY_LINK(#include <tcl.h>, Tcl_CreateInterp ();,
-	tcl_ok_conf=$file
-	tcl_vers_maj=$TCL_MAJOR_VERSION
-	tcl_vers_min=$TCL_MINOR_VERSION
-	AC_MSG_RESULT($v - working),
-	AC_MSG_RESULT($v - compilation failed)
-      )
-    else
-      AC_MSG_RESULT(older version $v)
-    fi
-  done
-fi
-CPPFLAGS=$old_CPPFLAGS
-LIBS=$old_LIBS
-LDFLAGS=$old_LDFLAGS
-tcl_header=no
-tcl_lib=no
-if test -n "$tcl_ok_conf" ; then
-  . $tcl_ok_conf
-  TCL_INCLUDES=
-  for incdir in "$TCL_PREFIX/include/tcl$v" "$TCL_PREFIX/include" ; do
-    if test -r "$incdir/tcl.h" -o -r "$incdir/tcl/tcl.h" ; then
-      if test "$incdir" != "/usr/include" ; then
-        TCL_INCLUDES=-I$incdir
-      fi
-      break
-    fi
-  done
-  # Need eval because the first-level expansion could reference
-  # variables like ${TCL_DBGX}.
-  eval TCL_LIBS='"'$TCL_LIB_SPEC $TCL_LIBS $TCL_DL_LIBS'"'
-  TCL_LIBPATH="-L$TCL_EXEC_PREFIX/lib"
-  TCL_RPATH=":$TCL_EXEC_PREFIX/lib"
-  if test "$DEPLIBEXT" != "$SHLIBEXT" && test -n "$RPATH_FLAG"; then
-    TCL_MAYBE_RPATH='$(RPATH_FLAG)'"$TCL_EXEC_PREFIX/lib$RPATH_TAIL"
-  else
-    TCL_MAYBE_RPATH=
-  fi
-  CPPFLAGS="$old_CPPFLAGS $TCL_INCLUDES"
-  AC_CHECK_HEADER(tcl.h,AC_DEFINE(HAVE_TCL_H,1,Define if tcl.h is available) tcl_header=yes)
-  if test $tcl_header=no; then
-     AC_CHECK_HEADER(tcl/tcl.h,AC_DEFINE(HAVE_TCL_TCL_H,1,Define if tcl/tcl.h is available) tcl_header=yes)
-  fi
-  CPPFLAGS="$old_CPPFLAGS"
-  tcl_lib=yes
-else
-  # If we read a tclConfig.sh file, it probably set this.
-  TCL_LIBS=
-fi  
-AC_SUBST(TCL_INCLUDES)
-AC_SUBST(TCL_LIBS)
-AC_SUBST(TCL_LIBPATH)
-AC_SUBST(TCL_RPATH)
-AC_SUBST(TCL_MAYBE_RPATH)
-)dnl
-dnl
-dnl AC_KRB5_TCL_TRYOLD
-dnl attempt to use old search algorithm for locating tcl
-dnl
-AC_DEFUN(AC_KRB5_TCL_TRYOLD, 
-AC_REQUIRE(KRB5_AC_FIND_DLOPEN)
-AC_MSG_WARN(trying old tcl search code)
-if test "$with_tcl" != yes -a "$with_tcl" != no; then
-	TCL_INCLUDES=-I$with_tcl/include
-	TCL_LIBPATH=-L$with_tcl/lib
-	TCL_RPATH=:$with_tcl/lib
-fi
-if test "$with_tcl" != no ; then
-	krb5_save_CPPFLAGS="$CPPFLAGS"
-	krb5_save_LDFLAGS="$LDFLAGS"
-	CPPFLAGS="$CPPFLAGS $TCL_INCLUDES"
-	LDFLAGS="$LDFLAGS $TCL_LIBPATH"
-	tcl_header=no
-	AC_CHECK_HEADER(tcl.h,AC_DEFINE(HAVE_TCL_H,1,Define if tcl.h found) tcl_header=yes)
-	if test $tcl_header=no; then
-	   AC_CHECK_HEADER(tcl/tcl.h,AC_DEFINE(HAVE_TCL_TCL_H,1,Define if tcl/tcl.h found) tcl_header=yes)
-	fi
-
-	if test $tcl_header = yes ; then
-		tcl_lib=no
-
-		if test $tcl_lib = no; then
-			AC_CHECK_LIB(tcl8.0, Tcl_CreateCommand, 
-				TCL_LIBS="$TCL_LIBS -ltcl8.0 -lm $DL_LIB $LIBS"
-				tcl_lib=yes,,-lm $DL_LIB)
-		fi
-		if test $tcl_lib = no; then
-			AC_CHECK_LIB(tcl7.6, Tcl_CreateCommand, 
-				TCL_LIBS="$TCL_LIBS -ltcl7.6 -lm $DL_LIB $LIBS"
-				tcl_lib=yes,,-lm $DL_LIB)
-		fi
-		if test $tcl_lib = no; then
-			AC_CHECK_LIB(tcl7.5, Tcl_CreateCommand, 
-				TCL_LIBS="$TCL_LIBS -ltcl7.5 -lm $DL_LIB $LIBS"
-				tcl_lib=yes,,-lm $DL_LIB)
-
-		fi
-		if test $tcl_lib = no ; then
-			AC_CHECK_LIB(tcl, Tcl_CreateCommand, 
-				TCL_LIBS="$TCL_LIBS -ltcl -lm $DL_LIB $LIBS"
-				tcl_lib=yes,,-lm $DL_LIB)
-
-		fi
-		if test $tcl_lib = no ; then		
-			AC_MSG_WARN("tcl.h found but not library")
-		fi
-	else
-		AC_MSG_WARN(Could not find Tcl which is needed for the kadm5 tests)
-		TCL_LIBS=
-	fi
-	CPPFLAGS="$krb5_save_CPPFLAGS"
-	LDFLAGS="$krb5_save_LDFLAGS"
-	AC_SUBST(TCL_INCLUDES)
-	AC_SUBST(TCL_LIBS)
-	AC_SUBST(TCL_LIBPATH)
-	AC_SUBST(TCL_RPATH)
-else
-	AC_MSG_RESULT("Not looking for Tcl library")
-fi
-)dnl
-dnl
-dnl AC_KRB5_TCL - determine if the TCL library is present on system
-dnl
-AC_DEFUN(AC_KRB5_TCL,
-TCL_INCLUDES=
-TCL_LIBPATH=
-TCL_RPATH=
-TCL_LIBS=
-TCL_WITH=
-tcl_dir=
-AC_ARG_WITH(tcl,
-  --with-tcl=path         where Tcl resides, , with_tcl=try)
-if test "$with_tcl" = no ; then
-  true
-elif test "$with_tcl" = yes -o "$with_tcl" = try ; then
-  tcl_dir=/usr
-  if test ! -r /usr/lib/tclConfig.sh; then
-    cat >> conftest <<\EOF
-puts "tcl_dir=$tcl_library"
-EOF
-    if tclsh conftest >conftest.out 2>/dev/null; then
-      if grep tcl_dir= conftest.out >/dev/null 2>&1; then
-        t=`sed s/tcl_dir=// conftest.out`
-        tcl_dir=$t
-      fi
-    fi # tclsh ran script okay
-  rm -f conftest conftest.out
-  fi # no /usr/lib/tclConfig.sh
-else
-  tcl_dir=$with_tcl
-fi
-if test "$with_tcl" != no ; then
-  AC_KRB5_TCL_FIND_CONFIG
-  if test $tcl_lib = no ; then
-    if test "$with_tcl" != try ; then
-      AC_KRB5_TCL_TRYOLD
-    else
-      AC_MSG_WARN(Could not find Tcl which is needed for some tests)
-    fi
-  fi
-fi
-# If "yes" or pathname, error out if not found.
-if test "$with_tcl" != no -a "$with_tcl" != try ; then
-  if test "$tcl_header $tcl_lib" != "yes yes" ; then
-    AC_MSG_ERROR(Could not find Tcl)
-  fi
-fi
-)dnl
-
-dnl
 dnl WITH_HESIOD
 dnl
 AC_DEFUN(WITH_HESIOD,
-AC_ARG_WITH(hesiod, AC_HELP_STRING(--with-hesiod=path, compile with hesiod support @<:@omitted@:>@),
-	hesiod=$with_hesiod, with_hesiod=no)
+AC_ARG_WITH(hesiod,
+  AS_HELP_STRING(--with-hesiod=path,
+    compile with hesiod support @<:@omitted@:>@),
+  hesiod=$with_hesiod, with_hesiod=no)
 if test "$with_hesiod" != "no"; then
 	HESIOD_DEFS=-DHESIOD
 	AC_CHECK_LIB(resolv, res_send, res_lib=-lresolv)
@@ -1120,8 +882,8 @@
 fi
 
 AC_ARG_ENABLE(rpath,
-AC_HELP_STRING(--disable-rpath,suppress run path flags in link lines),,
-enable_rpath=yes)
+  AS_HELP_STRING(--disable-rpath,suppress run path flags in link lines),
+  , enable_rpath=yes)
 
 if test "x$enable_rpath" != xyes ; then
 	# Unset the rpath flag values set by shlib.conf
@@ -1285,12 +1047,12 @@
 	AC_CHECK_FUNC(res_search,
 	  AC_DEFINE(HAVE_RES_SEARCH, 1,
 	    Define to 1 if you have the `res_search' function),
-	  AC_ERROR(cannot find res_nsearch or res_search))
+          AC_MSG_ERROR(cannot find res_nsearch or res_search))
     fi
   fi
 )
 AC_DEFUN(_KRB5_AC_CHECK_RES_FUNCS,
-AC_FOREACH(AC_Func, $1,
+m4_foreach_w(AC_Func, $1,
   AH_TEMPLATE(AS_TR_CPP(HAVE_AC_Func),
                Define to 1 if you have the `AC_Func' function.))dnl
 for krb5_func in $1; do
@@ -1302,17 +1064,20 @@
 # doesn't export it from libresolv.so, so we use extreme paranoia here
 # and check both for the declaration and that we can link against the
 # function.
-AC_CACHE_CHECK(for $1, krb5_cv_func_$1, AC_TRY_LINK(
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <arpa/nameser.h>
-@%:@include <resolv.h>,
-/*
- * Use volatile, or else optimization can cause false positives.
- */
-void (* volatile p)() = (void (*)())$1;,
-			     AS_VAR_SET(krb5_cv_func_$1, yes),
-			     AS_VAR_SET(krb5_cv_func_$1, no)))
+AC_CACHE_CHECK(for $1, krb5_cv_func_$1,
+AC_LINK_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <sys/types.h>
+      #include <netinet/in.h>
+      #include <arpa/nameser.h>
+      #include <resolv.h>
+    ,
+    /*
+       * Use volatile, or else optimization can cause false positives.
+       */
+      void (* volatile p)() = (void (*)())$1;),
+    AS_VAR_SET(krb5_cv_func_$1, yes),
+    AS_VAR_SET(krb5_cv_func_$1, no)))
 AS_IF(test AS_VAR_GET(krb5_cv_func_$1) = yes,
       AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_$1), 1,
 			  Define to 1 if you have the `$1' function))dnl
@@ -1347,13 +1112,14 @@
 AC_DEFUN(KRB5_NEED_PROTO, 
 ifelse($3, ,if test "x$ac_cv_func_$2" = xyes; then)
 AC_CACHE_CHECK(if $2 needs a prototype provided, krb5_cv_func_$2_noproto,
-AC_TRY_COMPILE($1,
-#undef $2
-struct k5foo {int foo; } xx;
-extern int $2 (struct k5foo*);
-$2(&xx);
-,
-krb5_cv_func_$2_noproto=yes,krb5_cv_func_$2_noproto=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    $1,
+    #undef $2
+      struct k5foo {int foo; } xx;
+      extern int $2 (struct k5foo*);
+      $2(&xx);),
+  krb5_cv_func_$2_noproto=yes, krb5_cv_func_$2_noproto=no))
 if test $krb5_cv_func_$2_noproto = yes; then
 	AC_DEFINE(NEED_translit($2, a-z, A-Z)_PROTO, 1, dnl
 define if the system header files are missing prototype for $2())
@@ -1375,12 +1141,13 @@
 krb5_lib_var=`echo "$1 $2" | sed 'y% ./+-*%___p_p%'`
 AC_MSG_CHECKING(if getsockname() takes arguments $1 and $2)
 AC_CACHE_VAL(krb5_cv_getsockname_proto_$krb5_lib_var,
-
-AC_TRY_COMPILE(#include <sys/types.h>
-#include <sys/socket.h>
-extern int getsockname(int, $1, $2);
-,,eval "krb5_cv_getsockname_proto_$krb5_lib_var=yes",
-    eval "krb5_cv_getsockname_proto_$krb5_lib_var=no"))
+AC_COMPILE_IFELSE(
+  AC_LANG_SOURCE(
+    #include <sys/types.h>
+      #include <sys/socket.h>
+      extern int getsockname(int, $1, $2);),
+  eval "krb5_cv_getsockname_proto_$krb5_lib_var=yes",
+  eval "krb5_cv_getsockname_proto_$krb5_lib_var=no"))
 if eval "test \"`echo '$krb5_cv_getsockname_proto_'$krb5_lib_var`\" = yes"; then
 	AC_MSG_RESULT(yes)
 	sock_set=yes; res1="$1"; res2="$2"
@@ -1415,7 +1182,8 @@
 dnl
 AC_DEFUN(KRB5_AC_CHOOSE_ET,
 AC_ARG_WITH(system-et,
-AC_HELP_STRING(--with-system-et,use system compile_et and -lcom_err @<:@default: build and install a local version@:>@))
+  AS_HELP_STRING(--with-system-et,
+    use system compile_et and -lcom_err @<:@default: build and install a local version@:>@))
 AC_MSG_CHECKING(which version of com_err to use)
 if test "x$with_system_et" = xyes ; then
   # This will be changed to "intlsys" if textdomain support is present.
@@ -1450,9 +1218,12 @@
   if compile_et conf$$e.et >/dev/null 2>&1 ; then true ; else
     AC_MSG_ERROR(execution failed)
   fi
-  AC_TRY_COMPILE(#include "conf$$e.h"
-      		 , &et_foo_error_table; ,:,
-		 AC_MSG_ERROR(cannot use et_foo_error_table))
+  AC_COMPILE_IFELSE(
+    AC_LANG_PROGRAM(
+      #include "conf$$e.h"
+      ,
+      &et_foo_error_table;),
+    , AC_MSG_ERROR(cannot use et_foo_error_table))
   # Anything else we need to test for?
   rm -f conf$$e.c conf$$e.h
   krb5_cv_compile_et_useful=yes
@@ -1482,7 +1253,8 @@
 )
 AC_DEFUN(KRB5_AC_CHOOSE_SS,
 AC_ARG_WITH(system-ss,
-	    AC_HELP_STRING(--with-system-ss,use system -lss and mk_cmds @<:@private version@:>@))
+  AS_HELP_STRING(--with-system-ss,
+    use system -lss and mk_cmds @<:@private version@:>@))
 AC_ARG_VAR(SS_LIB,system libraries for 'ss' package -lss)
 AC_MSG_CHECKING(which version of subsystem package to use)
 if test "x$with_system_ss" = xyes ; then
@@ -1493,18 +1265,20 @@
   test "x${SS_LIB+set}" = xset || SS_LIB=-lss
   old_LIBS="$LIBS"
   LIBS="$LIBS $SS_LIB"
-  AC_CACHE_CHECK(whether system ss package works, krb5_cv_system_ss_okay,
-  AC_TRY_RUN(
-#include <ss/ss.h>
-int main(int argc, char *argv) {
-  if (argc == 42) {
-    int i, err;
-    i = ss_create_invocation("foo","foo","",0,&err);
-    ss_listen(i);
-  }
-  return 0;
-}, krb5_cv_system_ss_okay=yes, AC_MSG_ERROR(cannot run test program),
-  krb5_cv_system_ss_okay="assumed"))
+  AC_CACHE_CHECK(whether system ss package works, krb5_cv_system_ss_okay,
+  AC_RUN_IFELSE(
+    AC_LANG_SOURCE(
+      #include <ss/ss.h>
+        int main(int argc, char *argv) {
+            if (argc == 42) {
+                int i, err;
+                i = ss_create_invocation("foo","foo","",0,&err);
+                ss_listen(i);
+            }
+            return 0;
+        }),
+    krb5_cv_system_ss_okay=yes, AC_MSG_ERROR(cannot run test program),
+    krb5_cv_system_ss_okay=assumed))
   LIBS="$old_LIBS"
   KRB5_NEED_PROTO(#include <ss/ss.h>,ss_execute_command,1)
 else
@@ -1517,7 +1291,8 @@
 dnl
 AC_DEFUN(KRB5_AC_CHOOSE_DB,
 AC_ARG_WITH(system-db,
-	    AC_HELP_STRING(--with-system-db,use system Berkeley db @<:@private version@:>@))
+  AS_HELP_STRING(--with-system-db,
+    use system Berkeley db @<:@private version@:>@))
 AC_ARG_VAR(DB_HEADER,header file for system Berkeley db package db.h)
 AC_ARG_VAR(DB_LIB,library for system Berkeley db package -ldb)
 if test "x$with_system_db" = xyes ; then
@@ -1607,14 +1382,17 @@
 a=no
 b=no
 # blindly assume we have 'unlink' and unistd.h.
-AC_TRY_RUN(#include <unistd.h>
-void foo1() __attribute__((constructor));
-void foo1() { unlink("conftest.1"); }
-void foo2() __attribute__((destructor));
-void foo2() { unlink("conftest.2"); }
-int main () { return 0; },
-test -r conftest.1 || a=yes
-test -r conftest.2 || b=yes, , AC_MSG_ERROR(Cannot test for constructor/destructor support when cross compiling))
+AC_RUN_IFELSE(
+  AC_LANG_SOURCE(
+    #include <unistd.h>
+      void foo1() __attribute__((constructor));
+      void foo1() { unlink("conftest.1"); }
+      void foo2() __attribute__((destructor));
+      void foo2() { unlink("conftest.2"); }
+      int main () { return 0; }),
+    test -r conftest.1 || a=yes
+     test -r conftest.2 || b=yes,
+  , AC_MSG_ERROR(Cannot test for constructor/destructor support when cross compiling))
 case $krb5_cv_host in
 *-*-aix4.*)
 	# Under AIX 4.3.3, at least, shared library destructor functions
@@ -1647,9 +1425,12 @@
 AC_DEFUN(KRB5_AC_PRAGMA_WEAK_REF,
 AC_CACHE_CHECK(whether pragma weak references are supported,
 krb5_cv_pragma_weak_ref,
-AC_TRY_LINK(#pragma weak flurbl
-extern int flurbl(void);,if (&flurbl != 0) return flurbl();,
-krb5_cv_pragma_weak_ref=yes,krb5_cv_pragma_weak_ref=no))
+AC_LINK_IFELSE(
+  AC_LANG_PROGRAM(
+    #pragma weak flurbl
+      extern int flurbl(void);,
+    if (&flurbl != 0) return flurbl();),
+  krb5_cv_pragma_weak_ref=yes, krb5_cv_pragma_weak_ref=no))
 if test $krb5_cv_pragma_weak_ref = yes ; then
   AC_DEFINE(HAVE_PRAGMA_WEAK_REF,1,Define if #pragma weak references work)
 fi)
@@ -1665,7 +1446,7 @@
 dnl
 AC_DEFUN(WITH_LDAP,
 AC_ARG_WITH(ldap,
-  --with-ldap             compile OpenLDAP database backend module,
+AS_HELP_STRING(--with-ldap, compile OpenLDAP database backend module),
 case "$withval" in
     OPENLDAP) with_ldap=yes ;;
     yes | no) ;;

_service:tar_scm:krb5-1.19.2.tar.gz/src/appl/gss-sample/gss-server.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/appl/gss-sample/gss-server.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/appl/gss-sample/t_gss_sample.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/appl/gss-sample/t_gss_sample.py Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/appl/sample/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/appl/sample/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/appl/sample/sserver/sserver.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/appl/sample/sserver/sserver.c Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/appl/sample/t_sample.py Added

_service:tar_scm:krb5-1.19.2.tar.gz/src/appl/simple/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/appl/simple/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/appl/simple/server/sim_server.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/appl/simple/server/sim_server.c Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/appl/simple/t_simple.py Added

@@ -0,0 +1,34 @@
+from k5test import *
+
+sim_client = os.path.join(buildtop, 'appl', 'simple', 'client', 'sim_client')
+sim_server = os.path.join(buildtop, 'appl', 'simple', 'server', 'sim_server')
+
+for realm in multipass_realms(create_host=False):
+    server_princ = 'sample/%s@%s' % (hostname, realm.realm)
+    realm.addprinc(server_princ)
+    realm.extract_keytab(server_princ, realm.keytab)
+
+    portstr = str(realm.server_port())
+    server = realm.start_server(sim_server, '-p', portstr, 'starting...')
+
+    out = realm.run(sim_client, '-p', portstr, hostname)
+    if ('Sent checksummed message:' not in out or
+        'Sent encrypted message:' not in out):
+        fail('Expected client messages not seen')
+
+    # sim_server exits after one client execution, so we can read
+    # until it closes stdout.
+    seen1 = seen2 = seen3 = False
+    for line in server.stdout:
+        if line == 'Got authentication info from user@KRBTEST.COM\n':
+            seen1 = True
+        if line == "Safe message is: 'hi there!'\n":
+            seen2 = True
+        if line == "Decrypted message is: 'hi there!'\n":
+            seen3 = True
+    if not (seen1 and seen2 and seen3):
+        fail('Expected server messages not seen')
+
+    await_daemon_exit(server)
+
+success('sim_client/sim_server tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/appl/user_user/t_user2user.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/appl/user_user/t_user2user.py Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/clients/kinit/kinit.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/clients/kinit/kinit.c Changed

@@ -141,18 +141,13 @@
 {
     fprintf(stderr,
             _("Usage: %s -V -l lifetime -s start_time "
-              "-r renewable_life"
-              USAGE_BREAK
-              "-f | -F -p | -P -n -a | -A -C -E"
-              USAGE_BREAK
-              "--request-pac | --no-request-pac "
-              USAGE_BREAK
-              "-v -R -k -i|-t keytab_file -c cachename"
-              USAGE_BREAK
-              "-S service_name -I input_ccache -T ticket_armor_cache"
-              USAGE_BREAK
-              "-X <attribute>=<value> principal"
-              "\n\n"), progname);
+              "-r renewable_life\n"
+              "\t-f | -F -p | -P -n -a | -A -C -E\n"
+              "\t--request-pac | --no-request-pac\n"
+              "\t-v -R -k -i|-t keytab_file -c cachename\n"
+              "\t-S service_name -I input_ccache -T ticket_armor_cache\n"
+              "\t-X <attribute>=<value> principal\n"
+              "\n"), progname);
 
     fprintf(stderr, "    options:\n");
     fprintf(stderr, _("\t-V verbose\n"));
@@ -510,17 +505,6 @@
                     _("when creating default server principal name"));
             goto cleanup;
         }
-        if (k5->me->realm.data0 == 0) {
-            ret = krb5_unparse_name(k5->ctx, k5->me, &k5->name);
-            if (ret == 0) {
-                com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
-                        _("(principal %s)"), k5->name);
-            } else {
-                com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
-                        _("for local services"));
-            }
-            goto cleanup;
-        }
     } else if (k5->out_cc != NULL) {
         /* If the output ccache is initialized, use its principal. */
         if (krb5_cc_get_principal(k5->ctx, k5->out_cc, &princ) == 0)
@@ -661,6 +645,8 @@
     krb5_get_init_creds_opt *options = NULL;
     krb5_boolean pwprompt = FALSE;
     krb5_address **addresses = NULL;
+    krb5_principal cprinc;
+    krb5_ccache mcc = NULL;
     int i;
 
     memset(&my_creds, 0, sizeof(my_creds));
@@ -809,21 +795,29 @@
     }
 
     if (opts->action != INIT_PW && opts->action != INIT_KT) {
-        ret = krb5_cc_initialize(k5->ctx, k5->out_cc, opts->canonicalize ?
-                                 my_creds.client : k5->me);
+        cprinc = opts->canonicalize ? my_creds.client : k5->me;
+        ret = krb5_cc_new_unique(k5->ctx, "MEMORY", NULL, &mcc);
+        if (!ret)
+            ret = krb5_cc_initialize(k5->ctx, mcc, cprinc);
         if (ret) {
-            com_err(progname, ret, _("when initializing cache %s"),
-                    opts->k5_out_cache_name ? opts->k5_out_cache_name : "");
+            com_err(progname, ret, _("when creating temporary cache"));
             goto cleanup;
         }
         if (opts->verbose)
             fprintf(stderr, _("Initialized cache\n"));
 
-        ret = k5_cc_store_primary_cred(k5->ctx, k5->out_cc, &my_creds);
+        ret = k5_cc_store_primary_cred(k5->ctx, mcc, &my_creds);
         if (ret) {
             com_err(progname, ret, _("while storing credentials"));
             goto cleanup;
         }
+        ret = krb5_cc_move(k5->ctx, mcc, k5->out_cc);
+        if (ret) {
+            com_err(progname, ret, _("while saving to cache %s"),
+                    opts->k5_out_cache_name ? opts->k5_out_cache_name : "");
+            goto cleanup;
+        }
+        mcc = NULL;
         if (opts->verbose)
             fprintf(stderr, _("Stored credentials\n"));
     }
@@ -840,6 +834,8 @@
 #ifndef _WIN32
     kinit_kdb_fini();
 #endif
+    if (mcc != NULL)
+        krb5_cc_destroy(k5->ctx, mcc);
     if (options)
         krb5_get_init_creds_opt_free(k5->ctx, options);
     if (my_creds.client == k5->me)

_service:tar_scm:krb5-1.19.2.tar.gz/src/clients/kvno/kvno.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/clients/kvno/kvno.c Changed

@@ -38,16 +38,14 @@
 static char *prog;
 static int quiet = 0;
 
-#define XUSAGE_BREAK "\n\t"
-
 static void
 xusage()
 {
     fprintf(stderr, _("usage: %s -c ccache -e etype -k keytab -q "
-                      "-u | -S sname" XUSAGE_BREAK
-                      "{-F cert_file | {-I | -U} for_user} -P | "
-                      "--u2u ccache" XUSAGE_BREAK
-                      "--cached-only --no-store --out-cache "
+                      "-u | -S sname\n"
+                      "\t{-F cert_file | {-I | -U} for_user} -P | "
+                      "--u2u ccache\n"
+                      "\t--cached-only --no-store --out-cache "
                       "service1 service2 ...\n"),
             prog);
     exit(1);
@@ -456,7 +454,7 @@
     krb5_error_code ret;
     int i, errors, flags, initialized = 0;
     krb5_enctype etype;
-    krb5_ccache ccache, out_ccache = NULL;
+    krb5_ccache ccache, mcc, out_ccache = NULL;
     krb5_principal me;
     krb5_keytab keytab = NULL;
     krb5_principal for_user_princ = NULL;
@@ -547,6 +545,14 @@
         exit(1);
     }
 
+    if (out_ccache != NULL) {
+        ret = krb5_cc_new_unique(context, "MEMORY", NULL, &mcc);
+        if (ret) {
+            com_err(prog, ret, _("while creating temporary output ccache"));
+            exit(1);
+        }
+    }
+
     errors = 0;
     for (i = 0; i < count; i++) {
         if (kvno(namesi, ccache, me, etype, keytab, sname, options, unknown,
@@ -554,7 +560,7 @@
             errors++;
         } else if (out_ccache != NULL) {
             if (!initialized) {
-                ret = krb5_cc_initialize(context, out_ccache, creds->client);
+                ret = krb5_cc_initialize(context, mcc, creds->client);
                 if (ret) {
                     com_err(prog, ret, _("while initializing output ccache"));
                     exit(1);
@@ -562,9 +568,9 @@
                 initialized = 1;
             }
             if (count == 1)
-                ret = k5_cc_store_primary_cred(context, out_ccache, creds);
+                ret = k5_cc_store_primary_cred(context, mcc, creds);
             else
-                ret = krb5_cc_store_cred(context, out_ccache, creds);
+                ret = krb5_cc_store_cred(context, mcc, creds);
             if (ret) {
                 com_err(prog, ret, _("while storing creds in output ccache"));
                 exit(1);
@@ -574,6 +580,14 @@
         krb5_free_creds(context, creds);
     }
 
+    if (!errors && out_ccache != NULL) {
+        ret = krb5_cc_move(context, mcc, out_ccache);
+        if (ret) {
+            com_err(prog, ret, _("while writing output ccache"));
+            exit(1);
+        }
+    }
+
     if (keytab != NULL)
         krb5_kt_close(context, keytab);
     krb5_free_principal(context, me);

_service:tar_scm:krb5-1.19.2.tar.gz/src/config/config.guess -> _service:tar_scm:krb5-1.20.1.tar.gz/src/config/config.guess Changed

@@ -1,12 +1,14 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2020 Free Software Foundation, Inc.
+#   Copyright 1992-2022 Free Software Foundation, Inc.
 
-timestamp='2020-11-19'
+# shellcheck disable=SC2006,SC2268 # see below for rationale
+
+timestamp='2022-01-09'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
+# the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -32,7 +34,15 @@
 # Please send patches to <config-patches@gnu.org>.
 
 
-me=$(echo "$0" | sed -e 's,.*/,,')
+# The "shellcheck disable" line above the timestamp inhibits complaints
+# about features and limitations of the classic Bourne shell that were
+# superseded or lifted in POSIX.  However, this script identifies a wide
+# variety of pre-POSIX systems that do not have POSIX shells at all, and
+# even some reasonably current systems (Solaris 10 as case-in-point) still
+# have a pre-POSIX /bin/sh.
+
+
+me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
 Usage: $0 OPTION
@@ -50,7 +60,7 @@
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2020 Free Software Foundation, Inc.
+Copyright 1992-2022 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -84,6 +94,9 @@
   exit 1
 fi
 
+# Just in case it came from the environment.
+GUESS=
+
 # CC_FOR_BUILD -- compiler used by this script. Note that the use of a
 # compiler to aid in system detection is discouraged as it requires
 # temporary files to be created and, as you can see below, it is a
@@ -102,8 +115,8 @@
     # prevent multiple calls if $tmp is already set
     test "$tmp" && return 0
     : "${TMPDIR=/tmp}"
-    # shellcheck disable=SC2039
-    { tmp=$( (umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null) && test -n "$tmp" && test -d "$tmp" ; } ||
+    # shellcheck disable=SC2039,SC3028
+    { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
 	{ test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir "$tmp" 2>/dev/null) ; } ||
 	{ tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir "$tmp" 2>/dev/null) && echo "Warning: creating insecure temp directory" >&2 ; } ||
 	{ echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; }
@@ -112,7 +125,7 @@
 	,,)    echo "int x;" > "$dummy.c"
 	       for driver in cc gcc c89 c99 ; do
 		   if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then
-		       CC_FOR_BUILD="$driver"
+		       CC_FOR_BUILD=$driver
 		       break
 		   fi
 	       done
@@ -131,12 +144,12 @@
 	PATH=$PATH:/.attbin ; export PATH
 fi
 
-UNAME_MACHINE=$( (uname -m) 2>/dev/null) || UNAME_MACHINE=unknown
-UNAME_RELEASE=$( (uname -r) 2>/dev/null) || UNAME_RELEASE=unknown
-UNAME_SYSTEM=$( (uname -s) 2>/dev/null) || UNAME_SYSTEM=unknown
-UNAME_VERSION=$( (uname -v) 2>/dev/null) || UNAME_VERSION=unknown
+UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown
+UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
+UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
+UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
-case "$UNAME_SYSTEM" in
+case $UNAME_SYSTEM in
 Linux|GNU|GNU/*)
 	LIBC=unknown
 
@@ -157,7 +170,8 @@
 	#endif
 	#endif
 	EOF
-	eval "$($CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g')"
+	cc_set_libc=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
+	eval "$cc_set_libc"
 
 	# Second heuristic to detect musl libc.
 	if  "$LIBC" = unknown  &&
@@ -176,7 +190,7 @@
 
 # Note: order is significant - the case branches are not exclusive.
 
-case "$UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION" in
+case $UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION in
     *:NetBSD:*:*)
 	# NetBSD (nbsd) targets should (where applicable) match one or
 	# more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*,
@@ -188,12 +202,11 @@
 	#
 	# Note: NetBSD doesn't particularly care about the vendor
 	# portion of the name.  We always set it to "unknown".
-	sysctl="sysctl -n hw.machine_arch"
-	UNAME_MACHINE_ARCH=$( (uname -p 2>/dev/null || \
-	    "/sbin/$sysctl" 2>/dev/null || \
-	    "/usr/sbin/$sysctl" 2>/dev/null || \
-	    echo unknown))
-	case "$UNAME_MACHINE_ARCH" in
+	UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \
+	    /sbin/sysctl -n hw.machine_arch 2>/dev/null || \
+	    /usr/sbin/sysctl -n hw.machine_arch 2>/dev/null || \
+	    echo unknown)`
+	case $UNAME_MACHINE_ARCH in
 	    aarch64eb) machine=aarch64_be-unknown ;;
 	    armeb) machine=armeb-unknown ;;
 	    arm*) machine=arm-unknown ;;
@@ -201,15 +214,15 @@
 	    sh3eb) machine=sh-unknown ;;
 	    sh5el) machine=sh5le-unknown ;;
 	    earmv*)
-		arch=$(echo "$UNAME_MACHINE_ARCH" | sed -e 's,^e$armv0-9$.*$,\1,')
-		endian=$(echo "$UNAME_MACHINE_ARCH" | sed -ne 's,^.*$eb$$,\1,p')
-		machine="${arch}${endian}"-unknown
+		arch=`echo "$UNAME_MACHINE_ARCH" | sed -e 's,^e$armv0-9$.*$,\1,'`
+		endian=`echo "$UNAME_MACHINE_ARCH" | sed -ne 's,^.*$eb$$,\1,p'`
+		machine=${arch}${endian}-unknown
 		;;
-	    *) machine="$UNAME_MACHINE_ARCH"-unknown ;;
+	    *) machine=$UNAME_MACHINE_ARCH-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
 	# to ELF recently (or will in the future) and ABI.
-	case "$UNAME_MACHINE_ARCH" in
+	case $UNAME_MACHINE_ARCH in
 	    earm*)
 		os=netbsdelf
 		;;
@@ -230,10 +243,10 @@
 		;;
 	esac
 	# Determine ABI tags.
-	case "$UNAME_MACHINE_ARCH" in
+	case $UNAME_MACHINE_ARCH in
 	    earm*)
 		expr='s/^earmv0-9/-eabi/;s/eb$//'
-		abi=$(echo "$UNAME_MACHINE_ARCH" | sed -e "$expr")
+		abi=`echo "$UNAME_MACHINE_ARCH" | sed -e "$expr"`
 		;;
 	esac
 	# The OS release
@@ -241,76 +254,82 @@
 	# thus, need a distinct triplet. However, they do not need
 	# kernel version information, so it can be replaced with a
 	# suitable tag, in the style of linux-gnu.
-	case "$UNAME_VERSION" in
+	case $UNAME_VERSION in
 	    Debian*)
 		release='-gnu'
 		;;
 	    *)
-		release=$(echo "$UNAME_RELEASE" | sed -e 's/-_.*//' | cut -d. -f1,2)
+		release=`echo "$UNAME_RELEASE" | sed -e 's/-_.*//' | cut -d. -f1,2`
 		;;
 	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
-	echo "$machine-${os}${release}${abi-}"
-	exit ;;
+	GUESS=$machine-${os}${release}${abi-}
+	;;
     *:Bitrig:*:*)
-	UNAME_MACHINE_ARCH=$(arch | sed 's/Bitrig.//')
-	echo "$UNAME_MACHINE_ARCH"-unknown-bitrig"$UNAME_RELEASE"
-	exit ;;
+	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
+	GUESS=$UNAME_MACHINE_ARCH-unknown-bitrig$UNAME_RELEASE
+	;;
     *:OpenBSD:*:*)
-	UNAME_MACHINE_ARCH=$(arch | sed 's/OpenBSD.//')
-	echo "$UNAME_MACHINE_ARCH"-unknown-openbsd"$UNAME_RELEASE"
-	exit ;;
+	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
+	GUESS=$UNAME_MACHINE_ARCH-unknown-openbsd$UNAME_RELEASE
+	;;
+    *:SecBSD:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/SecBSD.//'`
+	GUESS=$UNAME_MACHINE_ARCH-unknown-secbsd$UNAME_RELEASE
+	;;
     *:LibertyBSD:*:*)
-	UNAME_MACHINE_ARCH=$(arch | sed 's/^.*BSD\.//')
-	echo "$UNAME_MACHINE_ARCH"-unknown-libertybsd"$UNAME_RELEASE"
-	exit ;;
+	UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
+	GUESS=$UNAME_MACHINE_ARCH-unknown-libertybsd$UNAME_RELEASE
+	;;
     *:MidnightBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-midnightbsd"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-midnightbsd$UNAME_RELEASE
+	;;
     *:ekkoBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-ekkobsd"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-ekkobsd$UNAME_RELEASE
+	;;
     *:SolidBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-solidbsd"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-solidbsd$UNAME_RELEASE
+	;;
     *:OS108:*:*)
-	echo "$UNAME_MACHINE"-unknown-os108_"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-os108_$UNAME_RELEASE
+	;;
     macppc:MirBSD:*:*)
-	echo powerpc-unknown-mirbsd"$UNAME_RELEASE"
-	exit ;;
+	GUESS=powerpc-unknown-mirbsd$UNAME_RELEASE
+	;;
     *:MirBSD:*:*)
-	echo "$UNAME_MACHINE"-unknown-mirbsd"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-mirbsd$UNAME_RELEASE
+	;;
     *:Sortix:*:*)
-	echo "$UNAME_MACHINE"-unknown-sortix
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-sortix
+	;;
     *:Twizzler:*:*)
-	echo "$UNAME_MACHINE"-unknown-twizzler
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-twizzler
+	;;
     *:Redox:*:*)
-	echo "$UNAME_MACHINE"-unknown-redox
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-redox
+	;;
     mips:OSF1:*.*)
-	echo mips-dec-osf1
-	exit ;;
+	GUESS=mips-dec-osf1
+	;;
     alpha:OSF1:*:*)
+	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
+	trap '' 0
 	case $UNAME_RELEASE in
 	*4.0)
-		UNAME_RELEASE=$(/usr/sbin/sizer -v | awk '{print $3}')
+		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
 		;;
 	*5.*)
-		UNAME_RELEASE=$(/usr/sbin/sizer -v | awk '{print $4}')
+		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
 		;;
 	esac
 	# According to Compaq, /usr/sbin/psrinfo has been available on
 	# OSF/1 and Tru64 systems produced since 1995.  I hope that
 	# covers most systems running today.  This code pipes the CPU
 	# types through head -n 1, so we only detect the type of CPU 0.
-	ALPHA_CPU_TYPE=$(/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha $.*$ processor.*$/\1/p' | head -n 1)
-	case "$ALPHA_CPU_TYPE" in
+	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha $.*$ processor.*$/\1/p' | head -n 1`
+	case $ALPHA_CPU_TYPE in
 	    "EV4 (21064)")
 		UNAME_MACHINE=alpha ;;
 	    "EV4.5 (21064)")
@@ -347,68 +366,69 @@
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	echo "$UNAME_MACHINE"-dec-osf"$(echo "$UNAME_RELEASE" | sed -e 's/^PVTX//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz)"
-	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
-	exitcode=$?
-	trap '' 0
-	exit $exitcode ;;
+	OSF_REL=`echo "$UNAME_RELEASE" | sed -e 's/^PVTX//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
+	GUESS=$UNAME_MACHINE-dec-osf$OSF_REL
+	;;
     Amiga*:UNIX_System_V:4.0:*)
-	echo m68k-unknown-sysv4
-	exit ;;
+	GUESS=m68k-unknown-sysv4
+	;;
     *:AamigaOoSs:*:*)
-	echo "$UNAME_MACHINE"-unknown-amigaos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-amigaos
+	;;
     *:MmorphOoSs:*:*)
-	echo "$UNAME_MACHINE"-unknown-morphos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-morphos
+	;;
     *:OS/390:*:*)
-	echo i370-ibm-openedition
-	exit ;;
+	GUESS=i370-ibm-openedition
+	;;
     *:z/VM:*:*)
-	echo s390-ibm-zvmoe
-	exit ;;
+	GUESS=s390-ibm-zvmoe
+	;;
     *:OS400:*:*)
-	echo powerpc-ibm-os400
-	exit ;;
+	GUESS=powerpc-ibm-os400
+	;;
     arm:RISC*:1.012*:*|arm:riscix:1.012*:*)
-	echo arm-acorn-riscix"$UNAME_RELEASE"
-	exit ;;
+	GUESS=arm-acorn-riscix$UNAME_RELEASE
+	;;
     arm*:riscos:*:*|arm*:RISCOS:*:*)
-	echo arm-unknown-riscos
-	exit ;;
+	GUESS=arm-unknown-riscos
+	;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
-	echo hppa1.1-hitachi-hiuxmpp
-	exit ;;
+	GUESS=hppa1.1-hitachi-hiuxmpp
+	;;
     Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
 	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
-	if test "$( (/bin/universe) 2>/dev/null)" = att ; then
-		echo pyramid-pyramid-sysv3
-	else
-		echo pyramid-pyramid-bsd
-	fi
-	exit ;;
+	case `(/bin/universe) 2>/dev/null` in
+	    att) GUESS=pyramid-pyramid-sysv3 ;;
+	    *)   GUESS=pyramid-pyramid-bsd   ;;
+	esac
+	;;
     NILE*:*:*:dcosx)
-	echo pyramid-pyramid-svr4
-	exit ;;
+	GUESS=pyramid-pyramid-svr4
+	;;
     DRS?6000:unix:4.0:6*)
-	echo sparc-icl-nx6
-	exit ;;
+	GUESS=sparc-icl-nx6
+	;;
     DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
-	case $(/usr/bin/uname -p) in
-	    sparc) echo sparc-icl-nx7; exit ;;
-	esac ;;
+	case `/usr/bin/uname -p` in
+	    sparc) GUESS=sparc-icl-nx7 ;;
+	esac
+	;;
     s390x:SunOS:*:*)
-	echo "$UNAME_MACHINE"-ibm-solaris2"$(echo "$UNAME_RELEASE" | sed -e 's/^.*//')"
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=$UNAME_MACHINE-ibm-solaris2$SUN_REL
+	;;
     sun4H:SunOS:5.*:*)
-	echo sparc-hal-solaris2"$(echo "$UNAME_RELEASE"|sed -e 's/^.*//')"
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=sparc-hal-solaris2$SUN_REL
+	;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
-	echo sparc-sun-solaris2"$(echo "$UNAME_RELEASE" | sed -e 's/^.*//')"
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=sparc-sun-solaris2$SUN_REL
+	;;
     i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
-	echo i386-pc-auroraux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=i386-pc-auroraux$UNAME_RELEASE
+	;;
     i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
 	set_cc_for_build
 	SUN_ARCH=i386
@@ -417,47 +437,50 @@
 	# This test works for both compilers.
 	if test "$CC_FOR_BUILD" != no_compiler_found; then
 	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
-		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		(CCOPTS="" $CC_FOR_BUILD -m64 -E - 2>/dev/null) | \
 		grep IS_64BIT_ARCH >/dev/null
 	    then
 		SUN_ARCH=x86_64
 	    fi
 	fi
-	echo "$SUN_ARCH"-pc-solaris2"$(echo "$UNAME_RELEASE"|sed -e 's/^.*//')"
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=$SUN_ARCH-pc-solaris2$SUN_REL
+	;;
     sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
 	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
 	# it's likely to be more like Solaris than SunOS4.
-	echo sparc-sun-solaris3"$(echo "$UNAME_RELEASE"|sed -e 's/^.*//')"
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=sparc-sun-solaris3$SUN_REL
+	;;
     sun4*:SunOS:*:*)
-	case "$(/usr/bin/arch -k)" in
+	case `/usr/bin/arch -k` in
 	    Series*|S4*)
-		UNAME_RELEASE=$(uname -v)
+		UNAME_RELEASE=`uname -v`
 		;;
 	esac
 	# Japanese Language versions have a version number like `4.1.3-JL'.
-	echo sparc-sun-sunos"$(echo "$UNAME_RELEASE"|sed -e 's/-/_/')"
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/'`
+	GUESS=sparc-sun-sunos$SUN_REL
+	;;
     sun3*:SunOS:*:*)
-	echo m68k-sun-sunos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-sun-sunos$UNAME_RELEASE
+	;;
     sun*:*:4.2BSD:*)
-	UNAME_RELEASE=$( (sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null)
+	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
 	test "x$UNAME_RELEASE" = x && UNAME_RELEASE=3
-	case "$(/bin/arch)" in
+	case `/bin/arch` in
 	    sun3)
-		echo m68k-sun-sunos"$UNAME_RELEASE"
+		GUESS=m68k-sun-sunos$UNAME_RELEASE
 		;;
 	    sun4)
-		echo sparc-sun-sunos"$UNAME_RELEASE"
+		GUESS=sparc-sun-sunos$UNAME_RELEASE
 		;;
 	esac
-	exit ;;
+	;;
     aushp:SunOS:*:*)
-	echo sparc-auspex-sunos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sparc-auspex-sunos$UNAME_RELEASE
+	;;
     # The situation for MiNT is a little confusing.  The machine name
     # can be virtually everything (everything which is not
     # "atarist" or "atariste" at least should have a processor
@@ -467,41 +490,41 @@
     # MiNT.  But MiNT is downward compatible to TOS, so this should
     # be no problem.
     atariste:*MiNT:*:* | atariste:*mint:*:* | atariste:*TOS:*:*)
-	echo m68k-atari-mint"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atariste:*TOS:*:*)
-	echo m68k-atari-mint"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
-	echo m68k-atari-mint"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
-	echo m68k-milan-mint"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-milan-mint$UNAME_RELEASE
+	;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
-	echo m68k-hades-mint"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-hades-mint$UNAME_RELEASE
+	;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
-	echo m68k-unknown-mint"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-unknown-mint$UNAME_RELEASE
+	;;
     m68k:machten:*:*)
-	echo m68k-apple-machten"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-apple-machten$UNAME_RELEASE
+	;;
     powerpc:machten:*:*)
-	echo powerpc-apple-machten"$UNAME_RELEASE"
-	exit ;;
+	GUESS=powerpc-apple-machten$UNAME_RELEASE
+	;;
     RISC*:Mach:*:*)
-	echo mips-dec-mach_bsd4.3
-	exit ;;
+	GUESS=mips-dec-mach_bsd4.3
+	;;
     RISC*:ULTRIX:*:*)
-	echo mips-dec-ultrix"$UNAME_RELEASE"
-	exit ;;
+	GUESS=mips-dec-ultrix$UNAME_RELEASE
+	;;
     VAX*:ULTRIX*:*:*)
-	echo vax-dec-ultrix"$UNAME_RELEASE"
-	exit ;;
+	GUESS=vax-dec-ultrix$UNAME_RELEASE
+	;;
     2020:CLIX:*:* | 2430:CLIX:*:*)
-	echo clipper-intergraph-clix"$UNAME_RELEASE"
-	exit ;;
+	GUESS=clipper-intergraph-clix$UNAME_RELEASE
+	;;
     mips:*:*:UMIPS | mips:*:*:RISCos)
 	set_cc_for_build
 	sed 's/^	//' << EOF > "$dummy.c"
@@ -526,78 +549,79 @@
 	}
 EOF
 	$CC_FOR_BUILD -o "$dummy" "$dummy.c" &&
-	  dummyarg=$(echo "$UNAME_RELEASE" | sed -n 's/$0-9*$.*/\1/p') &&
-	  SYSTEM_NAME=$("$dummy" "$dummyarg") &&
+	  dummyarg=`echo "$UNAME_RELEASE" | sed -n 's/$0-9*$.*/\1/p'` &&
+	  SYSTEM_NAME=`"$dummy" "$dummyarg"` &&
 	    { echo "$SYSTEM_NAME"; exit; }
-	echo mips-mips-riscos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=mips-mips-riscos$UNAME_RELEASE
+	;;
     Motorola:PowerMAX_OS:*:*)
-	echo powerpc-motorola-powermax
-	exit ;;
+	GUESS=powerpc-motorola-powermax
+	;;
     Motorola:*:4.3:PL8-*)
-	echo powerpc-harris-powermax
-	exit ;;
+	GUESS=powerpc-harris-powermax
+	;;
     Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
-	echo powerpc-harris-powermax
-	exit ;;
+	GUESS=powerpc-harris-powermax
+	;;
     Night_Hawk:Power_UNIX:*:*)
-	echo powerpc-harris-powerunix
-	exit ;;
+	GUESS=powerpc-harris-powerunix
+	;;
     m88k:CX/UX:7*:*)
-	echo m88k-harris-cxux7
-	exit ;;
+	GUESS=m88k-harris-cxux7
+	;;
     m88k:*:4*:R4*)
-	echo m88k-motorola-sysv4
-	exit ;;
+	GUESS=m88k-motorola-sysv4
+	;;
     m88k:*:3*:R3*)
-	echo m88k-motorola-sysv3
-	exit ;;
+	GUESS=m88k-motorola-sysv3
+	;;
     AViiON:dgux:*:*)
 	# DG/UX returns AViiON for all architectures
-	UNAME_PROCESSOR=$(/usr/bin/uname -p)
+	UNAME_PROCESSOR=`/usr/bin/uname -p`
 	if test "$UNAME_PROCESSOR" = mc88100 || test "$UNAME_PROCESSOR" = mc88110
 	then
 	    if test "$TARGET_BINARY_INTERFACE"x = m88kdguxelfx || \
 	       test "$TARGET_BINARY_INTERFACE"x = x
 	    then
-		echo m88k-dg-dgux"$UNAME_RELEASE"
+		GUESS=m88k-dg-dgux$UNAME_RELEASE
 	    else
-		echo m88k-dg-dguxbcs"$UNAME_RELEASE"
+		GUESS=m88k-dg-dguxbcs$UNAME_RELEASE
 	    fi
 	else
-	    echo i586-dg-dgux"$UNAME_RELEASE"
+	    GUESS=i586-dg-dgux$UNAME_RELEASE
 	fi
-	exit ;;
+	;;
     M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
-	echo m88k-dolphin-sysv3
-	exit ;;
+	GUESS=m88k-dolphin-sysv3
+	;;
     M88*:*:R3*:*)
 	# Delta 88k system running SVR3
-	echo m88k-motorola-sysv3
-	exit ;;
+	GUESS=m88k-motorola-sysv3
+	;;
     XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
-	echo m88k-tektronix-sysv3
-	exit ;;
+	GUESS=m88k-tektronix-sysv3
+	;;
     Tek430-90-9:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
-	echo m68k-tektronix-bsd
-	exit ;;
+	GUESS=m68k-tektronix-bsd
+	;;
     *:IRIX*:*:*)
-	echo mips-sgi-irix"$(echo "$UNAME_RELEASE"|sed -e 's/-/_/g')"
-	exit ;;
+	IRIX_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/g'`
+	GUESS=mips-sgi-irix$IRIX_REL
+	;;
     ????????:AIX?:12.1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-	echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
-	exit ;;               # Note that: echo "'$(uname -s)'" gives 'AIX '
+	GUESS=romp-ibm-aix    # uname -m gives an 8 hex-code CPU id
+	;;                    # Note that: echo "'`uname -s`'" gives 'AIX '
     i*86:AIX:*:*)
-	echo i386-ibm-aix
-	exit ;;
+	GUESS=i386-ibm-aix
+	;;
     ia64:AIX:*:*)
 	if test -x /usr/bin/oslevel ; then
-		IBM_REV=$(/usr/bin/oslevel)
+		IBM_REV=`/usr/bin/oslevel`
 	else
-		IBM_REV="$UNAME_VERSION.$UNAME_RELEASE"
+		IBM_REV=$UNAME_VERSION.$UNAME_RELEASE
 	fi
-	echo "$UNAME_MACHINE"-ibm-aix"$IBM_REV"
-	exit ;;
+	GUESS=$UNAME_MACHINE-ibm-aix$IBM_REV
+	;;
     *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
 		set_cc_for_build
@@ -612,68 +636,68 @@
 			exit(0);
 			}
 EOF
-		if $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=$("$dummy")
+		if $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"`
 		then
-			echo "$SYSTEM_NAME"
+			GUESS=$SYSTEM_NAME
 		else
-			echo rs6000-ibm-aix3.2.5
+			GUESS=rs6000-ibm-aix3.2.5
 		fi
 	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
-		echo rs6000-ibm-aix3.2.4
+		GUESS=rs6000-ibm-aix3.2.4
 	else
-		echo rs6000-ibm-aix3.2
+		GUESS=rs6000-ibm-aix3.2
 	fi
-	exit ;;
+	;;
     *:AIX:*:4567)
-	IBM_CPU_ID=$(/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }')
+	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El "$IBM_CPU_ID" | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
 		IBM_ARCH=powerpc
 	fi
 	if test -x /usr/bin/lslpp ; then
-		IBM_REV=$(/usr/bin/lslpp -Lqc bos.rte.libc |
-			   awk -F: '{ print $3 }' | sed s/0-9*$/0/)
+		IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | \
+			   awk -F: '{ print $3 }' | sed s/0-9*$/0/`
 	else
-		IBM_REV="$UNAME_VERSION.$UNAME_RELEASE"
+		IBM_REV=$UNAME_VERSION.$UNAME_RELEASE
 	fi
-	echo "$IBM_ARCH"-ibm-aix"$IBM_REV"
-	exit ;;
+	GUESS=$IBM_ARCH-ibm-aix$IBM_REV
+	;;
     *:AIX:*:*)
-	echo rs6000-ibm-aix
-	exit ;;
+	GUESS=rs6000-ibm-aix
+	;;
     ibmrt:4.4BSD:*|romp-ibm:4.4BSD:*)
-	echo romp-ibm-bsd4.4
-	exit ;;
+	GUESS=romp-ibm-bsd4.4
+	;;
     ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
-	echo romp-ibm-bsd"$UNAME_RELEASE"   # 4.3 with uname added to
-	exit ;;                             # report: romp-ibm BSD 4.3
+	GUESS=romp-ibm-bsd$UNAME_RELEASE    # 4.3 with uname added to
+	;;                                  # report: romp-ibm BSD 4.3
     *:BOSX:*:*)
-	echo rs6000-bull-bosx
-	exit ;;
+	GUESS=rs6000-bull-bosx
+	;;
     DPX/2?00:B.O.S.:*:*)
-	echo m68k-bull-sysv3
-	exit ;;
+	GUESS=m68k-bull-sysv3
+	;;
     9000/34??:4.3bsd:1.*:*)
-	echo m68k-hp-bsd
-	exit ;;
+	GUESS=m68k-hp-bsd
+	;;
     hp300:4.4BSD:*:* | 9000/34??:4.3bsd:2.*:*)
-	echo m68k-hp-bsd4.4
-	exit ;;
+	GUESS=m68k-hp-bsd4.4
+	;;
     9000/34678??:HP-UX:*:*)
-	HPUX_REV=$(echo "$UNAME_RELEASE"|sed -e 's/^.*.0B*//')
-	case "$UNAME_MACHINE" in
+	HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/^.*.0B*//'`
+	case $UNAME_MACHINE in
 	    9000/31?)            HP_ARCH=m68000 ;;
 	    9000/34??)         HP_ARCH=m68k ;;
 	    9000/6780-90-9)
 		if test -x /usr/bin/getconf; then
-		    sc_cpu_version=$(/usr/bin/getconf SC_CPU_VERSION 2>/dev/null)
-		    sc_kernel_bits=$(/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null)
-		    case "$sc_cpu_version" in
+		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
+		    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
+		    case $sc_cpu_version in
 		      523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
 		      528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
 		      532)                      # CPU_PA_RISC2_0
-			case "$sc_kernel_bits" in
+			case $sc_kernel_bits in
 			  32) HP_ARCH=hppa2.0n ;;
 			  64) HP_ARCH=hppa2.0w ;;
 			  '') HP_ARCH=hppa2.0 ;;   # HP-UX 10.20
@@ -715,7 +739,7 @@
 		    exit (0);
 		}
 EOF
-		    (CCOPTS="" $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null) && HP_ARCH=$("$dummy")
+		    (CCOPTS="" $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null) && HP_ARCH=`"$dummy"`
 		    test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
@@ -740,12 +764,12 @@
 		HP_ARCH=hppa64
 	    fi
 	fi
-	echo "$HP_ARCH"-hp-hpux"$HPUX_REV"
-	exit ;;
+	GUESS=$HP_ARCH-hp-hpux$HPUX_REV
+	;;
     ia64:HP-UX:*:*)
-	HPUX_REV=$(echo "$UNAME_RELEASE"|sed -e 's/^.*.0B*//')
-	echo ia64-hp-hpux"$HPUX_REV"
-	exit ;;
+	HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/^.*.0B*//'`
+	GUESS=ia64-hp-hpux$HPUX_REV
+	;;
     3050*:HI-UX:*:*)
 	set_cc_for_build
 	sed 's/^	//' << EOF > "$dummy.c"
@@ -773,38 +797,38 @@
 	  exit (0);
 	}
 EOF
-	$CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=$("$dummy") &&
+	$CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"` &&
 		{ echo "$SYSTEM_NAME"; exit; }
-	echo unknown-hitachi-hiuxwe2
-	exit ;;
+	GUESS=unknown-hitachi-hiuxwe2
+	;;
     9000/7??:4.3bsd:*:* | 9000/8?79:4.3bsd:*:*)
-	echo hppa1.1-hp-bsd
-	exit ;;
+	GUESS=hppa1.1-hp-bsd
+	;;
     9000/8??:4.3bsd:*:*)
-	echo hppa1.0-hp-bsd
-	exit ;;
+	GUESS=hppa1.0-hp-bsd
+	;;
     *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
-	echo hppa1.0-hp-mpeix
-	exit ;;
+	GUESS=hppa1.0-hp-mpeix
+	;;
     hp7??:OSF1:*:* | hp8?79:OSF1:*:*)
-	echo hppa1.1-hp-osf
-	exit ;;
+	GUESS=hppa1.1-hp-osf
+	;;
     hp8??:OSF1:*:*)
-	echo hppa1.0-hp-osf
-	exit ;;
+	GUESS=hppa1.0-hp-osf
+	;;
     i*86:OSF1:*:*)
 	if test -x /usr/sbin/sysversion ; then
-	    echo "$UNAME_MACHINE"-unknown-osf1mk
+	    GUESS=$UNAME_MACHINE-unknown-osf1mk
 	else
-	    echo "$UNAME_MACHINE"-unknown-osf1
+	    GUESS=$UNAME_MACHINE-unknown-osf1
 	fi
-	exit ;;
+	;;
     parisc*:Lites*:*:*)
-	echo hppa1.1-hp-lites
-	exit ;;
+	GUESS=hppa1.1-hp-lites
+	;;
     C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
-	echo c1-convex-bsd
-	exit ;;
+	GUESS=c1-convex-bsd
+	;;
     C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
@@ -812,17 +836,18 @@
 	fi
 	exit ;;
     C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
-	echo c34-convex-bsd
-	exit ;;
+	GUESS=c34-convex-bsd
+	;;
     C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
-	echo c38-convex-bsd
-	exit ;;
+	GUESS=c38-convex-bsd
+	;;
     C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
-	echo c4-convex-bsd
-	exit ;;
+	GUESS=c4-convex-bsd
+	;;
     CRAY*Y-MP:*:*:*)
-	echo ymp-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=ymp-cray-unicos$CRAY_REL
+	;;
     CRAY*A-Z90:*:*:*)
 	echo "$UNAME_MACHINE"-cray-unicos"$UNAME_RELEASE" \
 	| sed -e 's/CRAY.*$A-Z90$/\1/' \
@@ -830,114 +855,129 @@
 	      -e 's/\.^.*$/.X/'
 	exit ;;
     CRAY*TS:*:*:*)
-	echo t90-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=t90-cray-unicos$CRAY_REL
+	;;
     CRAY*T3E:*:*:*)
-	echo alphaev5-cray-unicosmk"$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=alphaev5-cray-unicosmk$CRAY_REL
+	;;
     CRAY*SV1:*:*:*)
-	echo sv1-cray-unicos"$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=sv1-cray-unicos$CRAY_REL
+	;;
     *:UNICOS/mp:*:*)
-	echo craynv-cray-unicosmp"$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=craynv-cray-unicosmp$CRAY_REL
+	;;
     F3001:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
-	FUJITSU_PROC=$(uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz)
-	FUJITSU_SYS=$(uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///')
-	FUJITSU_REL=$(echo "$UNAME_RELEASE" | sed -e 's/ /_/')
-	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-	exit ;;
+	FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
+	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
+	FUJITSU_REL=`echo "$UNAME_RELEASE" | sed -e 's/ /_/'`
+	GUESS=${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}
+	;;
     5000:UNIX_System_V:4.*:*)
-	FUJITSU_SYS=$(uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///')
-	FUJITSU_REL=$(echo "$UNAME_RELEASE" | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/')
-	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-	exit ;;
+	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
+	FUJITSU_REL=`echo "$UNAME_RELEASE" | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
+	GUESS=sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}
+	;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
-	echo "$UNAME_MACHINE"-pc-bsdi"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-bsdi$UNAME_RELEASE
+	;;
     sparc*:BSD/OS:*:*)
-	echo sparc-unknown-bsdi"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sparc-unknown-bsdi$UNAME_RELEASE
+	;;
     *:BSD/OS:*:*)
-	echo "$UNAME_MACHINE"-unknown-bsdi"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-bsdi$UNAME_RELEASE
+	;;
     arm:FreeBSD:*:*)
-	UNAME_PROCESSOR=$(uname -p)
+	UNAME_PROCESSOR=`uname -p`
 	set_cc_for_build
 	if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
 	    | grep -q __ARM_PCS_VFP
 	then
-	    echo "${UNAME_PROCESSOR}"-unknown-freebsd"$(echo ${UNAME_RELEASE}|sed -e 's/-(.*//')"-gnueabi
+	    FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	    GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabi
 	else
-	    echo "${UNAME_PROCESSOR}"-unknown-freebsd"$(echo ${UNAME_RELEASE}|sed -e 's/-(.*//')"-gnueabihf
+	    FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	    GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabihf
 	fi
-	exit ;;
+	;;
     *:FreeBSD:*:*)
-	UNAME_PROCESSOR=$(/usr/bin/uname -p)
-	case "$UNAME_PROCESSOR" in
+	UNAME_PROCESSOR=`/usr/bin/uname -p`
+	case $UNAME_PROCESSOR in
 	    amd64)
 		UNAME_PROCESSOR=x86_64 ;;
 	    i386)
 		UNAME_PROCESSOR=i586 ;;
 	esac
-	echo "$UNAME_PROCESSOR"-unknown-freebsd"$(echo "$UNAME_RELEASE"|sed -e 's/-(.*//')"
-	exit ;;
+	FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL
+	;;
     i*:CYGWIN*:*)
-	echo "$UNAME_MACHINE"-pc-cygwin
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-cygwin
+	;;
     *:MINGW64*:*)
-	echo "$UNAME_MACHINE"-pc-mingw64
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-mingw64
+	;;
     *:MINGW*:*)
-	echo "$UNAME_MACHINE"-pc-mingw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-mingw32
+	;;
     *:MSYS*:*)
-	echo "$UNAME_MACHINE"-pc-msys
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-msys
+	;;
     i*:PW*:*)
-	echo "$UNAME_MACHINE"-pc-pw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-pw32
+	;;
+    *:SerenityOS:*:*)
+        GUESS=$UNAME_MACHINE-pc-serenity
+        ;;
     *:Interix*:*)
-	case "$UNAME_MACHINE" in
+	case $UNAME_MACHINE in
 	    x86)
-		echo i586-pc-interix"$UNAME_RELEASE"
-		exit ;;
+		GUESS=i586-pc-interix$UNAME_RELEASE
+		;;
 	    authenticamd | genuineintel | EM64T)
-		echo x86_64-unknown-interix"$UNAME_RELEASE"
-		exit ;;
+		GUESS=x86_64-unknown-interix$UNAME_RELEASE
+		;;
 	    IA64)
-		echo ia64-unknown-interix"$UNAME_RELEASE"
-		exit ;;
+		GUESS=ia64-unknown-interix$UNAME_RELEASE
+		;;
 	esac ;;
     i*:UWIN*:*)
-	echo "$UNAME_MACHINE"-pc-uwin
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-uwin
+	;;
     amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
-	echo x86_64-pc-cygwin
-	exit ;;
+	GUESS=x86_64-pc-cygwin
+	;;
     prep*:SunOS:5.*:*)
-	echo powerpcle-unknown-solaris2"$(echo "$UNAME_RELEASE"|sed -e 's/^.*//')"
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=powerpcle-unknown-solaris2$SUN_REL
+	;;
     *:GNU:*:*)
 	# the GNU system
-	echo "$(echo "$UNAME_MACHINE"|sed -e 's,-/.*$,,')-unknown-$LIBC$(echo "$UNAME_RELEASE"|sed -e 's,/.*$,,')"
-	exit ;;
+	GNU_ARCH=`echo "$UNAME_MACHINE" | sed -e 's,-/.*$,,'`
+	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's,/.*$,,'`
+	GUESS=$GNU_ARCH-unknown-$LIBC$GNU_REL
+	;;
     *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo "$UNAME_MACHINE-unknown-$(echo "$UNAME_SYSTEM" | sed 's,^^/*/,,' | tr ":upper:" ":lower:")$(echo "$UNAME_RELEASE"|sed -e 's/-(.*//')-$LIBC"
-	exit ;;
+	GNU_SYS=`echo "$UNAME_SYSTEM" | sed 's,^^/*/,,' | tr ":upper:" ":lower:"`
+	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	GUESS=$UNAME_MACHINE-unknown-$GNU_SYS$GNU_REL-$LIBC
+	;;
     *:Minix:*:*)
-	echo "$UNAME_MACHINE"-unknown-minix
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-minix
+	;;
     aarch64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     alpha:Linux:*:*)
-	case $(sed -n '/^cpu model/s/^.*: $.*$/\1/p' /proc/cpuinfo 2>/dev/null) in
+	case `sed -n '/^cpu model/s/^.*: $.*$/\1/p' /proc/cpuinfo 2>/dev/null` in
 	  EV5)   UNAME_MACHINE=alphaev5 ;;
 	  EV56)  UNAME_MACHINE=alphaev56 ;;
 	  PCA56) UNAME_MACHINE=alphapca56 ;;
@@ -948,60 +988,63 @@
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
 	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
-    arc:Linux:*:* | arceb:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
+    arc:Linux:*:* | arceb:Linux:*:* | arc32:Linux:*:* | arc64:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     arm*:Linux:*:*)
 	set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
 	    | grep -q __ARM_EABI__
 	then
-	    echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+	    GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	else
 	    if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
 		| grep -q __ARM_PCS_VFP
 	    then
-		echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"eabi
+		GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabi
 	    else
-		echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"eabihf
+		GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabihf
 	    fi
 	fi
-	exit ;;
+	;;
     avr32*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     cris:Linux:*:*)
-	echo "$UNAME_MACHINE"-axis-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-axis-linux-$LIBC
+	;;
     crisv32:Linux:*:*)
-	echo "$UNAME_MACHINE"-axis-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-axis-linux-$LIBC
+	;;
     e2k:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     frv:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     hexagon:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     i*86:Linux:*:*)
-	echo "$UNAME_MACHINE"-pc-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-linux-$LIBC
+	;;
     ia64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     k1om:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
+    loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     m32r*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     m68*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     mips:Linux:*:* | mips64:Linux:*:*)
 	set_cc_for_build
 	IS_GLIBC=0
@@ -1046,65 +1089,66 @@
 	#endif
 	#endif
 EOF
-	eval "$($CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^CPU\|^MIPS_ENDIAN\|^LIBCABI')"
+	cc_set_vars=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^CPU\|^MIPS_ENDIAN\|^LIBCABI'`
+	eval "$cc_set_vars"
 	test "x$CPU" != x && { echo "$CPU${MIPS_ENDIAN}-unknown-linux-$LIBCABI"; exit; }
 	;;
     mips64el:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     openrisc*:Linux:*:*)
-	echo or1k-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=or1k-unknown-linux-$LIBC
+	;;
     or32:Linux:*:* | or1k*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     padre:Linux:*:*)
-	echo sparc-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=sparc-unknown-linux-$LIBC
+	;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=hppa64-unknown-linux-$LIBC
+	;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
-	case $(grep '^cpu^a-z*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2) in
-	  PA7*) echo hppa1.1-unknown-linux-"$LIBC" ;;
-	  PA8*) echo hppa2.0-unknown-linux-"$LIBC" ;;
-	  *)    echo hppa-unknown-linux-"$LIBC" ;;
+	case `grep '^cpu^a-z*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
+	  PA7*) GUESS=hppa1.1-unknown-linux-$LIBC ;;
+	  PA8*) GUESS=hppa2.0-unknown-linux-$LIBC ;;
+	  *)    GUESS=hppa-unknown-linux-$LIBC ;;
 	esac
-	exit ;;
+	;;
     ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=powerpc64-unknown-linux-$LIBC
+	;;
     ppc:Linux:*:*)
-	echo powerpc-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=powerpc-unknown-linux-$LIBC
+	;;
     ppc64le:Linux:*:*)
-	echo powerpc64le-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=powerpc64le-unknown-linux-$LIBC
+	;;
     ppcle:Linux:*:*)
-	echo powerpcle-unknown-linux-"$LIBC"
-	exit ;;
-    riscv32:Linux:*:* | riscv64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=powerpcle-unknown-linux-$LIBC
+	;;
+    riscv32:Linux:*:* | riscv32be:Linux:*:* | riscv64:Linux:*:* | riscv64be:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     s390:Linux:*:* | s390x:Linux:*:*)
-	echo "$UNAME_MACHINE"-ibm-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-ibm-linux-$LIBC
+	;;
     sh64*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     sh*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     tile*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     vax:Linux:*:*)
-	echo "$UNAME_MACHINE"-dec-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-dec-linux-$LIBC
+	;;
     x86_64:Linux:*:*)
 	set_cc_for_build
 	LIBCABI=$LIBC
@@ -1113,71 +1157,71 @@
 		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
 		grep IS_X32 >/dev/null
 	    then
-		LIBCABI="$LIBC"x32
+		LIBCABI=${LIBC}x32
 	    fi
 	fi
-	echo "$UNAME_MACHINE"-pc-linux-"$LIBCABI"
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-linux-$LIBCABI
+	;;
     xtensa*:Linux:*:*)
-	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
 	# sysname and nodename.
-	echo i386-sequent-sysv4
-	exit ;;
+	GUESS=i386-sequent-sysv4
+	;;
     i*86:UNIX_SV:4.2MP:2.*)
 	# Unixware is an offshoot of SVR4, but it has its own version
 	# number series starting with 2...
 	# I am not positive that other SVR4 systems won't match this,
 	# I just have to hope.  -- rms.
 	# Use sysv4.2uw... so that sysv4* matches it.
-	echo "$UNAME_MACHINE"-pc-sysv4.2uw"$UNAME_VERSION"
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-sysv4.2uw$UNAME_VERSION
+	;;
     i*86:OS/2:*:*)
 	# If we were able to find `uname', then EMX Unix compatibility
 	# is probably installed.
-	echo "$UNAME_MACHINE"-pc-os2-emx
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-os2-emx
+	;;
     i*86:XTS-300:*:STOP)
-	echo "$UNAME_MACHINE"-unknown-stop
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-stop
+	;;
     i*86:atheos:*:*)
-	echo "$UNAME_MACHINE"-unknown-atheos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-atheos
+	;;
     i*86:syllable:*:*)
-	echo "$UNAME_MACHINE"-pc-syllable
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-syllable
+	;;
     i*86:LynxOS:2.*:* | i*86:LynxOS:3.01*:* | i*86:LynxOS:4.02*:*)
-	echo i386-unknown-lynxos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=i386-unknown-lynxos$UNAME_RELEASE
+	;;
     i*86:*DOS:*:*)
-	echo "$UNAME_MACHINE"-pc-msdosdjgpp
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-msdosdjgpp
+	;;
     i*86:*:4.*:*)
-	UNAME_REL=$(echo "$UNAME_RELEASE" | sed 's/\/MP$//')
+	UNAME_REL=`echo "$UNAME_RELEASE" | sed 's/\/MP$//'`
 	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
-		echo "$UNAME_MACHINE"-univel-sysv"$UNAME_REL"
+		GUESS=$UNAME_MACHINE-univel-sysv$UNAME_REL
 	else
-		echo "$UNAME_MACHINE"-pc-sysv"$UNAME_REL"
+		GUESS=$UNAME_MACHINE-pc-sysv$UNAME_REL
 	fi
-	exit ;;
+	;;
     i*86:*:5:678*)
 	# UnixWare 7.x, OpenUNIX and OpenServer 6.
-	case $(/bin/uname -X | grep "^Machine") in
+	case `/bin/uname -X | grep "^Machine"` in
 	    *486*)	     UNAME_MACHINE=i486 ;;
 	    *Pentium)	     UNAME_MACHINE=i586 ;;
 	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
 	esac
-	echo "$UNAME_MACHINE-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
+	;;
     i*86:*:3.2:*)
 	if test -f /usr/options/cb.name; then
-		UNAME_REL=$(sed -n 's/.*Version //p' </usr/options/cb.name)
-		echo "$UNAME_MACHINE"-pc-isc"$UNAME_REL"
+		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
+		GUESS=$UNAME_MACHINE-pc-isc$UNAME_REL
 	elif /bin/uname -X 2>/dev/null >/dev/null ; then
-		UNAME_REL=$( (/bin/uname -X|grep Release|sed -e 's/.*= //'))
+		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
 		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
 		(/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \
 			&& UNAME_MACHINE=i586
@@ -1185,11 +1229,11 @@
 			&& UNAME_MACHINE=i686
 		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
 			&& UNAME_MACHINE=i686
-		echo "$UNAME_MACHINE"-pc-sco"$UNAME_REL"
+		GUESS=$UNAME_MACHINE-pc-sco$UNAME_REL
 	else
-		echo "$UNAME_MACHINE"-pc-sysv32
+		GUESS=$UNAME_MACHINE-pc-sysv32
 	fi
-	exit ;;
+	;;
     pc:*:*:*)
 	# Left here for compatibility:
 	# uname -m prints for DJGPP always 'pc', but it prints nothing about
@@ -1197,37 +1241,37 @@
 	# Note: whatever this is, it MUST be the same as what config.sub
 	# prints for the "djgpp" host, or else GDB configure will decide that
 	# this is a cross-build.
-	echo i586-pc-msdosdjgpp
-	exit ;;
+	GUESS=i586-pc-msdosdjgpp
+	;;
     Intel:Mach:3*:*)
-	echo i386-pc-mach3
-	exit ;;
+	GUESS=i386-pc-mach3
+	;;
     paragon:*:*:*)
-	echo i860-intel-osf1
-	exit ;;
+	GUESS=i860-intel-osf1
+	;;
     i860:*:4.*:*) # i860-SVR4
 	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
-	  echo i860-stardent-sysv"$UNAME_RELEASE" # Stardent Vistra i860-SVR4
+	  GUESS=i860-stardent-sysv$UNAME_RELEASE    # Stardent Vistra i860-SVR4
 	else # Add other i860-SVR4 vendors below as they are discovered.
-	  echo i860-unknown-sysv"$UNAME_RELEASE"  # Unknown i860-SVR4
+	  GUESS=i860-unknown-sysv$UNAME_RELEASE     # Unknown i860-SVR4
 	fi
-	exit ;;
+	;;
     mini*:CTIX:SYS*5:*)
 	# "miniframe"
-	echo m68010-convergent-sysv
-	exit ;;
+	GUESS=m68010-convergent-sysv
+	;;
     mc68k:UNIX:SYSTEM5:3.51m)
-	echo m68k-convergent-sysv
-	exit ;;
+	GUESS=m68k-convergent-sysv
+	;;
     M680?0:D-NIX:5.3:*)
-	echo m68k-diab-dnix
-	exit ;;
+	GUESS=m68k-diab-dnix
+	;;
     M68*:*:R3V5678*:*)
 	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
     3345??:*:4.0:3.0 | 334??A:*:4.0:3.0 | 334??,*:*:4.0:3.0 | 334??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
 	OS_REL=''
 	test -r /etc/.relid \
-	&& OS_REL=.$(sed -n 's/^ * ^ * $0-90-9$.*/\1/p' < /etc/.relid)
+	&& OS_REL=.`sed -n 's/^ * ^ * $0-90-9$.*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
 	  && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
@@ -1238,7 +1282,7 @@
     NCR*:*:4.2:* | MPRAS*:*:4.2:*)
 	OS_REL='.3'
 	test -r /etc/.relid \
-	    && OS_REL=.$(sed -n 's/^ * ^ * $0-90-9$.*/\1/p' < /etc/.relid)
+	    && OS_REL=.`sed -n 's/^ * ^ * $0-90-9$.*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
 	    && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
@@ -1246,118 +1290,118 @@
 	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
 	    && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
-	echo m68k-unknown-lynxos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-unknown-lynxos$UNAME_RELEASE
+	;;
     mc68030:UNIX_System_V:4.*:*)
-	echo m68k-atari-sysv4
-	exit ;;
+	GUESS=m68k-atari-sysv4
+	;;
     TSUNAMI:LynxOS:2.*:*)
-	echo sparc-unknown-lynxos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sparc-unknown-lynxos$UNAME_RELEASE
+	;;
     rs6000:LynxOS:2.*:*)
-	echo rs6000-unknown-lynxos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=rs6000-unknown-lynxos$UNAME_RELEASE
+	;;
     PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.01*:* | PowerPC:LynxOS:4.02*:*)
-	echo powerpc-unknown-lynxos"$UNAME_RELEASE"
-	exit ;;
+	GUESS=powerpc-unknown-lynxos$UNAME_RELEASE
+	;;
     SMBES:UNIX_SV:*:*)
-	echo mips-dde-sysv"$UNAME_RELEASE"
-	exit ;;
+	GUESS=mips-dde-sysv$UNAME_RELEASE
+	;;
     RM*:ReliantUNIX-*:*:*)
-	echo mips-sni-sysv4
-	exit ;;
+	GUESS=mips-sni-sysv4
+	;;
     RM*:SINIX-*:*:*)
-	echo mips-sni-sysv4
-	exit ;;
+	GUESS=mips-sni-sysv4
+	;;
     *:SINIX-*:*:*)
 	if uname -p 2>/dev/null >/dev/null ; then
-		UNAME_MACHINE=$( (uname -p) 2>/dev/null)
-		echo "$UNAME_MACHINE"-sni-sysv4
+		UNAME_MACHINE=`(uname -p) 2>/dev/null`
+		GUESS=$UNAME_MACHINE-sni-sysv4
 	else
-		echo ns32k-sni-sysv
+		GUESS=ns32k-sni-sysv
 	fi
-	exit ;;
+	;;
     PENTIUM:*:4.0*:*)	# Unisys `ClearPath HMP IX 4000' SVR4/MP effort
 			# says <Richard.M.Bartel@ccMail.Census.GOV>
-	echo i586-unisys-sysv4
-	exit ;;
+	GUESS=i586-unisys-sysv4
+	;;
     *:UNIX_System_V:4*:FTX*)
 	# From Gerald Hewes <hewes@openmarket.com>.
 	# How about differentiating between stratus architectures? -djm
-	echo hppa1.1-stratus-sysv4
-	exit ;;
+	GUESS=hppa1.1-stratus-sysv4
+	;;
     *:*:*:FTX*)
 	# From seanf@swdc.stratus.com.
-	echo i860-stratus-sysv4
-	exit ;;
+	GUESS=i860-stratus-sysv4
+	;;
     i*86:VOS:*:*)
 	# From Paul.Green@stratus.com.
-	echo "$UNAME_MACHINE"-stratus-vos
-	exit ;;
+	GUESS=$UNAME_MACHINE-stratus-vos
+	;;
     *:VOS:*:*)
 	# From Paul.Green@stratus.com.
-	echo hppa1.1-stratus-vos
-	exit ;;
+	GUESS=hppa1.1-stratus-vos
+	;;
     mc68*:A/UX:*:*)
-	echo m68k-apple-aux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=m68k-apple-aux$UNAME_RELEASE
+	;;
     news*:NEWS-OS:6*:*)
-	echo mips-sony-newsos6
-	exit ;;
+	GUESS=mips-sony-newsos6
+	;;
     R34000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
 	if test -d /usr/nec; then
-		echo mips-nec-sysv"$UNAME_RELEASE"
+		GUESS=mips-nec-sysv$UNAME_RELEASE
 	else
-		echo mips-unknown-sysv"$UNAME_RELEASE"
+		GUESS=mips-unknown-sysv$UNAME_RELEASE
 	fi
-	exit ;;
+	;;
     BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
-	echo powerpc-be-beos
-	exit ;;
+	GUESS=powerpc-be-beos
+	;;
     BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
-	echo powerpc-apple-beos
-	exit ;;
+	GUESS=powerpc-apple-beos
+	;;
     BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
-	echo i586-pc-beos
-	exit ;;
+	GUESS=i586-pc-beos
+	;;
     BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
-	echo i586-pc-haiku
-	exit ;;
+	GUESS=i586-pc-haiku
+	;;
     x86_64:Haiku:*:*)
-	echo x86_64-unknown-haiku
-	exit ;;
+	GUESS=x86_64-unknown-haiku
+	;;
     SX-4:SUPER-UX:*:*)
-	echo sx4-nec-superux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sx4-nec-superux$UNAME_RELEASE
+	;;
     SX-5:SUPER-UX:*:*)
-	echo sx5-nec-superux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sx5-nec-superux$UNAME_RELEASE
+	;;
     SX-6:SUPER-UX:*:*)
-	echo sx6-nec-superux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sx6-nec-superux$UNAME_RELEASE
+	;;
     SX-7:SUPER-UX:*:*)
-	echo sx7-nec-superux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sx7-nec-superux$UNAME_RELEASE
+	;;
     SX-8:SUPER-UX:*:*)
-	echo sx8-nec-superux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sx8-nec-superux$UNAME_RELEASE
+	;;
     SX-8R:SUPER-UX:*:*)
-	echo sx8r-nec-superux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sx8r-nec-superux$UNAME_RELEASE
+	;;
     SX-ACE:SUPER-UX:*:*)
-	echo sxace-nec-superux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=sxace-nec-superux$UNAME_RELEASE
+	;;
     Power*:Rhapsody:*:*)
-	echo powerpc-apple-rhapsody"$UNAME_RELEASE"
-	exit ;;
+	GUESS=powerpc-apple-rhapsody$UNAME_RELEASE
+	;;
     *:Rhapsody:*:*)
-	echo "$UNAME_MACHINE"-apple-rhapsody"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-apple-rhapsody$UNAME_RELEASE
+	;;
     arm64:Darwin:*:*)
-	echo aarch64-apple-darwin"$UNAME_RELEASE"
-	exit ;;
+	GUESS=aarch64-apple-darwin$UNAME_RELEASE
+	;;
     *:Darwin:*:*)
-	UNAME_PROCESSOR=$(uname -p)
+	UNAME_PROCESSOR=`uname -p`
 	case $UNAME_PROCESSOR in
 	    unknown) UNAME_PROCESSOR=powerpc ;;
 	esac
@@ -1391,109 +1435,119 @@
 	    # uname -m returns i386 or x86_64
 	    UNAME_PROCESSOR=$UNAME_MACHINE
 	fi
-	echo "$UNAME_PROCESSOR"-apple-darwin"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_PROCESSOR-apple-darwin$UNAME_RELEASE
+	;;
     *:procnto*:*:* | *:QNX:0123456789*:*)
-	UNAME_PROCESSOR=$(uname -p)
+	UNAME_PROCESSOR=`uname -p`
 	if test "$UNAME_PROCESSOR" = x86; then
 		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
-	echo "$UNAME_PROCESSOR"-"$UNAME_MACHINE"-nto-qnx"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_PROCESSOR-$UNAME_MACHINE-nto-qnx$UNAME_RELEASE
+	;;
     *:QNX:*:4*)
-	echo i386-pc-qnx
-	exit ;;
+	GUESS=i386-pc-qnx
+	;;
     NEO-*:NONSTOP_KERNEL:*:*)
-	echo neo-tandem-nsk"$UNAME_RELEASE"
-	exit ;;
+	GUESS=neo-tandem-nsk$UNAME_RELEASE
+	;;
     NSE-*:NONSTOP_KERNEL:*:*)
-	echo nse-tandem-nsk"$UNAME_RELEASE"
-	exit ;;
+	GUESS=nse-tandem-nsk$UNAME_RELEASE
+	;;
     NSR-*:NONSTOP_KERNEL:*:*)
-	echo nsr-tandem-nsk"$UNAME_RELEASE"
-	exit ;;
+	GUESS=nsr-tandem-nsk$UNAME_RELEASE
+	;;
     NSV-*:NONSTOP_KERNEL:*:*)
-	echo nsv-tandem-nsk"$UNAME_RELEASE"
-	exit ;;
+	GUESS=nsv-tandem-nsk$UNAME_RELEASE
+	;;
     NSX-*:NONSTOP_KERNEL:*:*)
-	echo nsx-tandem-nsk"$UNAME_RELEASE"
-	exit ;;
+	GUESS=nsx-tandem-nsk$UNAME_RELEASE
+	;;
     *:NonStop-UX:*:*)
-	echo mips-compaq-nonstopux
-	exit ;;
+	GUESS=mips-compaq-nonstopux
+	;;
     BS2000:POSIX*:*:*)
-	echo bs2000-siemens-sysv
-	exit ;;
+	GUESS=bs2000-siemens-sysv
+	;;
     DS/*:UNIX_System_V:*:*)
-	echo "$UNAME_MACHINE"-"$UNAME_SYSTEM"-"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-$UNAME_SYSTEM-$UNAME_RELEASE
+	;;
     *:Plan9:*:*)
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
 	# operating systems.
-	# shellcheck disable=SC2154
-	if test "$cputype" = 386; then
+	if test "${cputype-}" = 386; then
 	    UNAME_MACHINE=i386
-	else
-	    UNAME_MACHINE="$cputype"
+	elif test "x${cputype-}" != x; then
+	    UNAME_MACHINE=$cputype
 	fi
-	echo "$UNAME_MACHINE"-unknown-plan9
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-plan9
+	;;
     *:TOPS-10:*:*)
-	echo pdp10-unknown-tops10
-	exit ;;
+	GUESS=pdp10-unknown-tops10
+	;;
     *:TENEX:*:*)
-	echo pdp10-unknown-tenex
-	exit ;;
+	GUESS=pdp10-unknown-tenex
+	;;
     KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
-	echo pdp10-dec-tops20
-	exit ;;
+	GUESS=pdp10-dec-tops20
+	;;
     XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
-	echo pdp10-xkl-tops20
-	exit ;;
+	GUESS=pdp10-xkl-tops20
+	;;
     *:TOPS-20:*:*)
-	echo pdp10-unknown-tops20
-	exit ;;
+	GUESS=pdp10-unknown-tops20
+	;;
     *:ITS:*:*)
-	echo pdp10-unknown-its
-	exit ;;
+	GUESS=pdp10-unknown-its
+	;;
     SEI:*:*:SEIUX)
-	echo mips-sei-seiux"$UNAME_RELEASE"
-	exit ;;
+	GUESS=mips-sei-seiux$UNAME_RELEASE
+	;;
     *:DragonFly:*:*)
-	echo "$UNAME_MACHINE"-unknown-dragonfly"$(echo "$UNAME_RELEASE"|sed -e 's/-(.*//')"
-	exit ;;
+	DRAGONFLY_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	GUESS=$UNAME_MACHINE-unknown-dragonfly$DRAGONFLY_REL
+	;;
     *:*VMS:*:*)
-	UNAME_MACHINE=$( (uname -p) 2>/dev/null)
-	case "$UNAME_MACHINE" in
-	    A*) echo alpha-dec-vms ; exit ;;
-	    I*) echo ia64-dec-vms ; exit ;;
-	    V*) echo vax-dec-vms ; exit ;;
+	UNAME_MACHINE=`(uname -p) 2>/dev/null`
+	case $UNAME_MACHINE in
+	    A*) GUESS=alpha-dec-vms ;;
+	    I*) GUESS=ia64-dec-vms ;;
+	    V*) GUESS=vax-dec-vms ;;
 	esac ;;
     *:XENIX:*:SysV)
-	echo i386-pc-xenix
-	exit ;;
+	GUESS=i386-pc-xenix
+	;;
     i*86:skyos:*:*)
-	echo "$UNAME_MACHINE"-pc-skyos"$(echo "$UNAME_RELEASE" | sed -e 's/ .*$//')"
-	exit ;;
+	SKYOS_REL=`echo "$UNAME_RELEASE" | sed -e 's/ .*$//'`
+	GUESS=$UNAME_MACHINE-pc-skyos$SKYOS_REL
+	;;
     i*86:rdos:*:*)
-	echo "$UNAME_MACHINE"-pc-rdos
-	exit ;;
-    i*86:AROS:*:*)
-	echo "$UNAME_MACHINE"-pc-aros
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-rdos
+	;;
+    i*86:Fiwix:*:*)
+	GUESS=$UNAME_MACHINE-pc-fiwix
+	;;
+    *:AROS:*:*)
+	GUESS=$UNAME_MACHINE-unknown-aros
+	;;
     x86_64:VMkernel:*:*)
-	echo "$UNAME_MACHINE"-unknown-esx
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-esx
+	;;
     amd64:Isilon\ OneFS:*:*)
-	echo x86_64-unknown-onefs
-	exit ;;
+	GUESS=x86_64-unknown-onefs
+	;;
     *:Unleashed:*:*)
-	echo "$UNAME_MACHINE"-unknown-unleashed"$UNAME_RELEASE"
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
+	;;
 esac
 
+# Do we have a guess based on uname results?
+if test "x$GUESS" != x; then
+    echo "$GUESS"
+    exit
+fi
+
 # No uname command or uname output not recognized.
 set_cc_for_build
 cat > "$dummy.c" <<EOF
@@ -1533,7 +1587,7 @@
 #define __ARCHITECTURE__ "m68k"
 #endif
   int version;
-  version=$( (hostinfo | sed -n 's/.*NeXT Mach $0-9*$.*/\1/p') 2>/dev/null);
+  version=`(hostinfo | sed -n 's/.*NeXT Mach $0-9*$.*/\1/p') 2>/dev/null`;
   if (version < 4)
     printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
   else
@@ -1625,7 +1679,7 @@
 }
 EOF
 
-$CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null && SYSTEM_NAME=$($dummy) &&
+$CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null && SYSTEM_NAME=`"$dummy"` &&
 	{ echo "$SYSTEM_NAME"; exit; }
 
 # Apollos put the system type in the environment.
@@ -1633,7 +1687,7 @@
 
 echo "$0: unable to guess system type" >&2
 
-case "$UNAME_MACHINE:$UNAME_SYSTEM" in
+case $UNAME_MACHINE:$UNAME_SYSTEM in
     mips:Linux | mips64:Linux)
 	# If we got here on MIPS GNU/Linux, output extra information.
 	cat >&2 <<EOF
@@ -1655,9 +1709,11 @@
   https://git.savannah.gnu.org/cgit/config.git/plain/config.sub
 EOF
 
-year=$(echo $timestamp | sed 's,-.*,,')
+our_year=`echo $timestamp | sed 's,-.*,,'`
+thisyear=`date +%Y`
 # shellcheck disable=SC2003
-if test "$(expr "$(date +%Y)" - "$year")" -lt 3 ; then
+script_age=`expr "$thisyear" - "$our_year"`
+if test "$script_age" -lt 3 ; then
    cat >&2 <<EOF
 
 If $0 has already been updated, send the following data and any
@@ -1666,20 +1722,20 @@
 
 config.guess timestamp = $timestamp
 
-uname -m = $( (uname -m) 2>/dev/null || echo unknown)
-uname -r = $( (uname -r) 2>/dev/null || echo unknown)
-uname -s = $( (uname -s) 2>/dev/null || echo unknown)
-uname -v = $( (uname -v) 2>/dev/null || echo unknown)
+uname -m = `(uname -m) 2>/dev/null || echo unknown`
+uname -r = `(uname -r) 2>/dev/null || echo unknown`
+uname -s = `(uname -s) 2>/dev/null || echo unknown`
+uname -v = `(uname -v) 2>/dev/null || echo unknown`
 
-/usr/bin/uname -p = $( (/usr/bin/uname -p) 2>/dev/null)
-/bin/uname -X     = $( (/bin/uname -X) 2>/dev/null)
+/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null`
+/bin/uname -X     = `(/bin/uname -X) 2>/dev/null`
 
-hostinfo               = $( (hostinfo) 2>/dev/null)
-/bin/universe          = $( (/bin/universe) 2>/dev/null)
-/usr/bin/arch -k       = $( (/usr/bin/arch -k) 2>/dev/null)
-/bin/arch              = $( (/bin/arch) 2>/dev/null)
-/usr/bin/oslevel       = $( (/usr/bin/oslevel) 2>/dev/null)
-/usr/convex/getsysinfo = $( (/usr/convex/getsysinfo) 2>/dev/null)
+hostinfo               = `(hostinfo) 2>/dev/null`
+/bin/universe          = `(/bin/universe) 2>/dev/null`
+/usr/bin/arch -k       = `(/usr/bin/arch -k) 2>/dev/null`
+/bin/arch              = `(/bin/arch) 2>/dev/null`
+/usr/bin/oslevel       = `(/usr/bin/oslevel) 2>/dev/null`
+/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`
 
 UNAME_MACHINE = "$UNAME_MACHINE"
 UNAME_RELEASE = "$UNAME_RELEASE"

_service:tar_scm:krb5-1.19.2.tar.gz/src/config/config.sub -> _service:tar_scm:krb5-1.20.1.tar.gz/src/config/config.sub Changed

@@ -1,12 +1,14 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2020 Free Software Foundation, Inc.
+#   Copyright 1992-2022 Free Software Foundation, Inc.
 
-timestamp='2020-11-19'
+# shellcheck disable=SC2006,SC2268 # see below for rationale
+
+timestamp='2022-01-03'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
+# the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -50,7 +52,14 @@
 #	CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM
 # It is wrong to echo any other type of specification.
 
-me=$(echo "$0" | sed -e 's,.*/,,')
+# The "shellcheck disable" line above the timestamp inhibits complaints
+# about features and limitations of the classic Bourne shell that were
+# superseded or lifted in POSIX.  However, this script identifies a wide
+# variety of pre-POSIX systems that do not have POSIX shells at all, and
+# even some reasonably current systems (Solaris 10 as case-in-point) still
+# have a pre-POSIX /bin/sh.
+
+me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
 Usage: $0 OPTION CPU-MFR-OPSYS or ALIAS
@@ -67,7 +76,7 @@
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2020 Free Software Foundation, Inc.
+Copyright 1992-2022 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -112,9 +121,11 @@
 
 # Split fields of configuration type
 # shellcheck disable=SC2162
+saved_IFS=$IFS
 IFS="-" read field1 field2 field3 field4 <<EOF
 $1
 EOF
+IFS=$saved_IFS
 
 # Separate into logical components for further validation
 case $1 in
@@ -163,6 +174,10 @@
 						basic_machine=$field1
 						basic_os=$field2
 						;;
+					zephyr*)
+						basic_machine=$field1-unknown
+						basic_os=$field2
+						;;
 					# Manufacturers
 					dec* | mips* | sequent* | encore* | pc533* | sgi* | sony* \
 					| att* | 7300* | 3300* | delta* | motorola* | sun234* \
@@ -769,22 +784,22 @@
 		vendor=hp
 		;;
 	i*86v32)
-		cpu=$(echo "$1" | sed -e 's/86.*/86/')
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
 		vendor=pc
 		basic_os=sysv32
 		;;
 	i*86v4*)
-		cpu=$(echo "$1" | sed -e 's/86.*/86/')
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
 		vendor=pc
 		basic_os=sysv4
 		;;
 	i*86v)
-		cpu=$(echo "$1" | sed -e 's/86.*/86/')
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
 		vendor=pc
 		basic_os=sysv
 		;;
 	i*86sol2)
-		cpu=$(echo "$1" | sed -e 's/86.*/86/')
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
 		vendor=pc
 		basic_os=solaris2
 		;;
@@ -917,14 +932,16 @@
 		;;
 	leon-*|leon3-9-*)
 		cpu=sparc
-		vendor=$(echo "$basic_machine" | sed 's/-.*//')
+		vendor=`echo "$basic_machine" | sed 's/-.*//'`
 		;;
 
 	*-*)
 		# shellcheck disable=SC2162
+		saved_IFS=$IFS
 		IFS="-" read cpu vendor <<EOF
 $basic_machine
 EOF
+		IFS=$saved_IFS
 		;;
 	# We use `pc' rather than `unknown'
 	# because (1) that's what they normally are, and
@@ -1003,6 +1020,11 @@
 		;;
 
 	# Here we normalize CPU types with a missing or matching vendor
+	armh-unknown | armh-alt)
+		cpu=armv7l
+		vendor=alt
+		basic_os=${basic_os:-linux-gnueabihf}
+		;;
 	dpx20-unknown | dpx20-bull)
 		cpu=rs6000
 		vendor=bull
@@ -1084,7 +1106,7 @@
 		cpu=mipsisa64sb1el
 		;;
 	sh5elb-*)
-		cpu=$(echo "$cpu" | sed 's/^$sh.$e$.$$/\1\2e/')
+		cpu=`echo "$cpu" | sed 's/^$sh.$e$.$$/\1\2e/'`
 		;;
 	spur-*)
 		cpu=spur
@@ -1102,9 +1124,9 @@
 		cpu=x86_64
 		;;
 	xscale-* | xscaleebl-*)
-		cpu=$(echo "$cpu" | sed 's/^xscale/arm/')
+		cpu=`echo "$cpu" | sed 's/^xscale/arm/'`
 		;;
-	arm64-*)
+	arm64-* | aarch64le-*)
 		cpu=aarch64
 		;;
 
@@ -1165,7 +1187,7 @@
 			| alphapca567 | alpha64pca567 \
 			| am33_2.0 \
 			| amdgcn \
-			| arc | arceb \
+			| arc | arceb | arc32 | arc64 \
 			| arm | armlbe | armelb | armv* \
 			| avr | avr32 \
 			| asmjs \
@@ -1185,6 +1207,7 @@
 			| k1om \
 			| le32 | le64 \
 			| lm32 \
+			| loongarch32 | loongarch64 | loongarchx32 \
 			| m32c | m32r | m32rle \
 			| m5200 | m68000 | m6800123460 | m68360 | m683?2 | m68k \
 			| m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \
@@ -1203,9 +1226,13 @@
 			| mips64vr5900 | mips64vr5900el \
 			| mipsisa32 | mipsisa32el \
 			| mipsisa32r2 | mipsisa32r2el \
+			| mipsisa32r3 | mipsisa32r3el \
+			| mipsisa32r5 | mipsisa32r5el \
 			| mipsisa32r6 | mipsisa32r6el \
 			| mipsisa64 | mipsisa64el \
 			| mipsisa64r2 | mipsisa64r2el \
+			| mipsisa64r3 | mipsisa64r3el \
+			| mipsisa64r5 | mipsisa64r5el \
 			| mipsisa64r6 | mipsisa64r6el \
 			| mipsisa64sb1 | mipsisa64sb1el \
 			| mipsisa64sr71k | mipsisa64sr71kel \
@@ -1229,7 +1256,7 @@
 			| powerpc | powerpc64 | powerpc64le | powerpcle | powerpcspe \
 			| pru \
 			| pyramid \
-			| riscv | riscv32 | riscv64 \
+			| riscv | riscv32 | riscv32be | riscv64 | riscv64be \
 			| rl78 | romp | rs6000 | rx \
 			| s390 | s390x \
 			| score \
@@ -1241,6 +1268,7 @@
 			| sparcv8 | sparcv9 | sparcv9b | sparcv9v | sv1 | sx* \
 			| spu \
 			| tahoe \
+			| thumbv7* \
 			| tic30 | tic4x | tic54x | tic55x | tic6x | tic80 \
 			| tron \
 			| ubicom32 \
@@ -1281,35 +1309,37 @@
 if test x$basic_os != x
 then
 
-# First recognize some ad-hoc caes, or perhaps split kernel-os, or else just
+# First recognize some ad-hoc cases, or perhaps split kernel-os, or else just
 # set os.
 case $basic_os in
 	gnu/linux*)
 		kernel=linux
-		os=$(echo $basic_os | sed -e 's|gnu/linux|gnu|')
+		os=`echo "$basic_os" | sed -e 's|gnu/linux|gnu|'`
 		;;
 	os2-emx)
 		kernel=os2
-		os=$(echo $basic_os | sed -e 's|os2-emx|emx|')
+		os=`echo "$basic_os" | sed -e 's|os2-emx|emx|'`
 		;;
 	nto-qnx*)
 		kernel=nto
-		os=$(echo $basic_os | sed -e 's|nto-qnx|qnx|')
+		os=`echo "$basic_os" | sed -e 's|nto-qnx|qnx|'`
 		;;
 	*-*)
 		# shellcheck disable=SC2162
+		saved_IFS=$IFS
 		IFS="-" read kernel os <<EOF
 $basic_os
 EOF
+		IFS=$saved_IFS
 		;;
 	# Default OS when just kernel was specified
 	nto*)
 		kernel=nto
-		os=$(echo $basic_os | sed -e 's|nto|qnx|')
+		os=`echo "$basic_os" | sed -e 's|nto|qnx|'`
 		;;
 	linux*)
 		kernel=linux
-		os=$(echo $basic_os | sed -e 's|linux|gnu|')
+		os=`echo "$basic_os" | sed -e 's|linux|gnu|'`
 		;;
 	*)
 		kernel=
@@ -1330,7 +1360,7 @@
 		os=cnk
 		;;
 	solaris1 | solaris1.*)
-		os=$(echo $os | sed -e 's|solaris1|sunos4|')
+		os=`echo "$os" | sed -e 's|solaris1|sunos4|'`
 		;;
 	solaris)
 		os=solaris2
@@ -1359,7 +1389,7 @@
 		os=sco3.2v4
 		;;
 	sco3.2.4-9*)
-		os=$(echo $os | sed -e 's/sco3.2./sco3.2v/')
+		os=`echo "$os" | sed -e 's/sco3.2./sco3.2v/'`
 		;;
 	sco*v* | scout)
 		# Don't match below
@@ -1389,7 +1419,7 @@
 		os=lynxos
 		;;
 	mac0-9*)
-		os=$(echo "$os" | sed -e 's|mac|macos|')
+		os=`echo "$os" | sed -e 's|mac|macos|'`
 		;;
 	opened*)
 		os=openedition
@@ -1398,10 +1428,10 @@
 		os=os400
 		;;
 	sunos5*)
-		os=$(echo "$os" | sed -e 's|sunos5|solaris2|')
+		os=`echo "$os" | sed -e 's|sunos5|solaris2|'`
 		;;
 	sunos6*)
-		os=$(echo "$os" | sed -e 's|sunos6|solaris3|')
+		os=`echo "$os" | sed -e 's|sunos6|solaris3|'`
 		;;
 	wince*)
 		os=wince
@@ -1435,7 +1465,7 @@
 		;;
 	# Preserve the version number of sinix5.
 	sinix5.*)
-		os=$(echo $os | sed -e 's|sinix|sysv|')
+		os=`echo "$os" | sed -e 's|sinix|sysv|'`
 		;;
 	sinix*)
 		os=sysv4
@@ -1681,11 +1711,14 @@
 
 # Now, validate our (potentially fixed-up) OS.
 case $os in
-	# Sometimes we do "kernel-abi", so those need to count as OSes.
-	musl* | newlib* | uclibc*)
+	# Sometimes we do "kernel-libc", so those need to count as OSes.
+	musl* | newlib* | relibc* | uclibc*)
+		;;
+	# Likewise for "kernel-abi"
+	eabi* | gnueabi*)
 		;;
-	# Likewise for "kernel-libc"
-	eabi | eabihf | gnueabi | gnueabihf)
+	# VxWorks passes extra cpu info in the 4th filed.
+	simlinux | simwindows | spe)
 		;;
 	# Now accept the basic system types.
 	# The portable systems comes first.
@@ -1702,12 +1735,12 @@
 	     | nindy* | vxsim* | vxworks* | ebmon* | hms* | mvs* \
 	     | clix* | riscos* | uniplus* | iris* | isc* | rtu* | xenix* \
 	     | mirbsd* | netbsd* | dicos* | openedition* | ose* \
-	     | bitrig* | openbsd* | solidbsd* | libertybsd* | os108* \
+	     | bitrig* | openbsd* | secbsd* | solidbsd* | libertybsd* | os108* \
 	     | ekkobsd* | freebsd* | riscix* | lynxos* | os400* \
 	     | bosx* | nextstep* | cxux* | aout* | elf* | oabi* \
 	     | ptx* | coff* | ecoff* | winnt* | domain* | vsta* \
 	     | udi* | lites* | ieee* | go32* | aux* | hcos* \
-	     | chorusrdb* | cegcc* | glidix* \
+	     | chorusrdb* | cegcc* | glidix* | serenity* \
 	     | cygwin* | msys* | pe* | moss* | proelf* | rtems* \
 	     | midipix* | mingw32* | mingw64* | mint* \
 	     | uxpv* | beos* | mpeix* | udk* | moxiebox* \
@@ -1720,7 +1753,8 @@
 	     | skyos* | haiku* | rdos* | toppers* | drops* | es* \
 	     | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \
 	     | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \
-	     | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx*)
+	     | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \
+	     | fiwix* )
 		;;
 	# This one is extra strict with allowed versions
 	sco3.2v2 | sco3.2v4-9* | sco5v6*)
@@ -1737,11 +1771,12 @@
 # As a final step for OS-related things, validate the OS-kernel combination
 # (given a valid OS), if there is a kernel.
 case $kernel-$os in
-	linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* | linux-musl* | linux-uclibc* )
+	linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* \
+		   | linux-musl* | linux-relibc* | linux-uclibc* )
 		;;
 	uclinux-uclibc* )
 		;;
-	-dietlibc* | -newlib* | -musl* | -uclibc* )
+	-dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* )
 		# These are just libc implementations, not actual OSes, and thus
 		# require a kernel.
 		echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2
@@ -1749,6 +1784,8 @@
 		;;
 	kfreebsd*-gnu* | kopensolaris*-gnu*)
 		;;
+	vxworks-simlinux | vxworks-simwindows | vxworks-spe)
+		;;
 	nto-qnx*)
 		;;
 	os2-emx)

_service:tar_scm:krb5-1.19.2.tar.gz/src/config/lib.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/config/lib.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/config/pre.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/config/pre.in Changed

@@ -228,35 +228,11 @@
 	$(KRB5_INCDIR)/gssapi \
 	$(KRB5_INCDIR)/gssrpc
 
-#
-# Macros used by the KADM5 (OV-based) unit test system.
-# XXX check which of these are actually used!
-#
 SKIPTESTS	= $(BUILDTOP)/skiptests
-TESTDIR		= $(BUILDTOP)/kadmin/testing
-STESTDIR	= $(top_srcdir)/kadmin/testing
-ENV_SETUP	= $(TESTDIR)/scripts/env-setup.sh
-CLNTTCL		= $(TESTDIR)/util/kadm5_clnt_tcl
-SRVTCL		= $(TESTDIR)/util/kadm5_srv_tcl
-# Dejagnu variables.
-# We have to set the host with --host so that setup_xfail will work.
-# If we don't set it, then the host type used is "native", which
-# doesn't match "*-*-*".
-host=@krb5_cv_host@
-DEJAFLAGS	= --debug --srcdir $(srcdir) --host $(host)
-RUNTEST		= runtest $(DEJAFLAGS)
 
 RUNPYTEST	= PYTHONPATH=$(top_srcdir)/util VALGRIND="$(VALGRIND)" \
 			$(PYTHON)
 
-START_SERVERS	= $(STESTDIR)/scripts/start_servers $(TEST_SERVER) $(TEST_PATH)
-START_SERVERS_LOCAL = $(STESTDIR)/scripts/start_servers_local
-
-STOP_SERVERS	= $(STESTDIR)/scripts/stop_servers $(TEST_SERVER) $(TEST_PATH)
-STOP_SERVERS_LOCAL = $(STESTDIR)/scripts/stop_servers_local
-#
-# End of macros for the KADM5 unit test system.
-#
 
 transform = @program_transform_name@
 
@@ -427,17 +403,9 @@
 RUN_TEST=$(RUN_SETUP) KRB5_CONFIG=$(top_srcdir)/config-files/krb5.conf \
     LC_ALL=C $(VALGRIND)
 
-#
-# variables for --with-tcl=
-TCL_LIBS	= @TCL_LIBS@
-TCL_LIBPATH	= @TCL_LIBPATH@
-TCL_RPATH	= @TCL_RPATH@
-TCL_MAYBE_RPATH = @TCL_MAYBE_RPATH@
-TCL_INCLUDES	= @TCL_INCLUDES@
-
-# Crypto and PRNG back-end selections
-CRYPTO_IMPL	= @CRYPTO_IMPL@
-PRNG_ALG	= @PRNG_ALG@
+# libk5crypto dependencies
+CRYPTO_IMPL_CFLAGS	= @CRYPTO_IMPL_CFLAGS@
+CRYPTO_IMPL_LIBS	= @CRYPTO_IMPL_LIBS@
 
 # TLS implementation selection
 TLS_IMPL	= @TLS_IMPL@

_service:tar_scm:krb5-1.19.2.tar.gz/src/config/win-pre.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/config/win-pre.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/configure -> _service:tar_scm:krb5-1.20.1.tar.gz/src/configure Changed

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for Kerberos 5 1.19.2.
+# Generated by GNU Autoconf 2.69 for Kerberos 5 1.20.1.
 #
 # Report bugs to <krb5-bugs@mit.edu>.
 #
@@ -584,8 +584,8 @@
 # Identity of this package.
 PACKAGE_NAME='Kerberos 5'
 PACKAGE_TARNAME='krb5'
-PACKAGE_VERSION='1.19.2'
-PACKAGE_STRING='Kerberos 5 1.19.2'
+PACKAGE_VERSION='1.20.1'
+PACKAGE_STRING='Kerberos 5 1.20.1'
 PACKAGE_BUGREPORT='krb5-bugs@mit.edu'
 PACKAGE_URL=''
 
@@ -655,7 +655,6 @@
 HAVE_PYTHON
 PYTHON
 PYTHON_MINVERSION
-HAVE_RUNTEST
 LIBOBJS
 PKINIT
 GSSRPC__BSD_TYPEALIASES
@@ -666,15 +665,7 @@
 GSSRPC__SYS_SELECT_H
 rpcent_define
 include_xom
-RUNTEST
 PRIOCNTL_HACK
-DO_ALL
-EXPECT
-S_TOP
-RBUILD
-DO_TEST
-have_PERL
-have_RUNTEST
 YFLAGS
 YACC
 NSLOOKUP
@@ -683,7 +674,6 @@
 BASH
 SH5
 SH
-DO_TCL
 KRB5_RCTMPDIR
 SIZEOF_TIME_T
 SETENVOBJ
@@ -693,9 +683,6 @@
 GETTIMEOFDAY_OBJ
 MKSTEMP_ST_OBJ
 MKSTEMP_OBJ
-LEXLIB
-LEX_OUTPUT_ROOT
-LEX
 ASAN
 ASAN_FLAGS
 KRB5_RUN_VARS
@@ -708,10 +695,9 @@
 TLS_IMPL_LIBS
 TLS_IMPL_CFLAGS
 TLS_IMPL
-PRNG_ALG
+CRYPTO_BUILTIN_TESTS
 CRYPTO_IMPL_LIBS
 CRYPTO_IMPL_CFLAGS
-CRYPTO_IMPL
 audit_plugin
 AUDIT_IMPL_LIBS
 AWK
@@ -773,11 +759,6 @@
 SHOBJEXT
 STOBJEXT
 OBJLISTS
-TCL_MAYBE_RPATH
-TCL_RPATH
-TCL_LIBPATH
-TCL_LIBS
-TCL_INCLUDES
 KRB5_VERSION
 DL_LIB
 THREAD_SUPPORT
@@ -896,13 +877,11 @@
 enable_shared
 enable_rpath
 enable_profiled
-with_tcl
 enable_athena
 enable_nls
 with_vague_errors
 enable_audit_plugin
 with_crypto_impl
-with_prng_alg
 with_tls_impl
 with_keyutils
 with_spake_openssl
@@ -1496,7 +1475,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Kerberos 5 1.19.2 to adapt to many kinds of systems.
+\`configure' configures Kerberos 5 1.20.1 to adapt to many kinds of systems.
 
 Usage: $0 OPTION... VAR=VALUE...
 
@@ -1567,7 +1546,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Kerberos 5 1.19.2:";;
+     short | recursive ) echo "Configuration of Kerberos 5 1.20.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1607,10 +1586,8 @@
   --with-netlib=LIBS      use user defined resolver library
   --with-hesiod=path      compile with hesiod support omitted
   --with-ldap             compile OpenLDAP database backend module
-  --with-tcl=path         where Tcl resides
   --with-vague-errors     Do not do send helpful errors to client
   --with-crypto-impl=IMPL use specified crypto implementation builtin
-  --with-prng-alg=ALG     use specified PRNG algorithm. fortuna
   --with-tls-impl=IMPL    use specified TLS implementation auto
   --without-keyutils      do not link with libkeyutils
   --with-spake-openssl    use OpenSSL for SPAKE preauth auto
@@ -1727,7 +1704,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Kerberos 5 configure 1.19.2
+Kerberos 5 configure 1.20.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2478,7 +2455,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Kerberos 5 $as_me 1.19.2, which was
+It was created by Kerberos 5 $as_me 1.20.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -4978,10 +4955,6 @@
       CFLAGS="$CFLAGS -fno-common"
       ;;
     esac
-    case "$LD $LDFLAGS" in
-    *-Wl,-search_paths_first*) ;;
-    *) LDFLAGS="${LDFLAGS} -Wl,-search_paths_first" ;;
-    esac
   fi
 else
   if test "`uname -s`" = AIX ; then
@@ -5286,13 +5259,13 @@
 int
 main ()
 {
- &et_foo_error_table;
+&et_foo_error_table;
   ;
   return 0;
 }
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
-  :
+
 else
   as_fn_error $? "cannot use et_foo_error_table" "$LINENO" 5
 fi
@@ -5358,22 +5331,20 @@
 if ${krb5_cv_system_ss_okay+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-
   if test "$cross_compiling" = yes; then :
-  krb5_cv_system_ss_okay="assumed"
+  krb5_cv_system_ss_okay=assumed
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-
 #include <ss/ss.h>
-int main(int argc, char *argv) {
-  if (argc == 42) {
-    int i, err;
-    i = ss_create_invocation("foo","foo","",0,&err);
-    ss_listen(i);
-  }
-  return 0;
-}
+        int main(int argc, char *argv) {
+            if (argc == 42) {
+                int i, err;
+                i = ss_create_invocation("foo","foo","",0,&err);
+                ss_listen(i);
+            }
+            return 0;
+        }
 _ACEOF
 if ac_fn_c_try_run "$LINENO"; then :
   krb5_cv_system_ss_okay=yes
@@ -5402,10 +5373,9 @@
 main ()
 {
 #undef ss_execute_command
-struct k5foo {int foo; } xx;
-extern int ss_execute_command (struct k5foo*);
-ss_execute_command(&xx);
-
+      struct k5foo {int foo; } xx;
+      extern int ss_execute_command (struct k5foo*);
+      ss_execute_command(&xx);
   ;
   return 0;
 }
@@ -5932,16 +5902,17 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/types.h>
-#include <netinet/in.h>
-#include <arpa/nameser.h>
-#include <resolv.h>
+      #include <netinet/in.h>
+      #include <arpa/nameser.h>
+      #include <resolv.h>
+
 int
 main ()
 {
 /*
- * Use volatile, or else optimization can cause false positives.
- */
-void (* volatile p)() = (void (*)())$krb5_func;
+       * Use volatile, or else optimization can cause false positives.
+       */
+      void (* volatile p)() = (void (*)())$krb5_func;
   ;
   return 0;
 }
@@ -6083,7 +6054,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #pragma weak flurbl
-extern int flurbl(void);
+      extern int flurbl(void);
 int
 main ()
 {
@@ -6168,15 +6139,15 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <unistd.h>
-void foo1() __attribute__((constructor));
-void foo1() { unlink("conftest.1"); }
-void foo2() __attribute__((destructor));
-void foo2() { unlink("conftest.2"); }
-int main () { return 0; }
+      void foo1() __attribute__((constructor));
+      void foo1() { unlink("conftest.1"); }
+      void foo2() __attribute__((destructor));
+      void foo2() { unlink("conftest.2"); }
+      int main () { return 0; }
 _ACEOF
 if ac_fn_c_try_run "$LINENO"; then :
   test -r conftest.1 || a=yes
-test -r conftest.2 || b=yes
+     test -r conftest.2 || b=yes
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
   conftest.$ac_objext conftest.beam conftest.$ac_ext
@@ -7072,7 +7043,7 @@
 
 
 
-KRB5_VERSION=1.19.2
+KRB5_VERSION=1.20.1
 
 
 
@@ -7589,423 +7560,6 @@
 fi
 fi
 
-
-TCL_INCLUDES=
-TCL_LIBPATH=
-TCL_RPATH=
-TCL_LIBS=
-TCL_WITH=
-tcl_dir=
-
-# Check whether --with-tcl was given.
-if test "${with_tcl+set}" = set; then :
-  withval=$with_tcl;
-else
-  with_tcl=try
-fi
-
-if test "$with_tcl" = no ; then
-  true
-elif test "$with_tcl" = yes -o "$with_tcl" = try ; then
-  tcl_dir=/usr
-  if test ! -r /usr/lib/tclConfig.sh; then
-    cat >> conftest <<\EOF
-puts "tcl_dir=$tcl_library"
-EOF
-    if tclsh conftest >conftest.out 2>/dev/null; then
-      if grep tcl_dir= conftest.out >/dev/null 2>&1; then
-        t=`sed s/tcl_dir=// conftest.out`
-        tcl_dir=$t
-      fi
-    fi # tclsh ran script okay
-  rm -f conftest conftest.out
-  fi # no /usr/lib/tclConfig.sh
-else
-  tcl_dir=$with_tcl
-fi
-if test "$with_tcl" != no ; then
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for tclConfig.sh" >&5
-$as_echo_n "checking for tclConfig.sh... " >&6; }
-if test -r "$tcl_dir/lib/tclConfig.sh" ; then
-  tcl_conf="$tcl_dir/lib/tclConfig.sh"
-elif test -r "$tcl_dir/tclConfig.sh" ; then
-  tcl_conf="$tcl_dir/tclConfig.sh"
-elif test -r "$tcl_dir/../tclConfig.sh" ; then
-  tcl_conf="$tcl_dir/../tclConfig.sh"
-else
-  tcl_conf=
-  lib="$tcl_dir/lib"
-    for d in "$lib" "$lib"/tcl7.0-9 "$lib"/tcl8.0-9 ; do
-    if test -r "$d/tclConfig.sh" ; then
-      tcl_conf="$tcl_conf $d/tclConfig.sh"
-    fi
-  done
-  fi
-if test -n "$tcl_conf" ; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $tcl_conf" >&5
-$as_echo "$tcl_conf" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
-fi
-tcl_ok_conf=
-tcl_vers_maj=
-tcl_vers_min=
-old_CPPFLAGS=$CPPFLAGS
-old_LIBS=$LIBS
-old_LDFLAGS=$LDFLAGS
-if test -n "$tcl_conf" ; then
-  for file in $tcl_conf ; do
-    TCL_MAJOR_VERSION=x ; TCL_MINOR_VERSION=x
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking Tcl info in $file" >&5
-$as_echo_n "checking Tcl info in $file... " >&6; }
-    . $file
-    v=$TCL_MAJOR_VERSION.$TCL_MINOR_VERSION
-    if test -z "$tcl_vers_maj" \
-	|| test "$tcl_vers_maj" -lt "$TCL_MAJOR_VERSION" \
-	|| test "$tcl_vers_maj" = "$TCL_MAJOR_VERSION" -a "$tcl_vers_min" -lt "$TCL_MINOR_VERSION" ; then
-      for incdir in "$TCL_PREFIX/include/tcl$v" "$TCL_PREFIX/include" ; do
-	if test -r "$incdir/tcl.h" -o -r "$incdir/tcl/tcl.h" ; then
-	  CPPFLAGS="$old_CPPFLAGS -I$incdir"
-	  break
-	fi
-      done
-      LIBS="$old_LIBS `eval echo x $TCL_LIB_SPEC $TCL_LIBS | sed 's/^x//'`"
-      LDFLAGS="$old_LDFLAGS $TCL_LD_FLAGS"
-      cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <tcl.h>
-int
-main ()
-{
-Tcl_CreateInterp ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  tcl_ok_conf=$file
-	tcl_vers_maj=$TCL_MAJOR_VERSION
-	tcl_vers_min=$TCL_MINOR_VERSION
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $v - working" >&5
-$as_echo "$v - working" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $v - compilation failed" >&5
-$as_echo "$v - compilation failed" >&6; }
-
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-    else
-      { $as_echo "$as_me:${as_lineno-$LINENO}: result: older version $v" >&5
-$as_echo "older version $v" >&6; }
-    fi
-  done
-fi
-CPPFLAGS=$old_CPPFLAGS
-LIBS=$old_LIBS
-LDFLAGS=$old_LDFLAGS
-tcl_header=no
-tcl_lib=no
-if test -n "$tcl_ok_conf" ; then
-  . $tcl_ok_conf
-  TCL_INCLUDES=
-  for incdir in "$TCL_PREFIX/include/tcl$v" "$TCL_PREFIX/include" ; do
-    if test -r "$incdir/tcl.h" -o -r "$incdir/tcl/tcl.h" ; then
-      if test "$incdir" != "/usr/include" ; then
-        TCL_INCLUDES=-I$incdir
-      fi
-      break
-    fi
-  done
-  # Need eval because the first-level expansion could reference
-  # variables like ${TCL_DBGX}.
-  eval TCL_LIBS='"'$TCL_LIB_SPEC $TCL_LIBS $TCL_DL_LIBS'"'
-  TCL_LIBPATH="-L$TCL_EXEC_PREFIX/lib"
-  TCL_RPATH=":$TCL_EXEC_PREFIX/lib"
-  if test "$DEPLIBEXT" != "$SHLIBEXT" && test -n "$RPATH_FLAG"; then
-    TCL_MAYBE_RPATH='$(RPATH_FLAG)'"$TCL_EXEC_PREFIX/lib$RPATH_TAIL"
-  else
-    TCL_MAYBE_RPATH=
-  fi
-  CPPFLAGS="$old_CPPFLAGS $TCL_INCLUDES"
-  ac_fn_c_check_header_mongrel "$LINENO" "tcl.h" "ac_cv_header_tcl_h" "$ac_includes_default"
-if test "x$ac_cv_header_tcl_h" = xyes; then :
-
-$as_echo "#define HAVE_TCL_H 1" >>confdefs.h
- tcl_header=yes
-fi
-
-
-  if test $tcl_header=no; then
-     ac_fn_c_check_header_mongrel "$LINENO" "tcl/tcl.h" "ac_cv_header_tcl_tcl_h" "$ac_includes_default"
-if test "x$ac_cv_header_tcl_tcl_h" = xyes; then :
-
-$as_echo "#define HAVE_TCL_TCL_H 1" >>confdefs.h
- tcl_header=yes
-fi
-
-
-  fi
-  CPPFLAGS="$old_CPPFLAGS"
-  tcl_lib=yes
-else
-  # If we read a tclConfig.sh file, it probably set this.
-  TCL_LIBS=
-fi
-
-
-
-
-
-
-  if test $tcl_lib = no ; then
-    if test "$with_tcl" != try ; then
-
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: trying old tcl search code" >&5
-$as_echo "$as_me: WARNING: trying old tcl search code" >&2;}
-if test "$with_tcl" != yes -a "$with_tcl" != no; then
-	TCL_INCLUDES=-I$with_tcl/include
-	TCL_LIBPATH=-L$with_tcl/lib
-	TCL_RPATH=:$with_tcl/lib
-fi
-if test "$with_tcl" != no ; then
-	krb5_save_CPPFLAGS="$CPPFLAGS"
-	krb5_save_LDFLAGS="$LDFLAGS"
-	CPPFLAGS="$CPPFLAGS $TCL_INCLUDES"
-	LDFLAGS="$LDFLAGS $TCL_LIBPATH"
-	tcl_header=no
-	ac_fn_c_check_header_mongrel "$LINENO" "tcl.h" "ac_cv_header_tcl_h" "$ac_includes_default"
-if test "x$ac_cv_header_tcl_h" = xyes; then :
-
-$as_echo "#define HAVE_TCL_H 1" >>confdefs.h
- tcl_header=yes
-fi
-
-
-	if test $tcl_header=no; then
-	   ac_fn_c_check_header_mongrel "$LINENO" "tcl/tcl.h" "ac_cv_header_tcl_tcl_h" "$ac_includes_default"
-if test "x$ac_cv_header_tcl_tcl_h" = xyes; then :
-
-$as_echo "#define HAVE_TCL_TCL_H 1" >>confdefs.h
- tcl_header=yes
-fi
-
-
-	fi
-
-	if test $tcl_header = yes ; then
-		tcl_lib=no
-
-		if test $tcl_lib = no; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Tcl_CreateCommand in -ltcl8.0" >&5
-$as_echo_n "checking for Tcl_CreateCommand in -ltcl8.0... " >&6; }
-if ${ac_cv_lib_tcl8_0_Tcl_CreateCommand+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-ltcl8.0 -lm $DL_LIB $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char Tcl_CreateCommand ();
-int
-main ()
-{
-return Tcl_CreateCommand ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_tcl8_0_Tcl_CreateCommand=yes
-else
-  ac_cv_lib_tcl8_0_Tcl_CreateCommand=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_tcl8_0_Tcl_CreateCommand" >&5
-$as_echo "$ac_cv_lib_tcl8_0_Tcl_CreateCommand" >&6; }
-if test "x$ac_cv_lib_tcl8_0_Tcl_CreateCommand" = xyes; then :
-  TCL_LIBS="$TCL_LIBS -ltcl8.0 -lm $DL_LIB $LIBS"
-				tcl_lib=yes
-fi
-
-		fi
-		if test $tcl_lib = no; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Tcl_CreateCommand in -ltcl7.6" >&5
-$as_echo_n "checking for Tcl_CreateCommand in -ltcl7.6... " >&6; }
-if ${ac_cv_lib_tcl7_6_Tcl_CreateCommand+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-ltcl7.6 -lm $DL_LIB $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char Tcl_CreateCommand ();
-int
-main ()
-{
-return Tcl_CreateCommand ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_tcl7_6_Tcl_CreateCommand=yes
-else
-  ac_cv_lib_tcl7_6_Tcl_CreateCommand=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_tcl7_6_Tcl_CreateCommand" >&5
-$as_echo "$ac_cv_lib_tcl7_6_Tcl_CreateCommand" >&6; }
-if test "x$ac_cv_lib_tcl7_6_Tcl_CreateCommand" = xyes; then :
-  TCL_LIBS="$TCL_LIBS -ltcl7.6 -lm $DL_LIB $LIBS"
-				tcl_lib=yes
-fi
-
-		fi
-		if test $tcl_lib = no; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Tcl_CreateCommand in -ltcl7.5" >&5
-$as_echo_n "checking for Tcl_CreateCommand in -ltcl7.5... " >&6; }
-if ${ac_cv_lib_tcl7_5_Tcl_CreateCommand+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-ltcl7.5 -lm $DL_LIB $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char Tcl_CreateCommand ();
-int
-main ()
-{
-return Tcl_CreateCommand ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_tcl7_5_Tcl_CreateCommand=yes
-else
-  ac_cv_lib_tcl7_5_Tcl_CreateCommand=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_tcl7_5_Tcl_CreateCommand" >&5
-$as_echo "$ac_cv_lib_tcl7_5_Tcl_CreateCommand" >&6; }
-if test "x$ac_cv_lib_tcl7_5_Tcl_CreateCommand" = xyes; then :
-  TCL_LIBS="$TCL_LIBS -ltcl7.5 -lm $DL_LIB $LIBS"
-				tcl_lib=yes
-fi
-
-
-		fi
-		if test $tcl_lib = no ; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Tcl_CreateCommand in -ltcl" >&5
-$as_echo_n "checking for Tcl_CreateCommand in -ltcl... " >&6; }
-if ${ac_cv_lib_tcl_Tcl_CreateCommand+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-ltcl -lm $DL_LIB $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char Tcl_CreateCommand ();
-int
-main ()
-{
-return Tcl_CreateCommand ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_tcl_Tcl_CreateCommand=yes
-else
-  ac_cv_lib_tcl_Tcl_CreateCommand=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_tcl_Tcl_CreateCommand" >&5
-$as_echo "$ac_cv_lib_tcl_Tcl_CreateCommand" >&6; }
-if test "x$ac_cv_lib_tcl_Tcl_CreateCommand" = xyes; then :
-  TCL_LIBS="$TCL_LIBS -ltcl -lm $DL_LIB $LIBS"
-				tcl_lib=yes
-fi
-
-
-		fi
-		if test $tcl_lib = no ; then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: \"tcl.h found but not library\"" >&5
-$as_echo "$as_me: WARNING: \"tcl.h found but not library\"" >&2;}
-		fi
-	else
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Could not find Tcl which is needed for the kadm5 tests" >&5
-$as_echo "$as_me: WARNING: Could not find Tcl which is needed for the kadm5 tests" >&2;}
-		TCL_LIBS=
-	fi
-	CPPFLAGS="$krb5_save_CPPFLAGS"
-	LDFLAGS="$krb5_save_LDFLAGS"
-
-
-
-
-else
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: \"Not looking for Tcl library\"" >&5
-$as_echo "\"Not looking for Tcl library\"" >&6; }
-fi
-
-    else
-      { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Could not find Tcl which is needed for some tests" >&5
-$as_echo "$as_me: WARNING: Could not find Tcl which is needed for some tests" >&2;}
-    fi
-  fi
-fi
-# If "yes" or pathname, error out if not found.
-if test "$with_tcl" != no -a "$with_tcl" != try ; then
-  if test "$tcl_header $tcl_lib" != "yes yes" ; then
-    as_fn_error $? "Could not find Tcl" "$LINENO" 5
-  fi
-fi
-
 # Check whether --enable-athena was given.
 if test "${enable_athena+set}" = set; then :
   enableval=$enable_athena;
@@ -8384,18 +7938,21 @@
 if ${ac_cv_func_regcomp+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-
-if test "$cross_compiling" = yes; then :
+  if test "$cross_compiling" = yes; then :
   as_fn_error $? "Cannot test regcomp when cross compiling" "$LINENO" 5
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-
 #include <sys/types.h>
-#include <regex.h>
-regex_t x; regmatch_t m;
-int main() { return regcomp(&x,"pat.*",0) || regexec(&x,"pattern",1,&m,0); }
-
+      #include <regex.h>
+      regex_t x; regmatch_t m;
+int
+main ()
+{
+return regcomp(&x,"pat.*",0) || regexec(&x,"pattern",1,&m,0);
+  ;
+  return 0;
+}
 _ACEOF
 if ac_fn_c_try_run "$LINENO"; then :
   ac_cv_func_regcomp=yes
@@ -8509,10 +8066,9 @@
 main ()
 {
 #undef daemon
-struct k5foo {int foo; } xx;
-extern int daemon (struct k5foo*);
-daemon(&xx);
-
+      struct k5foo {int foo; } xx;
+      extern int daemon (struct k5foo*);
+      daemon(&xx);
   ;
   return 0;
 }
@@ -8547,20 +8103,11 @@
 if eval \${krb5_cv_getsockname_proto_$krb5_lib_var+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/types.h>
-#include <sys/socket.h>
-extern int getsockname(int, $sock_arg1, $sock_arg2);
-
-int
-main ()
-{
-
-  ;
-  return 0;
-}
+      #include <sys/socket.h>
+      extern int getsockname(int, $sock_arg1, $sock_arg2);
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   eval "krb5_cv_getsockname_proto_$krb5_lib_var=yes"
@@ -8887,10 +8434,9 @@
 main ()
 {
 #undef vasprintf
-struct k5foo {int foo; } xx;
-extern int vasprintf (struct k5foo*);
-vasprintf(&xx);
-
+      struct k5foo {int foo; } xx;
+      extern int vasprintf (struct k5foo*);
+      vasprintf(&xx);
   ;
   return 0;
 }
@@ -8931,10 +8477,9 @@
 main ()
 {
 #undef swab
-struct k5foo {int foo; } xx;
-extern int swab (struct k5foo*);
-swab(&xx);
-
+      struct k5foo {int foo; } xx;
+      extern int swab (struct k5foo*);
+      swab(&xx);
   ;
   return 0;
 }
@@ -9058,15 +8603,14 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
+      #include <netdb.h>
+      #endif
+
 int
 main ()
 {
-
 struct addrinfo *ai;
-getaddrinfo("kerberos.mit.edu", "echo", 0, &ai);
-
+      getaddrinfo("kerberos.mit.edu", "echo", 0, &ai);
   ;
   return 0;
 }
@@ -9096,24 +8640,21 @@
 if test "$ac_cv_func_inet_ntop" != "yes" ; then
   krb5_cv_inet6=no
 else
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-
 #ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netdb.h>
+        #include <sys/types.h>
+        #endif
+        #include <sys/socket.h>
+        #include <netinet/in.h>
+        #include <netdb.h>
 
 int
 main ()
 {
-
-  struct sockaddr_in6 in;
-  AF_INET6;
-  IN6_IS_ADDR_LINKLOCAL (&in.sin6_addr);
-
+struct sockaddr_in6 in;
+        AF_INET6;
+        IN6_IS_ADDR_LINKLOCAL(&in.sin6_addr);
   ;
   return 0;
 }
@@ -9140,22 +8681,19 @@
 CC="$CC -DINET6"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-
 #ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netdb.h>
+      #include <sys/types.h>
+      #endif
+      #include <sys/socket.h>
+      #include <netinet/in.h>
+      #include <netdb.h>
 
 int
 main ()
 {
-
-  struct sockaddr_in6 in;
-  AF_INET6;
-  IN6_IS_ADDR_LINKLOCAL (&in.sin6_addr);
-
+struct sockaddr_in6 in;
+      AF_INET6;
+      IN6_IS_ADDR_LINKLOCAL (&in.sin6_addr);
   ;
   return 0;
 }
@@ -9201,6 +8739,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <signal.h>
+
 int
 main ()
 {
@@ -9318,20 +8857,20 @@
 
 # WITH_CRYPTO_IMPL
 
-CRYPTO_IMPL="builtin"
+CRYPTO_IMPL=builtin
 
 # Check whether --with-crypto-impl was given.
 if test "${with_crypto_impl+set}" = set; then :
   withval=$with_crypto_impl; CRYPTO_IMPL=$withval
-{ $as_echo "$as_me:${as_lineno-$LINENO}: k5crypto will use '$withval'" >&5
+   { $as_echo "$as_me:${as_lineno-$LINENO}: k5crypto will use '$withval'" >&5
 $as_echo "$as_me: k5crypto will use '$withval'" >&6;}
-
-else
-  withval=builtin
 fi
 
-case "$withval" in
+
+CRYPTO_BUILTIN_TESTS=no
+case $CRYPTO_IMPL in
 builtin)
+  CRYPTO_BUILTIN_TESTS=yes
   ;;
 openssl)
   { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PKCS7_get_signer_info in -lcrypto" >&5
@@ -9379,36 +8918,17 @@
 
 fi
 
+
+$as_echo "#define CRYPTO_OPENSSL 1" >>confdefs.h
+
   ;;
 *)
   as_fn_error $? "Unknown crypto implementation $withval" "$LINENO" 5
   ;;
 esac
-ac_config_commands="$ac_config_commands CRYPTO_IMPL"
-
-
-
-
-
-
-# Check whether --with-prng-alg was given.
-if test "${with_prng_alg+set}" = set; then :
-  withval=$with_prng_alg; PRNG_ALG=$withval
-{ $as_echo "$as_me:${as_lineno-$LINENO}: k5crypto will use '$withval'" >&5
-$as_echo "$as_me: k5crypto will use '$withval'" >&6;}
-
-else
-  PRNG_ALG=fortuna
-fi
-
-ac_config_commands="$ac_config_commands PRNG_ALG"
 
 
-if test "$PRNG_ALG" = fortuna; then
 
-$as_echo "#define FORTUNA 1" >>confdefs.h
-
-fi
 
 # WITH_TLS_IMPL
 
@@ -9823,204 +9343,11 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking return type of signal handlers" >&5
-$as_echo_n "checking return type of signal handlers... " >&6; }
-if ${ac_cv_type_signal+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <sys/types.h>
-#include <signal.h>
-
-int
-main ()
-{
-return *(signal (0, 0)) (0) == 1;
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_type_signal=int
-else
-  ac_cv_type_signal=void
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_signal" >&5
-$as_echo "$ac_cv_type_signal" >&6; }
-
-cat >>confdefs.h <<_ACEOF
-#define RETSIGTYPE $ac_cv_type_signal
-_ACEOF
-
-
-
 # from old include/configure.in
 
 
 ac_config_headers="$ac_config_headers include/autoconf.h"
 
-for ac_prog in flex lex
-do
-  # Extract the first word of "$ac_prog", so it can be a program name with args.
-set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_LEX+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test -n "$LEX"; then
-  ac_cv_prog_LEX="$LEX" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_prog_LEX="$ac_prog"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-fi
-fi
-LEX=$ac_cv_prog_LEX
-if test -n "$LEX"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LEX" >&5
-$as_echo "$LEX" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-  test -n "$LEX" && break
-done
-test -n "$LEX" || LEX=":"
-
-if test "x$LEX" != "x:"; then
-  cat >conftest.l <<_ACEOF
-%%
-a { ECHO; }
-b { REJECT; }
-c { yymore (); }
-d { yyless (1); }
-e { /* IRIX 6.5 flex 2.5.4 underquotes its yyless argument.  */
-    yyless ((input () != 0)); }
-f { unput (yytext0); }
-. { BEGIN INITIAL; }
-%%
-#ifdef YYTEXT_POINTER
-extern char *yytext;
-#endif
-int
-main (void)
-{
-  return ! yylex () + ! yywrap ();
-}
-_ACEOF
-{ { ac_try="$LEX conftest.l"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
-  (eval "$LEX conftest.l") 2>&5
-  ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; }
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking lex output file root" >&5
-$as_echo_n "checking lex output file root... " >&6; }
-if ${ac_cv_prog_lex_root+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-
-if test -f lex.yy.c; then
-  ac_cv_prog_lex_root=lex.yy
-elif test -f lexyy.c; then
-  ac_cv_prog_lex_root=lexyy
-else
-  as_fn_error $? "cannot find output from $LEX; giving up" "$LINENO" 5
-fi
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_lex_root" >&5
-$as_echo "$ac_cv_prog_lex_root" >&6; }
-LEX_OUTPUT_ROOT=$ac_cv_prog_lex_root
-
-if test -z "${LEXLIB+set}"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking lex library" >&5
-$as_echo_n "checking lex library... " >&6; }
-if ${ac_cv_lib_lex+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-
-    ac_save_LIBS=$LIBS
-    ac_cv_lib_lex='none needed'
-    for ac_lib in '' -lfl -ll; do
-      LIBS="$ac_lib $ac_save_LIBS"
-      cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-`cat $LEX_OUTPUT_ROOT.c`
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_lex=$ac_lib
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-      test "$ac_cv_lib_lex" != 'none needed' && break
-    done
-    LIBS=$ac_save_LIBS
-
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_lex" >&5
-$as_echo "$ac_cv_lib_lex" >&6; }
-  test "$ac_cv_lib_lex" != 'none needed' && LEXLIB=$ac_cv_lib_lex
-fi
-
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether yytext is a pointer" >&5
-$as_echo_n "checking whether yytext is a pointer... " >&6; }
-if ${ac_cv_prog_lex_yytext_pointer+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  # POSIX says lex can declare yytext either as a pointer or an array; the
-# default is implementation-dependent.  Figure out which it is, since
-# not all implementations provide the %pointer and %array declarations.
-ac_cv_prog_lex_yytext_pointer=no
-ac_save_LIBS=$LIBS
-LIBS="$LEXLIB $ac_save_LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-  #define YYTEXT_POINTER 1
-`cat $LEX_OUTPUT_ROOT.c`
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_prog_lex_yytext_pointer=yes
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_save_LIBS
-
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_lex_yytext_pointer" >&5
-$as_echo "$ac_cv_prog_lex_yytext_pointer" >&6; }
-if test $ac_cv_prog_lex_yytext_pointer = yes; then
-
-$as_echo "#define YYTEXT_POINTER 1" >>confdefs.h
-
-fi
-rm -f conftest.l $LEX_OUTPUT_ROOT.c
-
-fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for an ANSI C-conforming const" >&5
 $as_echo_n "checking for an ANSI C-conforming const... " >&6; }
 if ${ac_cv_c_const+:} false; then :
@@ -10404,7 +9731,8 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <stdio.h>
-#include <errno.h>
+      #include <errno.h>
+
 int
 main ()
 {
@@ -10452,7 +9780,7 @@
 if ac_fn_c_try_link "$LINENO"; then :
   krb5_cv_var_sys_errlist=yes
 else
-  krb5_cv_var_sys_errlist=no;
+  krb5_cv_var_sys_errlist=no
 fi
 rm -f core conftest.err conftest.$ac_objext \
     conftest$ac_exeext conftest.$ac_ext
@@ -10601,10 +9929,9 @@
 main ()
 {
 #undef strptime
-struct k5foo {int foo; } xx;
-extern int strptime (struct k5foo*);
-strptime(&xx);
-
+      struct k5foo {int foo; } xx;
+      extern int strptime (struct k5foo*);
+      strptime(&xx);
   ;
   return 0;
 }
@@ -10634,29 +9961,23 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/types.h>
-#include <sys/wait.h>
-extern pid_t wait(int *);
-int
-main ()
-{
-
-  ;
-  return 0;
-}
+      #include <sys/wait.h>
+      extern pid_t wait(int *);
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   krb5_cv_struct_wait=no
 else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/wait.h>
+
 int
 main ()
 {
 union wait i;
-#ifdef WEXITSTATUS
-  WEXITSTATUS (i);
-#endif
+        #ifdef WEXITSTATUS
+        WEXITSTATUS (i);
+        #endif
 
   ;
   return 0;
@@ -10689,10 +10010,11 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <signal.h>
+
 int
 main ()
 {
-sigprocmask(SIG_SETMASK,0,0);
+sigprocmask(SIG_SETMASK, 0, 0);
   ;
   return 0;
 }
@@ -10703,6 +10025,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <signal.h>
+
 int
 main ()
 {
@@ -10839,6 +10162,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <setjmp.h>
+
 int
 main ()
 {
@@ -10876,17 +10200,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void setrpcent();
-int
-main ()
-{
-int i;
-  ;
-  return 0;
-}
+                    extern void setrpcent();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   k5_cv_type_setrpcent=void
@@ -10912,17 +10226,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void endrpcent();
-int
-main ()
-{
-int i;
-  ;
-  return 0;
-}
+      extern void endrpcent();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   k5_cv_type_endrpcent=void
@@ -10947,12 +10251,12 @@
 if ${krb5_cv_bswap_16+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #if HAVE_BYTESWAP_H
-#include <byteswap.h>
-#endif
+      #include <byteswap.h>
+      #endif
+
 int
 main ()
 {
@@ -10982,12 +10286,12 @@
 if ${krb5_cv_bswap_64+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #if HAVE_BYTESWAP_H
-#include <byteswap.h>
-#endif
+      #include <byteswap.h>
+      #endif
+
 int
 main ()
 {
@@ -11088,14 +10392,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-  extern int gethostbyname_r ();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+        extern int gethostbyname_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   krb5_cv_gethostbyname_r_returns_int=yes
@@ -11116,14 +10413,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-  extern struct hostent *gethostbyname_r ();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+        extern struct hostent *gethostbyname_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   krb5_cv_gethostbyname_r_returns_ptr=yes
@@ -11189,14 +10479,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <pwd.h>
-   extern int getpwnam_r();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+        extern int getpwnam_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   getpwnam_r_returns_int=yes
@@ -11207,14 +10490,7 @@
    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <pwd.h>
-   extern struct passwd *getpwnam_r();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+        extern struct passwd *getpwnam_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   getpwnam_r_returns_ptr=yes
@@ -11250,7 +10526,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <pwd.h>
-   struct passwd pwx; char buf1024;
+        struct passwd pwx; char buf1024;
 int
 main ()
 {
@@ -11268,7 +10544,8 @@
    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <pwd.h>
-   struct passwd pwx, *p; char buf1024;
+         struct passwd pwx, *p;
+         char buf1024;
 int
 main ()
 {
@@ -11338,14 +10615,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <time.h>
-   extern int gmtime_r ();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+        extern int gmtime_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   return_int=yes
@@ -11355,15 +10625,9 @@
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-#include <time.h>
-   extern struct tm *gmtime_r ();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+
+     #include <time.h>
+         extern struct tm *gmtime_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   return_ptr=yes
@@ -11406,14 +10670,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-  extern int getservbyname_r ();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+        extern int getservbyname_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   krb5_cv_getservbyname_r_returns_int=yes
@@ -11434,14 +10691,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-  extern struct servent *getservbyname_r ();
-int
-main ()
-{
-1;
-  ;
-  return 0;
-}
+        extern struct servent *getservbyname_r();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   krb5_cv_getservbyname_r_returns_ptr=yes
@@ -11479,30 +10729,6 @@
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for yylineno declaration" >&5
-$as_echo_n "checking for yylineno declaration... " >&6; }
-if ${krb5_cv_type_yylineno+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  # some systems have yylineno, others don't...
-  echo '%%
-%%' | ${LEX} -t > conftest.out
-  if egrep yylineno conftest.out >/dev/null 2>&1; then
-	krb5_cv_type_yylineno=yes
-  else
-	krb5_cv_type_yylineno=no
-  fi
-  rm -f conftest.out
-fi
-
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $krb5_cv_type_yylineno" >&5
-$as_echo "$krb5_cv_type_yylineno" >&6; }
-  if test $krb5_cv_type_yylineno = no; then
-
-$as_echo "#define NO_YYLINENO 1" >>confdefs.h
-
-  fi
-
 
 ac_fn_c_check_header_mongrel "$LINENO" "dirent.h" "ac_cv_header_dirent_h" "$ac_includes_default"
 if test "x$ac_cv_header_dirent_h" = xyes; then :
@@ -11556,55 +10782,6 @@
 
 
 
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking POSIX signal handlers" >&5
-$as_echo_n "checking POSIX signal handlers... " >&6; }
-if ${krb5_cv_has_posix_signals+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <sys/types.h>
-#include <signal.h>
-#ifdef signal
-#undef signal
-#endif
-extern void (*signal ()) ();
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  krb5_cv_has_posix_signals=yes
-else
-  krb5_cv_has_posix_signals=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $krb5_cv_has_posix_signals" >&5
-$as_echo "$krb5_cv_has_posix_signals" >&6; }
-if test $krb5_cv_has_posix_signals = yes; then
-   stype=void
-
-$as_echo "#define POSIX_SIGTYPE 1" >>confdefs.h
-
-else
-  if test $ac_cv_type_signal = void; then
-     stype=void
-  else
-     stype=int
-  fi
-fi
-
-cat >>confdefs.h <<_ACEOF
-#define krb5_sigtype $stype
-_ACEOF
-
 for ac_header in poll.h stdlib.h string.h stddef.h sys/types.h sys/file.h sys/param.h sys/stat.h sys/time.h netinet/in.h sys/uio.h sys/filio.h sys/select.h time.h paths.h errno.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
@@ -11622,30 +10799,27 @@
 # If compiling with IPv6 support, test if in6addr_any functions.
 # Irix 6.5.16 defines it, but lacks support in the C library.
 if test $krb5_cv_inet6 = yes || test "$krb5_cv_inet6_with_dinet6" = yes ; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for in6addr_any definition in library" >&5
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for in6addr_any definition in library" >&5
 $as_echo_n "checking for in6addr_any definition in library... " >&6; }
 if ${krb5_cv_var_in6addr_any+:} false; then :
   $as_echo_n "(cached) " >&6
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-
 #ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netdb.h>
-#include <stdio.h>
+        #include <sys/types.h>
+        #endif
+        #include <sys/socket.h>
+        #include <netinet/in.h>
+        #include <netdb.h>
+        #include <stdio.h>
 
 int
 main ()
 {
-
-  struct sockaddr_in6 in;
-  in.sin6_addr = in6addr_any;
-  printf("%x", &in);
-
+struct sockaddr_in6 in;
+        in.sin6_addr = in6addr_any;
+        printf("%x", &in);
   ;
   return 0;
 }
@@ -11669,41 +10843,6 @@
 
 # then from osconf.h, we have
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether time.h and sys/time.h may both be included" >&5
-$as_echo_n "checking whether time.h and sys/time.h may both be included... " >&6; }
-if ${ac_cv_header_time+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <sys/types.h>
-#include <sys/time.h>
-#include <time.h>
-
-int
-main ()
-{
-if ((struct tm *) 0)
-return 0;
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  ac_cv_header_time=yes
-else
-  ac_cv_header_time=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_time" >&5
-$as_echo "$ac_cv_header_time" >&6; }
-if test $ac_cv_header_time = yes; then
-
-$as_echo "#define TIME_WITH_SYS_TIME 1" >>confdefs.h
-
-fi
-
 ac_fn_c_check_type "$LINENO" "time_t" "ac_cv_type_time_t" "$ac_includes_default"
 if test "x$ac_cv_type_time_t" = xyes; then :
 
@@ -11784,12 +10923,12 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/types.h>
-#include <sys/socket.h>
+      #include <sys/socket.h>
 
 int
 main ()
 {
-sizeof (socklen_t);
+sizeof(socklen_t);
   ;
   return 0;
 }
@@ -11818,7 +10957,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/socket.h>
-#include <net/if.h>
+      #include <net/if.h>
 
 int
 main ()
@@ -11852,13 +10991,13 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/socket.h>
-#include <net/if.h>
-#include <net/if6.h>
+      #include <net/if.h>
+      #include <net/if6.h>
 
 int
 main ()
 {
-sizeof (struct if_laddrconf);
+sizeof(struct if_laddrconf);
   ;
   return 0;
 }
@@ -12094,13 +11233,6 @@
 fi
 
 
-# stuff for util/profile
-
-# AC_KRB5_TCL already done
-DO_TCL=
-test "$TCL_LIBS" != "" && DO_TCL=ok
-
-
 # types libdb2 wants
 
 ac_fn_c_check_type "$LINENO" "ssize_t" "ac_cv_type_ssize_t" "$ac_includes_default"
@@ -12343,25 +11475,25 @@
 if ${ac_cv_printf_positional+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-
-if test "$cross_compiling" = yes; then :
+  if test "$cross_compiling" = yes; then :
   as_fn_error $? "Cannot test for printf positional argument support when cross compiling" "$LINENO" 5
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-
 #include <stdio.h>
-#include <string.h>
-const char expected = "200 100";
-int main () {
-    char buf30;
-    sprintf(buf, "%2\$x %1\$d", 100, 512);
-    if (strcmp(expected, buf)) {
-	fprintf(stderr,"bad result: <%s> wanted: <%s>\n", buf, expected);
-	return 1;
-    }
-    return 0;
-}
+      #include <string.h>
+      const char expected = "200 100";
+      int main()
+      {
+          char buf30;
+          sprintf(buf, "%2\$x %1\$d", 100, 512);
+          if (strcmp(expected, buf)) {
+              fprintf(stderr, "bad result: <%s> wanted: <%s>\n",
+                      buf, expected);
+              return 1;
+          }
+          return 0;
+      }
 _ACEOF
 if ac_fn_c_try_run "$LINENO"; then :
   ac_cv_printf_positional=yes
@@ -12515,139 +11647,6 @@
   enableval=$enable_athena; ath_compat=compat
 fi
 
-# The following are tests for the presence of programs required for
-# kadmin testing.
-# Extract the first word of "runtest", so it can be a program name with args.
-set dummy runtest; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_have_RUNTEST+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test -n "$have_RUNTEST"; then
-  ac_cv_prog_have_RUNTEST="$have_RUNTEST" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_prog_have_RUNTEST="runtest"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-fi
-fi
-have_RUNTEST=$ac_cv_prog_have_RUNTEST
-if test -n "$have_RUNTEST"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_RUNTEST" >&5
-$as_echo "$have_RUNTEST" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-# Extract the first word of "perl", so it can be a program name with args.
-set dummy perl; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_have_PERL+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test -n "$have_PERL"; then
-  ac_cv_prog_have_PERL="$have_PERL" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_prog_have_PERL="perl"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-fi
-fi
-have_PERL=$ac_cv_prog_have_PERL
-if test -n "$have_PERL"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_PERL" >&5
-$as_echo "$have_PERL" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-if test "$have_PERL" = perl -a "$have_RUNTEST" = runtest -a "$TCL_LIBS" != ""; then
-	DO_TEST=ok
-fi
-
-
-# The following are substituted into kadmin/testing/scripts/env-setup.sh
-RBUILD=`pwd`
-
-case "$srcdir" in
-/*)	S_TOP=$srcdir ;;
-*)	S_TOP=`pwd`/$srcdir ;;
-esac
-
-# Extract the first word of "expect", so it can be a program name with args.
-set dummy expect; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_EXPECT+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  case $EXPECT in
-  \\/* | ?:\\/*)
-  ac_cv_path_EXPECT="$EXPECT" # Let the user override the test with a path.
-  ;;
-  *)
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_EXPECT="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-  ;;
-esac
-fi
-EXPECT=$ac_cv_path_EXPECT
-if test -n "$EXPECT"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $EXPECT" >&5
-$as_echo "$EXPECT" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-# For kadmin/testing/util/Makefile.in
-if test "$TCL_LIBS" != "" ;  then
-	DO_ALL=tcl
-fi
 
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to use priocntl hack" >&5
 $as_echo_n "checking whether to use priocntl hack... " >&6; }
@@ -12686,45 +11685,6 @@
 	PRIOCNTL_HACK=0
 fi
 
-ac_config_files="$ac_config_files kadmin/testing/scripts/env-setup.sh:kadmin/testing/scripts/env-setup.shin"
-
-# for lib/kadm5
-# Extract the first word of "runtest", so it can be a program name with args.
-set dummy runtest; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_RUNTEST+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  if test -n "$RUNTEST"; then
-  ac_cv_prog_RUNTEST="$RUNTEST" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_prog_RUNTEST="runtest"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-fi
-fi
-RUNTEST=$ac_cv_prog_RUNTEST
-if test -n "$RUNTEST"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $RUNTEST" >&5
-$as_echo "$RUNTEST" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
 
 # Extract the first word of "perl", so it can be a program name with args.
 set dummy perl; ac_word=$2
@@ -12799,45 +11759,57 @@
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
+
 int
 main ()
 {
 struct rpcent e;
-char c = e.r_name0;
-int i = e.r_number;
+      char c = e.r_name0;
+      int i = e.r_number;
   ;
   return 0;
 }
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
+  netdb_rpcent=yes
+else
+  netdb_rpcent=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+if test "$netdb_rpcent" = yes; then
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <rpc/netdb.h>
+
 int
 main ()
 {
 struct rpcent e;
-char c = e.r_name0;
-int i = e.r_number;
+        char c = e.r_name0;
+        int i = e.r_number;
   ;
   return 0;
 }
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: rpc/netdb.h" >&5
-$as_echo "rpc/netdb.h" >&6; }
-rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H'
+  rpc_netdb_rpcent=yes
 else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: netdb.h" >&5
-$as_echo "netdb.h" >&6; }
+  rpc_netdb_rpcent=no
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  if test "$rpc_netdb_rpcent" = yes; then
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: rpc/netdb.h" >&5
+$as_echo "rpc/netdb.h" >&6; }
+    rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H'
+  else
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: netdb.h" >&5
+$as_echo "netdb.h" >&6; }
+  fi
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: nowhere" >&5
 $as_echo "nowhere" >&6; }
-rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H'
+  rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H'
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
 
 for ac_header in sys/select.h sys/time.h unistd.h
@@ -12880,6 +11852,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/param.h>
+
 int
 main ()
 {
@@ -12905,6 +11878,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
+
 int
 main ()
 {
@@ -12946,15 +11920,16 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <sys/types.h>
-#if HAVE_UNISTD_H
-#include <unistd.h>
-#endif
+      #if HAVE_UNISTD_H
+      #include <unistd.h>
+      #endif
+
 int
 main ()
 {
 u_char c;
-u_int i;
-u_long l;
+      u_int i;
+      u_long l;
   ;
   return 0;
 }
@@ -12983,17 +11958,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void setrpcent();
-int
-main ()
-{
-int i;
-  ;
-  return 0;
-}
+      extern void setrpcent();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   k5_cv_type_setrpcent=void
@@ -13019,17 +11984,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void endrpcent();
-int
-main ()
-{
-int i;
-  ;
-  return 0;
-}
+      extern void endrpcent();
 _ACEOF
 if ac_fn_c_try_compile "$LINENO"; then :
   k5_cv_type_endrpcent=void
@@ -13127,6 +12082,17 @@
 
 fi
 
+  for ac_func in EVP_PKEY_get_bn_param
+do :
+  ac_fn_c_check_func "$LINENO" "EVP_PKEY_get_bn_param" "ac_cv_func_EVP_PKEY_get_bn_param"
+if test "x$ac_cv_func_EVP_PKEY_get_bn_param" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_EVP_PKEY_GET_BN_PARAM 1
+_ACEOF
+
+fi
+done
+
   LIBS="$old_LIBS"
 fi
 if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then
@@ -13209,14 +12175,6 @@
 
 
 
-# for tests/
-if test x"$RUNTEST" != x; then
-	HAVE_RUNTEST=yes
-else
-	HAVE_RUNTEST=no
-fi
-
-
 # For Python tests.  Python version 3.2.4 is required as prior
 # versions do not accept string input to subprocess.Popen.communicate
 # when universal_newlines is set.
@@ -13404,25 +12362,9 @@
 
 
 
-# Check for thread safety issues.
-# (Is there a better place for this?)
-# tsfuncs="getpwnam_r getpwuid_r gethostbyname_r getservbyname_r gmtime_r localtime_r"
-# Removed getpwnam_r and getpwuid_r because include/configure.in has some
-# more careful checks, and may decide to pretend that they're not found if
-# the function signatures can't be figured out.
-tsfuncs="gethostbyname_r getservbyname_r gmtime_r localtime_r"
-for ac_func in $tsfuncs
-do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
-
+# Warn about possible thread safety issues.  These functions have all
+# been checked for previously.
+tsfuncs="getpwnam_r getpwuid_r gethostbyname_r getservbyname_r gmtime_r localtime_r"
 if test "$enable_thread_support" = yes; then
   tsmissing=""
   for ts in $tsfuncs; do
@@ -13807,7 +12749,6 @@
 
 # Compile with libedit support in ss by default if available.  Compile
 # with readline only if asked, to avoid a default GPL dependency.
-# Building with readline also breaks the dejagnu test suite.
 
 # Check whether --with-libedit was given.
 if test "${with_libedit+set}" = set; then :
@@ -14217,17 +13158,21 @@
  ac_config_files="$ac_config_files lib/kdb/Makefile:$srcdir/./config/pre.in:lib/kdb/Makefile.in:lib/kdb/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/crypto/Makefile:$srcdir/./config/pre.in:lib/crypto/Makefile.in:lib/crypto/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/crypto/krb/Makefile:$srcdir/./config/pre.in:lib/crypto/krb/Makefile.in:lib/crypto/krb/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/Makefile.in:lib/crypto/$CRYPTO_IMPL/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/enc_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/enc_provider/Makefile.in:lib/crypto/$CRYPTO_IMPL/enc_provider/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/hash_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/hash_provider/Makefile.in:lib/crypto/$CRYPTO_IMPL/hash_provider/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/des/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/des/Makefile.in:lib/crypto/$CRYPTO_IMPL/des/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/md4/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/md4/Makefile.in:lib/crypto/$CRYPTO_IMPL/md4/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/md5/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/md5/Makefile.in:lib/crypto/$CRYPTO_IMPL/md5/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/sha1/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/sha1/Makefile.in:lib/crypto/$CRYPTO_IMPL/sha1/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/sha2/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/sha2/Makefile.in:lib/crypto/$CRYPTO_IMPL/sha2/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/aes/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/aes/Makefile.in:lib/crypto/$CRYPTO_IMPL/aes/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/crypto/$CRYPTO_IMPL/camellia/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/camellia/Makefile.in:lib/crypto/$CRYPTO_IMPL/camellia/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/crypto/crypto_tests/Makefile:$srcdir/./config/pre.in:lib/crypto/crypto_tests/Makefile.in:lib/crypto/crypto_tests/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/Makefile.in:lib/crypto/builtin/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/des/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/des/Makefile.in:lib/crypto/builtin/des/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/aes/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/aes/Makefile.in:lib/crypto/builtin/aes/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/camellia/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/camellia/Makefile.in:lib/crypto/builtin/camellia/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/md4/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/md4/Makefile.in:lib/crypto/builtin/md4/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/md5/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/md5/Makefile.in:lib/crypto/builtin/md5/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/sha1/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/sha1/Makefile.in:lib/crypto/builtin/sha1/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/sha2/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/sha2/Makefile.in:lib/crypto/builtin/sha2/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/enc_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/enc_provider/Makefile.in:lib/crypto/builtin/enc_provider/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/builtin/hash_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/hash_provider/Makefile.in:lib/crypto/builtin/hash_provider/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/openssl/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/Makefile.in:lib/crypto/openssl/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/openssl/des/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/des/Makefile.in:lib/crypto/openssl/des/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/openssl/enc_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/enc_provider/Makefile.in:lib/crypto/openssl/enc_provider/deps:$srcdir/./config/post.in"
+ ac_config_files="$ac_config_files lib/crypto/openssl/hash_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/hash_provider/Makefile.in:lib/crypto/openssl/hash_provider/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/krb5/Makefile:$srcdir/./config/pre.in:lib/krb5/Makefile.in:lib/krb5/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/krb5/error_tables/Makefile:$srcdir/./config/pre.in:lib/krb5/error_tables/Makefile.in:lib/krb5/error_tables/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/krb5/asn.1/Makefile:$srcdir/./config/pre.in:lib/krb5/asn.1/Makefile.in:lib/krb5/asn.1/deps:$srcdir/./config/post.in"
@@ -14247,7 +13192,6 @@
  ac_config_files="$ac_config_files lib/kadm5/Makefile:$srcdir/./config/pre.in:lib/kadm5/Makefile.in:lib/kadm5/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/kadm5/clnt/Makefile:$srcdir/./config/pre.in:lib/kadm5/clnt/Makefile.in:lib/kadm5/clnt/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/kadm5/srv/Makefile:$srcdir/./config/pre.in:lib/kadm5/srv/Makefile.in:lib/kadm5/srv/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files lib/kadm5/unit-test/Makefile:$srcdir/./config/pre.in:lib/kadm5/unit-test/Makefile.in:lib/kadm5/unit-test/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/krad/Makefile:$srcdir/./config/pre.in:lib/krad/Makefile.in:lib/krad/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files lib/apputils/Makefile:$srcdir/./config/pre.in:lib/apputils/Makefile.in:lib/apputils/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files kdc/Makefile:$srcdir/./config/pre.in:kdc/Makefile.in:kdc/deps:$srcdir/./config/post.in"
@@ -14295,9 +13239,6 @@
  ac_config_files="$ac_config_files kadmin/dbutil/Makefile:$srcdir/./config/pre.in:kadmin/dbutil/Makefile.in:kadmin/dbutil/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files kadmin/ktutil/Makefile:$srcdir/./config/pre.in:kadmin/ktutil/Makefile.in:kadmin/ktutil/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files kadmin/server/Makefile:$srcdir/./config/pre.in:kadmin/server/Makefile.in:kadmin/server/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files kadmin/testing/Makefile:$srcdir/./config/pre.in:kadmin/testing/Makefile.in:kadmin/testing/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files kadmin/testing/scripts/Makefile:$srcdir/./config/pre.in:kadmin/testing/scripts/Makefile.in:kadmin/testing/scripts/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files kadmin/testing/util/Makefile:$srcdir/./config/pre.in:kadmin/testing/util/Makefile.in:kadmin/testing/util/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files appl/Makefile:$srcdir/./config/pre.in:appl/Makefile.in:appl/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files appl/sample/Makefile:$srcdir/./config/pre.in:appl/sample/Makefile.in:appl/sample/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files appl/sample/sclient/Makefile:$srcdir/./config/pre.in:appl/sample/sclient/Makefile.in:appl/sample/sclient/deps:$srcdir/./config/post.in"
@@ -14313,7 +13254,6 @@
  ac_config_files="$ac_config_files tests/hammer/Makefile:$srcdir/./config/pre.in:tests/hammer/Makefile.in:tests/hammer/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files tests/verify/Makefile:$srcdir/./config/pre.in:tests/verify/Makefile.in:tests/verify/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files tests/gssapi/Makefile:$srcdir/./config/pre.in:tests/gssapi/Makefile.in:tests/gssapi/deps:$srcdir/./config/post.in"
- ac_config_files="$ac_config_files tests/dejagnu/Makefile:$srcdir/./config/pre.in:tests/dejagnu/Makefile.in:tests/dejagnu/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files tests/threads/Makefile:$srcdir/./config/pre.in:tests/threads/Makefile.in:tests/threads/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files tests/shlib/Makefile:$srcdir/./config/pre.in:tests/shlib/Makefile.in:tests/shlib/deps:$srcdir/./config/post.in"
  ac_config_files="$ac_config_files tests/gss-threads/Makefile:$srcdir/./config/pre.in:tests/gss-threads/Makefile.in:tests/gss-threads/deps:$srcdir/./config/post.in"
@@ -14825,7 +13765,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Kerberos 5 $as_me 1.19.2, which was
+This file was extended by Kerberos 5 $as_me 1.20.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -14852,7 +13792,6 @@
 # Files that config.status was made for.
 config_files="$ac_config_files"
 config_headers="$ac_config_headers"
-config_commands="$ac_config_commands"
 
 _ACEOF
 
@@ -14882,16 +13821,13 @@
 Configuration headers:
 $config_headers
 
-Configuration commands:
-$config_commands
-
 Report bugs to <krb5-bugs@mit.edu>."
 
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/\\""\`\$/\\\\&/g'`"
 ac_cs_version="\\
-Kerberos 5 config.status 1.19.2
+Kerberos 5 config.status 1.20.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -15006,12 +13942,6 @@
 
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
-#
-# INIT-COMMANDS
-#
-CRYPTO_IMPL=$CRYPTO_IMPL
-PRNG_ALG=$PRNG_ALG
-
 _ACEOF
 
 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
@@ -15022,10 +13952,7 @@
   case $ac_config_target in
     "po/Makefile") CONFIG_FILES="$CONFIG_FILES po/Makefile:$srcdir/./config/pre.in:po/Makefile.in:po/deps:$srcdir/./config/post.in" ;;
     "plugins/audit/simple/Makefile") CONFIG_FILES="$CONFIG_FILES plugins/audit/simple/Makefile:$srcdir/./config/pre.in:plugins/audit/simple/Makefile.in:plugins/audit/simple/deps:$srcdir/./config/post.in" ;;
-    "CRYPTO_IMPL") CONFIG_COMMANDS="$CONFIG_COMMANDS CRYPTO_IMPL" ;;
-    "PRNG_ALG") CONFIG_COMMANDS="$CONFIG_COMMANDS PRNG_ALG" ;;
     "include/autoconf.h") CONFIG_HEADERS="$CONFIG_HEADERS include/autoconf.h" ;;
-    "kadmin/testing/scripts/env-setup.sh") CONFIG_FILES="$CONFIG_FILES kadmin/testing/scripts/env-setup.sh:kadmin/testing/scripts/env-setup.shin" ;;
     "include/gssrpc/types.h") CONFIG_FILES="$CONFIG_FILES include/gssrpc/types.h:include/gssrpc/types.hin" ;;
     "plugins/preauth/pkinit/Makefile") CONFIG_FILES="$CONFIG_FILES plugins/preauth/pkinit/Makefile:$srcdir/./config/pre.in:plugins/preauth/pkinit/Makefile.in:plugins/preauth/pkinit/deps:$srcdir/./config/post.in" ;;
     "tests/softpkcs11/Makefile") CONFIG_FILES="$CONFIG_FILES tests/softpkcs11/Makefile:$srcdir/./config/pre.in:tests/softpkcs11/Makefile.in:tests/softpkcs11/deps:$srcdir/./config/post.in" ;;
@@ -15055,17 +13982,21 @@
     "lib/kdb/Makefile") CONFIG_FILES="$CONFIG_FILES lib/kdb/Makefile:$srcdir/./config/pre.in:lib/kdb/Makefile.in:lib/kdb/deps:$srcdir/./config/post.in" ;;
     "lib/crypto/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/Makefile:$srcdir/./config/pre.in:lib/crypto/Makefile.in:lib/crypto/deps:$srcdir/./config/post.in" ;;
     "lib/crypto/krb/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/krb/Makefile:$srcdir/./config/pre.in:lib/crypto/krb/Makefile.in:lib/crypto/krb/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/Makefile.in:lib/crypto/$CRYPTO_IMPL/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/enc_provider/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/enc_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/enc_provider/Makefile.in:lib/crypto/$CRYPTO_IMPL/enc_provider/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/hash_provider/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/hash_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/hash_provider/Makefile.in:lib/crypto/$CRYPTO_IMPL/hash_provider/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/des/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/des/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/des/Makefile.in:lib/crypto/$CRYPTO_IMPL/des/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/md4/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/md4/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/md4/Makefile.in:lib/crypto/$CRYPTO_IMPL/md4/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/md5/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/md5/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/md5/Makefile.in:lib/crypto/$CRYPTO_IMPL/md5/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/sha1/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/sha1/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/sha1/Makefile.in:lib/crypto/$CRYPTO_IMPL/sha1/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/sha2/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/sha2/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/sha2/Makefile.in:lib/crypto/$CRYPTO_IMPL/sha2/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/aes/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/aes/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/aes/Makefile.in:lib/crypto/$CRYPTO_IMPL/aes/deps:$srcdir/./config/post.in" ;;
-    "lib/crypto/$CRYPTO_IMPL/camellia/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/$CRYPTO_IMPL/camellia/Makefile:$srcdir/./config/pre.in:lib/crypto/$CRYPTO_IMPL/camellia/Makefile.in:lib/crypto/$CRYPTO_IMPL/camellia/deps:$srcdir/./config/post.in" ;;
     "lib/crypto/crypto_tests/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/crypto_tests/Makefile:$srcdir/./config/pre.in:lib/crypto/crypto_tests/Makefile.in:lib/crypto/crypto_tests/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/Makefile.in:lib/crypto/builtin/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/des/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/des/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/des/Makefile.in:lib/crypto/builtin/des/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/aes/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/aes/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/aes/Makefile.in:lib/crypto/builtin/aes/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/camellia/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/camellia/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/camellia/Makefile.in:lib/crypto/builtin/camellia/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/md4/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/md4/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/md4/Makefile.in:lib/crypto/builtin/md4/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/md5/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/md5/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/md5/Makefile.in:lib/crypto/builtin/md5/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/sha1/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/sha1/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/sha1/Makefile.in:lib/crypto/builtin/sha1/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/sha2/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/sha2/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/sha2/Makefile.in:lib/crypto/builtin/sha2/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/enc_provider/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/enc_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/enc_provider/Makefile.in:lib/crypto/builtin/enc_provider/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/builtin/hash_provider/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/builtin/hash_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/builtin/hash_provider/Makefile.in:lib/crypto/builtin/hash_provider/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/openssl/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/openssl/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/Makefile.in:lib/crypto/openssl/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/openssl/des/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/openssl/des/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/des/Makefile.in:lib/crypto/openssl/des/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/openssl/enc_provider/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/openssl/enc_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/enc_provider/Makefile.in:lib/crypto/openssl/enc_provider/deps:$srcdir/./config/post.in" ;;
+    "lib/crypto/openssl/hash_provider/Makefile") CONFIG_FILES="$CONFIG_FILES lib/crypto/openssl/hash_provider/Makefile:$srcdir/./config/pre.in:lib/crypto/openssl/hash_provider/Makefile.in:lib/crypto/openssl/hash_provider/deps:$srcdir/./config/post.in" ;;
     "lib/krb5/Makefile") CONFIG_FILES="$CONFIG_FILES lib/krb5/Makefile:$srcdir/./config/pre.in:lib/krb5/Makefile.in:lib/krb5/deps:$srcdir/./config/post.in" ;;
     "lib/krb5/error_tables/Makefile") CONFIG_FILES="$CONFIG_FILES lib/krb5/error_tables/Makefile:$srcdir/./config/pre.in:lib/krb5/error_tables/Makefile.in:lib/krb5/error_tables/deps:$srcdir/./config/post.in" ;;
     "lib/krb5/asn.1/Makefile") CONFIG_FILES="$CONFIG_FILES lib/krb5/asn.1/Makefile:$srcdir/./config/pre.in:lib/krb5/asn.1/Makefile.in:lib/krb5/asn.1/deps:$srcdir/./config/post.in" ;;
@@ -15085,7 +14016,6 @@
     "lib/kadm5/Makefile") CONFIG_FILES="$CONFIG_FILES lib/kadm5/Makefile:$srcdir/./config/pre.in:lib/kadm5/Makefile.in:lib/kadm5/deps:$srcdir/./config/post.in" ;;
     "lib/kadm5/clnt/Makefile") CONFIG_FILES="$CONFIG_FILES lib/kadm5/clnt/Makefile:$srcdir/./config/pre.in:lib/kadm5/clnt/Makefile.in:lib/kadm5/clnt/deps:$srcdir/./config/post.in" ;;
     "lib/kadm5/srv/Makefile") CONFIG_FILES="$CONFIG_FILES lib/kadm5/srv/Makefile:$srcdir/./config/pre.in:lib/kadm5/srv/Makefile.in:lib/kadm5/srv/deps:$srcdir/./config/post.in" ;;
-    "lib/kadm5/unit-test/Makefile") CONFIG_FILES="$CONFIG_FILES lib/kadm5/unit-test/Makefile:$srcdir/./config/pre.in:lib/kadm5/unit-test/Makefile.in:lib/kadm5/unit-test/deps:$srcdir/./config/post.in" ;;
     "lib/krad/Makefile") CONFIG_FILES="$CONFIG_FILES lib/krad/Makefile:$srcdir/./config/pre.in:lib/krad/Makefile.in:lib/krad/deps:$srcdir/./config/post.in" ;;
     "lib/apputils/Makefile") CONFIG_FILES="$CONFIG_FILES lib/apputils/Makefile:$srcdir/./config/pre.in:lib/apputils/Makefile.in:lib/apputils/deps:$srcdir/./config/post.in" ;;
     "kdc/Makefile") CONFIG_FILES="$CONFIG_FILES kdc/Makefile:$srcdir/./config/pre.in:kdc/Makefile.in:kdc/deps:$srcdir/./config/post.in" ;;
@@ -15133,9 +14063,6 @@
     "kadmin/dbutil/Makefile") CONFIG_FILES="$CONFIG_FILES kadmin/dbutil/Makefile:$srcdir/./config/pre.in:kadmin/dbutil/Makefile.in:kadmin/dbutil/deps:$srcdir/./config/post.in" ;;
     "kadmin/ktutil/Makefile") CONFIG_FILES="$CONFIG_FILES kadmin/ktutil/Makefile:$srcdir/./config/pre.in:kadmin/ktutil/Makefile.in:kadmin/ktutil/deps:$srcdir/./config/post.in" ;;
     "kadmin/server/Makefile") CONFIG_FILES="$CONFIG_FILES kadmin/server/Makefile:$srcdir/./config/pre.in:kadmin/server/Makefile.in:kadmin/server/deps:$srcdir/./config/post.in" ;;
-    "kadmin/testing/Makefile") CONFIG_FILES="$CONFIG_FILES kadmin/testing/Makefile:$srcdir/./config/pre.in:kadmin/testing/Makefile.in:kadmin/testing/deps:$srcdir/./config/post.in" ;;
-    "kadmin/testing/scripts/Makefile") CONFIG_FILES="$CONFIG_FILES kadmin/testing/scripts/Makefile:$srcdir/./config/pre.in:kadmin/testing/scripts/Makefile.in:kadmin/testing/scripts/deps:$srcdir/./config/post.in" ;;
-    "kadmin/testing/util/Makefile") CONFIG_FILES="$CONFIG_FILES kadmin/testing/util/Makefile:$srcdir/./config/pre.in:kadmin/testing/util/Makefile.in:kadmin/testing/util/deps:$srcdir/./config/post.in" ;;
     "appl/Makefile") CONFIG_FILES="$CONFIG_FILES appl/Makefile:$srcdir/./config/pre.in:appl/Makefile.in:appl/deps:$srcdir/./config/post.in" ;;
     "appl/sample/Makefile") CONFIG_FILES="$CONFIG_FILES appl/sample/Makefile:$srcdir/./config/pre.in:appl/sample/Makefile.in:appl/sample/deps:$srcdir/./config/post.in" ;;
     "appl/sample/sclient/Makefile") CONFIG_FILES="$CONFIG_FILES appl/sample/sclient/Makefile:$srcdir/./config/pre.in:appl/sample/sclient/Makefile.in:appl/sample/sclient/deps:$srcdir/./config/post.in" ;;
@@ -15151,7 +14078,6 @@
     "tests/hammer/Makefile") CONFIG_FILES="$CONFIG_FILES tests/hammer/Makefile:$srcdir/./config/pre.in:tests/hammer/Makefile.in:tests/hammer/deps:$srcdir/./config/post.in" ;;
     "tests/verify/Makefile") CONFIG_FILES="$CONFIG_FILES tests/verify/Makefile:$srcdir/./config/pre.in:tests/verify/Makefile.in:tests/verify/deps:$srcdir/./config/post.in" ;;
     "tests/gssapi/Makefile") CONFIG_FILES="$CONFIG_FILES tests/gssapi/Makefile:$srcdir/./config/pre.in:tests/gssapi/Makefile.in:tests/gssapi/deps:$srcdir/./config/post.in" ;;
-    "tests/dejagnu/Makefile") CONFIG_FILES="$CONFIG_FILES tests/dejagnu/Makefile:$srcdir/./config/pre.in:tests/dejagnu/Makefile.in:tests/dejagnu/deps:$srcdir/./config/post.in" ;;
     "tests/threads/Makefile") CONFIG_FILES="$CONFIG_FILES tests/threads/Makefile:$srcdir/./config/pre.in:tests/threads/Makefile.in:tests/threads/deps:$srcdir/./config/post.in" ;;
     "tests/shlib/Makefile") CONFIG_FILES="$CONFIG_FILES tests/shlib/Makefile:$srcdir/./config/pre.in:tests/shlib/Makefile.in:tests/shlib/deps:$srcdir/./config/post.in" ;;
     "tests/gss-threads/Makefile") CONFIG_FILES="$CONFIG_FILES tests/gss-threads/Makefile:$srcdir/./config/pre.in:tests/gss-threads/Makefile.in:tests/gss-threads/deps:$srcdir/./config/post.in" ;;
@@ -15169,7 +14095,6 @@
 if $ac_need_defaults; then
   test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files
   test "${CONFIG_HEADERS+set}" = set || CONFIG_HEADERS=$config_headers
-  test "${CONFIG_COMMANDS+set}" = set || CONFIG_COMMANDS=$config_commands
 fi
 
 # Have a temporary directory for convenience.  Make it in the build tree
@@ -15500,7 +14425,7 @@
 fi # test -n "$CONFIG_HEADERS"
 
 
-eval set X "  :F $CONFIG_FILES  :H $CONFIG_HEADERS    :C $CONFIG_COMMANDS"
+eval set X "  :F $CONFIG_FILES  :H $CONFIG_HEADERS    "
 shift
 for ac_tag
 do
@@ -15743,9 +14668,7 @@
   fi
  ;;
 
-  :C)  { $as_echo "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5
-$as_echo "$as_me: executing $ac_file commands" >&6;}
- ;;
+
   esac

_service:tar_scm:krb5-1.19.2.tar.gz/src/configure.ac -> _service:tar_scm:krb5-1.20.1.tar.gz/src/configure.ac Changed

@@ -98,7 +98,6 @@
 # configuration options.
 
 KRB5_LIB_AUX
-AC_KRB5_TCL
 AC_ARG_ENABLE(athena,
   --enable-athena         build with MIT Project Athena configuration,,)
 
@@ -123,8 +122,8 @@
 # Determine if NLS is desired and supported.
 po=
 AC_ARG_ENABLE(nls,
-AC_HELP_STRING(--disable-nls, disable native language support),
-              , enable_nls=check)
+  AS_HELP_STRING(--disable-nls, disable native language support),
+  , enable_nls=check)
 if test "$enable_nls" != no; then
   AC_CHECK_HEADER(libintl.h, 
     AC_SEARCH_LIBS(dgettext, intl, 
@@ -229,7 +228,9 @@
 # --with-vague-errors disables useful error messages.
 
 AC_ARG_WITH(vague-errors,
-AC_HELP_STRING(--with-vague-errors,Do not @<:@do@:>@ send helpful errors to client), , withval=no)
+  AS_HELP_STRING(--with-vague-errors,
+    Do not @<:@do@:>@ send helpful errors to client),
+  , withval=no)
 if test "$withval" = yes; then
 	AC_MSG_NOTICE(Supplying vague error messages to KDC clients)
 	AC_DEFINE(KRBCONF_VAGUE_ERRORS,1,Define if the KDC should return only vague error codes to clients)
@@ -238,8 +239,9 @@
 # Check which (if any) audit plugin to build
 audit_plugin=""
 AC_ARG_ENABLE(audit-plugin,
-AC_HELP_STRING(--enable-audit-plugin=IMPL,
-               use audit plugin @<:@ do not use audit @:>@), , enableval=no)
+  AS_HELP_STRING(--enable-audit-plugin=IMPL,
+    use audit plugin @<:@ do not use audit @:>@),
+  , enableval=no)
 if test "$enableval" != no; then
     case "$enableval" in
     simple)
@@ -261,44 +263,36 @@
 
 # WITH_CRYPTO_IMPL
 
-CRYPTO_IMPL="builtin"
+CRYPTO_IMPL=builtin
 AC_ARG_WITH(crypto-impl,
-AC_HELP_STRING(--with-crypto-impl=IMPL, use specified crypto implementation @<:@builtin@:>@),
-CRYPTO_IMPL=$withval
-AC_MSG_NOTICE(k5crypto will use '$withval')
-, withval=builtin)
-case "$withval" in
+  AS_HELP_STRING(--with-crypto-impl=IMPL,
+    use specified crypto implementation @<:@builtin@:>@),
+  CRYPTO_IMPL=$withval
+   AC_MSG_NOTICE(k5crypto will use '$withval'))
+
+CRYPTO_BUILTIN_TESTS=no
+case $CRYPTO_IMPL in
 builtin)
+  CRYPTO_BUILTIN_TESTS=yes
   ;;
 openssl)
   AC_CHECK_LIB(crypto, PKCS7_get_signer_info)
+  AC_DEFINE(CRYPTO_OPENSSL, 1, Define to use OpenSSL crypto library)
   ;;
 *)
   AC_MSG_ERROR(Unknown crypto implementation $withval)
   ;;
 esac
-AC_CONFIG_COMMANDS(CRYPTO_IMPL, , CRYPTO_IMPL=$CRYPTO_IMPL)
-AC_SUBST(CRYPTO_IMPL)
-AC_SUBST(CRYPTO_IMPL_CFLAGS)
-AC_SUBST(CRYPTO_IMPL_LIBS)
-
-AC_ARG_WITH(prng-alg,
-AC_HELP_STRING(--with-prng-alg=ALG, use specified PRNG algorithm. @<:@fortuna@:>@),
-PRNG_ALG=$withval
-AC_MSG_NOTICE(k5crypto will use '$withval')
-, PRNG_ALG=fortuna)
-AC_CONFIG_COMMANDS(PRNG_ALG, , PRNG_ALG=$PRNG_ALG)
-AC_SUBST(PRNG_ALG)
-if test "$PRNG_ALG" = fortuna; then
-	AC_DEFINE(FORTUNA,1,Define if Fortuna PRNG is selected)
-fi
+AC_SUBST(CRYPTO_IMPL_CFLAGS)
+AC_SUBST(CRYPTO_IMPL_LIBS)
+AC_SUBST(CRYPTO_BUILTIN_TESTS)
 
 # WITH_TLS_IMPL
 
 AC_ARG_WITH(tls-impl,
-AC_HELP_STRING(--with-tls-impl=IMPL,
-               use specified TLS implementation @<:@auto@:>@),
-TLS_IMPL=$withval,TLS_IMPL=auto)
+  AS_HELP_STRING(--with-tls-impl=IMPL,
+    use specified TLS implementation @<:@auto@:>@),
+  TLS_IMPL=$withval, TLS_IMPL=auto)
 case "$TLS_IMPL" in
 openssl|auto)
   AC_CHECK_LIB(ssl,SSL_CTX_new,have_lib_ssl=true,have_lib_ssl=false,
@@ -337,8 +331,8 @@
 AC_SUBST(TLS_IMPL_LIBS)
 
 AC_ARG_WITH(keyutils,
-AC_HELP_STRING(--without-keyutils,do not link with libkeyutils),
-            , with_keyutils=check)
+  AS_HELP_STRING(--without-keyutils, do not link with libkeyutils),
+  , with_keyutils=check)
 if test "$with_keyutils" != no; then
   have_keyutils=false
   AC_CHECK_HEADERS(keyutils.h,
@@ -361,8 +355,9 @@
 # and can support three NIST groups using OpenSSL.
 HAVE_SPAKE_OPENSSL=no
 AC_ARG_WITH(spake-openssl,
-AC_HELP_STRING(--with-spake-openssl,
-               use OpenSSL for SPAKE preauth @<:@auto@:>@),,withval=auto)
+  AS_HELP_STRING(--with-spake-openssl,
+    use OpenSSL for SPAKE preauth @<:@auto@:>@),
+  , withval=auto)
 if test "$withval" = auto -o "$withval" = yes; then
   AC_CHECK_LIB(crypto,EC_POINT_new,have_crypto=true,have_crypto=false)
   if test "$have_crypto" = true; then
@@ -377,8 +372,8 @@
 AC_SUBST(SPAKE_OPENSSL_LIBS)
 
 AC_ARG_ENABLE(aesni,
-AC_HELP_STRING(--disable-aesni,Do not build with AES-NI support), ,
-enable_aesni=check)
+  AS_HELP_STRING(--disable-aesni, Do not build with AES-NI support),
+  , enable_aesni=check)
 if test "$CRYPTO_IMPL" = builtin -a "x$enable_aesni" != xno; then
     case "$host" in
     i686-*)
@@ -415,9 +410,9 @@
 AC_SUBST(AESNI_FLAGS)
 
 AC_ARG_ENABLE(kdc-lookaside-cache,
-AC_HELP_STRING(--disable-kdc-lookaside-cache,
-               Disable the cache which detects client retransmits), ,
-               enableval=yes)
+  AS_HELP_STRING(--disable-kdc-lookaside-cache,
+    Disable the cache which detects client retransmits),
+  , enableval=yes)
 if test "$enableval" = no ; then
 	AC_DEFINE(NOCACHE,1,Define if the KDC should use no lookaside cache)
 fi
@@ -428,8 +423,8 @@
 # -fsanitize=address, and set ASAN=yes to suppress the undefined
 # symbols check when building shared libraries.
 AC_ARG_ENABLE(asan,
-AC_HELP_STRING(--enable-asan,Build with asan memory checking),,
-               enable_asan=no)
+  AS_HELP_STRING(--enable-asan, Build with asan memory checking),
+  , enable_asan=no)
 if test "$enable_asan" != no; then
     if test "$enable_asan" = yes; then
         enable_asan=address
@@ -444,14 +439,11 @@
 AC_SUBST(ASAN_FLAGS)
 AC_SUBST(ASAN)
 
-AC_TYPE_SIGNAL
-
 # from old include/configure.in
 AH_TEMPLATE(HAVE_STRUCT_SOCKADDR_STORAGE,
 Define if "struct sockaddr_storage" is available.)
 
 AC_CONFIG_HEADERS(include/autoconf.h, echo timestamp > include/autoconf.stamp)
-AC_PROG_LEX
 AC_C_CONST
 AC_HEADER_DIRENT
 AC_FUNC_STRERROR_R
@@ -513,42 +505,50 @@
 
 AC_MSG_CHECKING(return type of setrpcent)
 AC_CACHE_VAL(k5_cv_type_setrpcent,
-AC_TRY_COMPILE(#include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void setrpcent();,
-int i;, k5_cv_type_setrpcent=void, k5_cv_type_setrpcent=int))
+AC_COMPILE_IFELSE(
+  AC_LANG_SOURCE(#include <netdb.h>
+                    extern void setrpcent();),
+  k5_cv_type_setrpcent=void,
+  k5_cv_type_setrpcent=int))
 AC_MSG_RESULT($k5_cv_type_setrpcent)
 AC_DEFINE_UNQUOTED(SETRPCENT_TYPE, $k5_cv_type_setrpcent, Define as return type of setrpcent)
 
 AC_MSG_CHECKING(return type of endrpcent)
 AC_CACHE_VAL(k5_cv_type_endrpcent,
-AC_TRY_COMPILE(#include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void endrpcent();,
-int i;, k5_cv_type_endrpcent=void, k5_cv_type_endrpcent=int))
+AC_COMPILE_IFELSE(
+  AC_LANG_SOURCE(
+    #include <netdb.h>
+      extern void endrpcent();),
+  k5_cv_type_endrpcent=void, k5_cv_type_endrpcent=int))
 AC_MSG_RESULT($k5_cv_type_endrpcent)
 AC_DEFINE_UNQUOTED(ENDRPCENT_TYPE, $k5_cv_type_endrpcent, Define as return type of endrpcent)
 
 
 # bswap_16 is a macro in byteswap.h under GNU libc
 AC_MSG_CHECKING(for bswap_16)
-AC_CACHE_VAL(krb5_cv_bswap_16,
-AC_TRY_LINK(#if HAVE_BYTESWAP_H
-#include <byteswap.h>
-#endif,bswap_16(37);,krb5_cv_bswap_16=yes,krb5_cv_bswap_16=no))
+AC_CACHE_VAL(krb5_cv_bswap_16,
+AC_LINK_IFELSE(
+  AC_LANG_PROGRAM(
+    #if HAVE_BYTESWAP_H
+      #include <byteswap.h>
+      #endif
+    ,
+    bswap_16(37);),
+  krb5_cv_bswap_16=yes, krb5_cv_bswap_16=no))
 AC_MSG_RESULT($krb5_cv_bswap_16)
 if test "$krb5_cv_bswap_16" = yes; then
   AC_DEFINE(HAVE_BSWAP_16,1,Define to 1 if bswap_16 is available via byteswap.h)
 fi
 AC_MSG_CHECKING(for bswap_64)
-AC_CACHE_VAL(krb5_cv_bswap_64,
-AC_TRY_LINK(#if HAVE_BYTESWAP_H
-#include <byteswap.h>
-#endif,bswap_64(37);,krb5_cv_bswap_64=yes,krb5_cv_bswap_64=no))
+AC_CACHE_VAL(krb5_cv_bswap_64,
+AC_LINK_IFELSE(
+  AC_LANG_PROGRAM(
+    #if HAVE_BYTESWAP_H
+      #include <byteswap.h>
+      #endif
+    ,
+    bswap_64(37);),
+  krb5_cv_bswap_64=yes, krb5_cv_bswap_64=no))
 AC_MSG_RESULT($krb5_cv_bswap_64)
 if test "$krb5_cv_bswap_64" = yes; then
   AC_DEFINE(HAVE_BSWAP_64,1,Define to 1 if bswap_64 is available via byteswap.h)
@@ -581,18 +581,22 @@
 if test "$ac_cv_func_gethostbyname_r" = yes; then
   AC_MSG_CHECKING(if gethostbyname_r returns an int)
   AC_CACHE_VAL(krb5_cv_gethostbyname_r_returns_int,
-  AC_TRY_COMPILE(#include <netdb.h>
-  extern int gethostbyname_r ();, 1;,
-  krb5_cv_gethostbyname_r_returns_int=yes,
-  krb5_cv_gethostbyname_r_returns_int=no))
+  AC_COMPILE_IFELSE(
+    AC_LANG_SOURCE(
+      #include <netdb.h>
+        extern int gethostbyname_r();),
+    krb5_cv_gethostbyname_r_returns_int=yes,
+    krb5_cv_gethostbyname_r_returns_int=no))
   AC_MSG_RESULT($krb5_cv_gethostbyname_r_returns_int)
 
   AC_MSG_CHECKING(if gethostbyname_r returns a pointer)
   AC_CACHE_VAL(krb5_cv_gethostbyname_r_returns_ptr,
-  AC_TRY_COMPILE(#include <netdb.h>
-  extern struct hostent *gethostbyname_r ();, 1;,
-  krb5_cv_gethostbyname_r_returns_ptr=yes,
-  krb5_cv_gethostbyname_r_returns_ptr=no))
+  AC_COMPILE_IFELSE(
+    AC_LANG_SOURCE(
+      #include <netdb.h>
+        extern struct hostent *gethostbyname_r();),
+    krb5_cv_gethostbyname_r_returns_ptr=yes,
+    krb5_cv_gethostbyname_r_returns_ptr=no))
   AC_MSG_RESULT($krb5_cv_gethostbyname_r_returns_ptr)
 
   if test "$krb5_cv_gethostbyname_r_returns_int" = "$krb5_cv_gethostbyname_r_returns_ptr"; then
@@ -619,12 +623,16 @@
 if test "$ac_cv_func_getpwnam_r" = yes; then
   AC_MSG_CHECKING(return type of getpwnam_r)
   AC_CACHE_VAL(krb5_cv_getpwnam_r_return_type,
-  AC_TRY_COMPILE(#include <pwd.h>
-   extern int getpwnam_r();, 1;,
-   getpwnam_r_returns_int=yes,getpwnam_r_returns_int=no)
-   AC_TRY_COMPILE(#include <pwd.h>
-   extern struct passwd *getpwnam_r();, 1;,
-   getpwnam_r_returns_ptr=yes,getpwnam_r_returns_ptr=no)
+  AC_COMPILE_IFELSE(
+    AC_LANG_SOURCE(
+      #include <pwd.h>
+        extern int getpwnam_r();),
+    getpwnam_r_returns_int=yes, getpwnam_r_returns_int=no)
+   AC_COMPILE_IFELSE(
+    AC_LANG_SOURCE(
+      #include <pwd.h>
+        extern struct passwd *getpwnam_r();),
+    getpwnam_r_returns_ptr=yes, getpwnam_r_returns_ptr=no)
    case "$getpwnam_r_returns_int/$getpwnam_r_returns_ptr" in
      yes/no) krb5_cv_getpwnam_r_return_type=int ;;
      no/yes) krb5_cv_getpwnam_r_return_type=ptr ;;
@@ -641,12 +649,19 @@
 if test "$ac_cv_func_getpwnam_r" = yes; then
   AC_MSG_CHECKING(number of arguments to getpwnam_r)
   AC_CACHE_VAL(krb5_cv_getpwnam_r_args,
-  AC_TRY_COMPILE(#include <pwd.h>
-   struct passwd pwx; char buf1024;,
-   getpwnam_r("", &pwx, buf, sizeof(buf));, args4=yes, args4=no)
-   AC_TRY_COMPILE(#include <pwd.h>
-   struct passwd pwx, *p; char buf1024;,
-   getpwnam_r("", &pwx, buf, sizeof(buf), &p);, args5=yes, args5=no)
+  AC_COMPILE_IFELSE(
+    AC_LANG_PROGRAM(
+      #include <pwd.h>
+        struct passwd pwx; char buf1024;,
+      getpwnam_r("", &pwx, buf, sizeof(buf));),
+    args4=yes, args4=no)
+   AC_COMPILE_IFELSE(
+     AC_LANG_PROGRAM(
+       #include <pwd.h>
+         struct passwd pwx, *p;
+         char buf1024;,
+       getpwnam_r("", &pwx, buf, sizeof(buf), &p);),
+     args5=yes, args5=no)
    case $args4/$args5 in
      yes/no) krb5_cv_getpwnam_r_args=4 ;;
      no/yes) krb5_cv_getpwnam_r_args=5 ;;
@@ -683,10 +698,16 @@
 if test "$ac_cv_func_gmtime_r" = yes; then
   AC_MSG_CHECKING(whether gmtime_r returns int)
   AC_CACHE_VAL(krb5_cv_gmtime_r_returns_int,
-  AC_TRY_COMPILE(#include <time.h>
-   extern int gmtime_r ();, 1;, return_int=yes, return_int=no)
-   AC_TRY_COMPILE(#include <time.h>
-   extern struct tm *gmtime_r ();, 1;, return_ptr=yes, return_ptr=no)
+  AC_COMPILE_IFELSE(
+    AC_LANG_SOURCE(
+      #include <time.h>
+        extern int gmtime_r();),
+    return_int=yes, return_int=no)
+   AC_COMPILE_IFELSE(
+     AC_LANG_SOURCE(
+       #include <time.h>
+         extern struct tm *gmtime_r();),
+     return_ptr=yes, return_ptr=no)
    case $return_int/$return_ptr in
      yes/no) krb5_cv_gmtime_r_returns_int=yes ;;
      no/yes) krb5_cv_gmtime_r_returns_int=no ;;
@@ -708,18 +729,22 @@
 if test "$ac_cv_func_getservbyname_r" = yes; then
   AC_MSG_CHECKING(if getservbyname_r returns an int)
   AC_CACHE_VAL(krb5_cv_getservbyname_r_returns_int,
-  AC_TRY_COMPILE(#include <netdb.h>
-  extern int getservbyname_r ();, 1;,
-  krb5_cv_getservbyname_r_returns_int=yes,
-  krb5_cv_getservbyname_r_returns_int=no))
+  AC_COMPILE_IFELSE(
+    AC_LANG_SOURCE(
+      #include <netdb.h>
+        extern int getservbyname_r();),
+    krb5_cv_getservbyname_r_returns_int=yes,
+    krb5_cv_getservbyname_r_returns_int=no))
   AC_MSG_RESULT($krb5_cv_getservbyname_r_returns_int)
 
   AC_MSG_CHECKING(if getservbyname_r returns a pointer)
   AC_CACHE_VAL(krb5_cv_getservbyname_r_returns_ptr,
-  AC_TRY_COMPILE(#include <netdb.h>
-  extern struct servent *getservbyname_r ();, 1;,
-  krb5_cv_getservbyname_r_returns_ptr=yes,
-  krb5_cv_getservbyname_r_returns_ptr=no))
+  AC_COMPILE_IFELSE(
+    AC_LANG_SOURCE(
+      #include <netdb.h>
+        extern struct servent *getservbyname_r();),
+    krb5_cv_getservbyname_r_returns_ptr=yes,
+    krb5_cv_getservbyname_r_returns_ptr=no))
   AC_MSG_RESULT($krb5_cv_getservbyname_r_returns_ptr)
 
   if test "$krb5_cv_getservbyname_r_returns_int" = "$krb5_cv_getservbyname_r_returns_ptr"; then
@@ -736,7 +761,6 @@
 fi
 )
 
-HAVE_YYLINENO
 CHECK_DIRENT
 AC_TYPE_UID_T
 
@@ -744,27 +768,27 @@
 AC_CHECK_FUNC(tcsetattr,
   AC_DEFINE(POSIX_TERMIOS,1,Define if termios.h exists and tcsetattr exists)))
 
-KRB5_SIGTYPE
 AC_CHECK_HEADERS(poll.h stdlib.h string.h stddef.h sys/types.h sys/file.h sys/param.h sys/stat.h sys/time.h netinet/in.h sys/uio.h sys/filio.h sys/select.h time.h paths.h errno.h)
 
 # If compiling with IPv6 support, test if in6addr_any functions.
 # Irix 6.5.16 defines it, but lacks support in the C library.
 if test $krb5_cv_inet6 = yes || test "$krb5_cv_inet6_with_dinet6" = yes ; then
-AC_CACHE_CHECK(for in6addr_any definition in library,
-  krb5_cv_var_in6addr_any,
-AC_TRY_LINK(
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netdb.h>
-#include <stdio.h>
-,
-  struct sockaddr_in6 in;
-  in.sin6_addr = in6addr_any;
-  printf("%x", &in);
-,krb5_cv_var_in6addr_any=yes, krb5_cv_var_in6addr_any=no))
+  AC_CACHE_CHECK(for in6addr_any definition in library,
+  krb5_cv_var_in6addr_any,
+  AC_LINK_IFELSE(
+    AC_LANG_PROGRAM(
+      #ifdef HAVE_SYS_TYPES_H
+        #include <sys/types.h>
+        #endif
+        #include <sys/socket.h>
+        #include <netinet/in.h>
+        #include <netdb.h>
+        #include <stdio.h>
+      ,
+      struct sockaddr_in6 in;
+        in.sin6_addr = in6addr_any;
+        printf("%x", &in);),
+    krb5_cv_var_in6addr_any=yes, krb5_cv_var_in6addr_any=no))
   if test $krb5_cv_var_in6addr_any = no; then
     AC_DEFINE(NEED_INSIXADDR_ANY,1,Define if in6addr_any is not defined in libc)
   fi
@@ -772,7 +796,6 @@
 
 # then from osconf.h, we have
 
-AC_HEADER_TIME
 AC_CHECK_TYPE(time_t, long)
 AC_CHECK_SIZEOF(time_t)
 SIZEOF_TIME_T=$ac_cv_sizeof_time_t
@@ -799,11 +822,13 @@
 
 AC_MSG_CHECKING(for socklen_t)
 AC_CACHE_VAL(krb5_cv_has_type_socklen_t,
-AC_TRY_COMPILE(
-#include <sys/types.h>
-#include <sys/socket.h>
-,sizeof (socklen_t);,
-krb5_cv_has_type_socklen_t=yes,krb5_cv_has_type_socklen_t=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <sys/types.h>
+      #include <sys/socket.h>
+    ,
+    sizeof(socklen_t);),
+  krb5_cv_has_type_socklen_t=yes, krb5_cv_has_type_socklen_t=no))
 AC_MSG_RESULT($krb5_cv_has_type_socklen_t)
 if test $krb5_cv_has_type_socklen_t = yes; then
     AC_DEFINE(HAVE_SOCKLEN_T,1,Define if there is a socklen_t type. If not, probably use size_t)
@@ -811,11 +836,13 @@
 
 AC_MSG_CHECKING(for struct lifconf)
 AC_CACHE_VAL(krb5_cv_has_struct_lifconf,
-AC_TRY_COMPILE(
-#include <sys/socket.h>
-#include <net/if.h>
-,sizeof (struct lifconf);,
-krb5_cv_has_struct_lifconf=yes,krb5_cv_has_struct_lifconf=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <sys/socket.h>
+      #include <net/if.h>
+    ,
+    sizeof (struct lifconf);),
+  krb5_cv_has_struct_lifconf=yes, krb5_cv_has_struct_lifconf=no))
 AC_MSG_RESULT($krb5_cv_has_struct_lifconf)
 if test $krb5_cv_has_struct_lifconf = yes; then
     AC_DEFINE(HAVE_STRUCT_LIFCONF,1,Define if there is a struct lifconf.)
@@ -823,12 +850,15 @@
 # HP-UX 11 uses stuct if_laddrconf
 AC_MSG_CHECKING(for struct if_laddrconf)
 AC_CACHE_VAL(krb5_cv_has_struct_if_laddrconf,
-AC_TRY_COMPILE(
-#include <sys/socket.h>
-#include <net/if.h>
-#include <net/if6.h>
-,sizeof (struct if_laddrconf);,
-krb5_cv_has_struct_if_laddrconf=yes,krb5_cv_has_struct_if_laddrconf=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <sys/socket.h>
+      #include <net/if.h>
+      #include <net/if6.h>
+    ,
+    sizeof(struct if_laddrconf);),
+  krb5_cv_has_struct_if_laddrconf=yes,
+  krb5_cv_has_struct_if_laddrconf=no))
 AC_MSG_RESULT($krb5_cv_has_struct_if_laddrconf)
 if test $krb5_cv_has_struct_if_laddrconf = yes; then
     AC_DEFINE(HAVE_STRUCT_IF_LADDRCONF,1,Define if there is a struct if_laddrconf.)
@@ -837,10 +867,12 @@
 
 AC_MSG_CHECKING(for h_errno in netdb.h)
 AC_CACHE_VAL(krb5_cv_header_netdb_h_h_errno,
-AC_TRY_COMPILE(
-	#include <netdb.h>,
-	int x = h_errno;, krb5_cv_header_netdb_h_h_errno=yes,
-	krb5_cv_header_netdb_h_h_errno=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <netdb.h>,
+    int x = h_errno;),
+    krb5_cv_header_netdb_h_h_errno=yes,
+    krb5_cv_header_netdb_h_h_errno=no))
 AC_MSG_RESULT($krb5_cv_header_netdb_h_h_errno)
 if test $krb5_cv_header_netdb_h_h_errno = yes; then
     AC_DEFINE(HAVE_NETDB_H_H_ERRNO, 1,
@@ -881,13 +913,6 @@
 AC_CHECK_SIZEOF(size_t)
 AC_CHECK_TYPES(__int128_t, __uint128_t)
 
-# stuff for util/profile
-
-# AC_KRB5_TCL already done
-DO_TCL=
-test "$TCL_LIBS" != "" && DO_TCL=ok
-AC_SUBST(DO_TCL)
-
 # types libdb2 wants
 
 AC_CHECK_TYPES(ssize_t, u_char, u_int, u_long, u_int8_t, u_int16_t, u_int32_t, int8_t, int16_t, int32_t)
@@ -913,23 +938,25 @@
 # to ANSI/ISO C 1999 specification).  Specifically, positional
 # specifications; not checking for other features like %zx at present.
 AC_MSG_CHECKING(for POSIX printf positional specification support)
-AC_CACHE_VAL(ac_cv_printf_positional,
-AC_TRY_RUN(
-#include <stdio.h>
-#include <string.h>
-const char expected = "200 100";
-int main () {
-    char buf30;
-    sprintf(buf, "%2\$x %1\$d", 100, 512);
-    if (strcmp(expected, buf)) {
-	fprintf(stderr,"bad result: <%s> wanted: <%s>\n", buf, expected);
-	return 1;
-    }
-    return 0;
-},
-  ac_cv_printf_positional=yes,
-  ac_cv_printf_positional=no,
-  AC_MSG_ERROR(Cannot test for printf positional argument support when cross compiling)))
+AC_CACHE_VAL(ac_cv_printf_positional,
+AC_RUN_IFELSE(
+  AC_LANG_SOURCE(
+    #include <stdio.h>
+      #include <string.h>
+      const char expected = "200 100";
+      int main()
+      {
+          char buf30;
+          sprintf(buf, "%2\$x %1\$d", 100, 512);
+          if (strcmp(expected, buf)) {
+              fprintf(stderr, "bad result: <%s> wanted: <%s>\n",
+                      buf, expected);
+              return 1;
+          }
+          return 0;
+      }),
+  ac_cv_printf_positional=yes, ac_cv_printf_positional=no,
+  AC_MSG_ERROR(Cannot test for printf positional argument support when cross compiling)))
 # Nothing for autoconf.h for now.
 AC_MSG_RESULT($ac_cv_printf_positional)
 
@@ -946,33 +973,9 @@
 AC_ARG_ENABLE(athena,
   --enable-athena         build with MIT Project Athena configuration,
 ath_compat=compat,)
-# The following are tests for the presence of programs required for
-# kadmin testing.
-AC_CHECK_PROG(have_RUNTEST,runtest,runtest)
-AC_CHECK_PROG(have_PERL,perl,perl)
-if test "$have_PERL" = perl -a "$have_RUNTEST" = runtest -a "$TCL_LIBS" != ""; then
-	DO_TEST=ok
-fi
-AC_SUBST(DO_TEST)
-
-# The following are substituted into kadmin/testing/scripts/env-setup.sh
-RBUILD=`pwd`
-AC_SUBST(RBUILD)
-case "$srcdir" in
-/*)	S_TOP=$srcdir ;;
-*)	S_TOP=`pwd`/$srcdir ;;
-esac
-AC_SUBST(S_TOP)
-AC_PATH_PROG(EXPECT,expect)
-# For kadmin/testing/util/Makefile.in
-if test "$TCL_LIBS" != "" ;  then
-	DO_ALL=tcl
-fi
-AC_SUBST(DO_ALL)
+
 KRB5_AC_PRIOCNTL_HACK
-K5_GEN_FILE(kadmin/testing/scripts/env-setup.sh:kadmin/testing/scripts/env-setup.shin)
-# for lib/kadm5
-AC_CHECK_PROG(RUNTEST,runtest,runtest)
+
 AC_CHECK_PROG(PERL,perl,perl)
 
 # lib/gssapi
@@ -999,19 +1002,33 @@
 # STRUCT_RPCENT_IN_RPC_NETDB_H anyway.
 
 AC_MSG_CHECKING(where struct rpcent is declared)
-AC_TRY_COMPILE(#include <netdb.h>,
-struct rpcent e;
-char c = e.r_name0;
-int i = e.r_number;,
-AC_TRY_COMPILE(#include <rpc/netdb.h>,
-struct rpcent e;
-char c = e.r_name0;
-int i = e.r_number;,
-AC_MSG_RESULT(rpc/netdb.h)
-rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H',
-AC_MSG_RESULT(netdb.h)),
-AC_MSG_RESULT(nowhere)
-rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H')
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <netdb.h>
+    ,
+    struct rpcent e;
+      char c = e.r_name0;
+      int i = e.r_number;),
+    netdb_rpcent=yes, netdb_rpcent=no)
+if test "$netdb_rpcent" = yes; then
+  AC_COMPILE_IFELSE(
+    AC_LANG_PROGRAM(
+      #include <rpc/netdb.h>
+      ,
+      struct rpcent e;
+        char c = e.r_name0;
+        int i = e.r_number;),
+    rpc_netdb_rpcent=yes, rpc_netdb_rpcent=no)
+  if test "$rpc_netdb_rpcent" = yes; then
+    AC_MSG_RESULT(rpc/netdb.h)
+    rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H'
+  else
+    AC_MSG_RESULT(netdb.h)
+  fi
+else
+  AC_MSG_RESULT(nowhere)
+  rpcent_define='#define STRUCT_RPCENT_IN_RPC_NETDB_H'
+fi
 AC_SUBST(rpcent_define)
 
 AC_CHECK_HEADERS(sys/select.h sys/time.h unistd.h)
@@ -1035,15 +1052,21 @@
 AC_SUBST(GSSRPC__UNISTD_H)
 
 AC_CACHE_CHECK(for MAXHOSTNAMELEN in sys/param.h,
-  krb5_cv_header_sys_param_h_maxhostnamelen,
-  AC_TRY_COMPILE(#include <sys/param.h>,
-    int i = MAXHOSTNAMELEN;,
+krb5_cv_header_sys_param_h_maxhostnamelen,
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <sys/param.h>
+    ,
+    int i = MAXHOSTNAMELEN;),
     krb5_cv_header_sys_param_h_maxhostnamelen=yes,
     krb5_cv_header_sys_param_h_maxhostnamelen=no))
 AC_CACHE_CHECK(for MAXHOSTNAMELEN in netdb.h,
-  krb5_cv_header_netdb_h_maxhostnamelen,
-  AC_TRY_COMPILE(#include <netdb.h>,
-    int i = MAXHOSTNAMELEN;,
+krb5_cv_header_netdb_h_maxhostnamelen,
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <netdb.h>
+    ,
+    int i = MAXHOSTNAMELEN;),
     krb5_cv_header_netdb_h_maxhostnamelen=yes,
     krb5_cv_header_netdb_h_maxhostnamelen=no))
 
@@ -1062,14 +1085,17 @@
 AC_SUBST(GSSRPC__NETDB_H)
 
 AC_CACHE_CHECK(for BSD type aliases, krb5_cv_type_bsdaliases,
-  AC_TRY_COMPILE(
-    #include <sys/types.h>
-#if HAVE_UNISTD_H
-#include <unistd.h>
-#endif,
-    u_char c;
-u_int i;
-u_long l;, krb5_cv_type_bsdaliases=yes, krb5_cv_type_bsdaliases=no))
+AC_COMPILE_IFELSE(
+  AC_LANG_PROGRAM(
+    #include <sys/types.h>
+      #if HAVE_UNISTD_H
+      #include <unistd.h>
+      #endif
+    ,
+    u_char c;
+      u_int i;
+      u_long l;),
+  krb5_cv_type_bsdaliases=yes, krb5_cv_type_bsdaliases=no))
 if test $krb5_cv_type_bsdaliases = yes; then
   GSSRPC__BSD_TYPEALIASES='/* #undef GSSRPC__BSD_TYPEALIASES */'
 else
@@ -1079,23 +1105,21 @@
 
 AC_MSG_CHECKING(return type of setrpcent)
 AC_CACHE_VAL(k5_cv_type_setrpcent,
-AC_TRY_COMPILE(#include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void setrpcent();,
-int i;, k5_cv_type_setrpcent=void, k5_cv_type_setrpcent=int))
+AC_COMPILE_IFELSE(
+  AC_LANG_SOURCE(
+    #include <netdb.h>
+      extern void setrpcent();),
+  k5_cv_type_setrpcent=void, k5_cv_type_setrpcent=int))
 AC_MSG_RESULT($k5_cv_type_setrpcent)
 AC_DEFINE_UNQUOTED(SETRPCENT_TYPE, $k5_cv_type_setrpcent, Define as return type of setrpcent)
 
 AC_MSG_CHECKING(return type of endrpcent)
 AC_CACHE_VAL(k5_cv_type_endrpcent,
-AC_TRY_COMPILE(#include <netdb.h>
-#ifdef __cplusplus
-extern "C"
-#endif
-extern void endrpcent();,
-int i;, k5_cv_type_endrpcent=void, k5_cv_type_endrpcent=int))
+AC_COMPILE_IFELSE(
+  AC_LANG_SOURCE(
+    #include <netdb.h>
+      extern void endrpcent();),
+  k5_cv_type_endrpcent=void, k5_cv_type_endrpcent=int))
 AC_MSG_RESULT($k5_cv_type_endrpcent)
 AC_DEFINE_UNQUOTED(ENDRPCENT_TYPE, $k5_cv_type_endrpcent, Define as return type of endrpcent)
 K5_GEN_FILE(include/gssrpc/types.h:include/gssrpc/types.hin)
@@ -1114,6 +1138,7 @@
 ), k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no))
   old_LIBS="$LIBS"
   AC_CHECK_LIB(crypto, PKCS7_get_signer_info)
+  AC_CHECK_FUNCS(EVP_PKEY_get_bn_param)
   LIBS="$old_LIBS"
 fi
 if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then
@@ -1133,14 +1158,6 @@
 # for lib/apputils
 AC_REPLACE_FUNCS(daemon)
 
-# for tests/
-if test x"$RUNTEST" != x; then
-	HAVE_RUNTEST=yes
-else
-	HAVE_RUNTEST=no
-fi
-AC_SUBST(HAVE_RUNTEST)
-
 # For Python tests.  Python version 3.2.4 is required as prior
 # versions do not accept string input to subprocess.Popen.communicate
 # when universal_newlines is set.
@@ -1200,14 +1217,9 @@
 
 
 
-# Check for thread safety issues.
-# (Is there a better place for this?)
-# tsfuncs="getpwnam_r getpwuid_r gethostbyname_r getservbyname_r gmtime_r localtime_r"
-# Removed getpwnam_r and getpwuid_r because include/configure.in has some
-# more careful checks, and may decide to pretend that they're not found if
-# the function signatures can't be figured out.
-tsfuncs="gethostbyname_r getservbyname_r gmtime_r localtime_r"
-AC_CHECK_FUNCS($tsfuncs)
+# Warn about possible thread safety issues.  These functions have all
+# been checked for previously.
+tsfuncs="getpwnam_r getpwuid_r gethostbyname_r getservbyname_r gmtime_r localtime_r"
 if test "$enable_thread_support" = yes; then
   tsmissing=""
   for ts in $tsfuncs; do
@@ -1264,7 +1276,7 @@
     if test "$BER_OKAY" = "1"; then
       LDAP_LIBS='-lldap -llber'
     else
-      AC_ERROR("BER library missing - cannot build LDAP database module")
+      AC_MSG_ERROR("BER library missing - cannot build LDAP database module")
     fi
   fi
   AC_DEFINE(ENABLE_LDAP, 1, Define if LDAP KDB support within the Kerberos library (mainly ASN.1 code) should be enabled.)
@@ -1301,9 +1313,9 @@
 lmdb_plugin_dir=""
 HAVE_LMDB=no
 AC_ARG_WITH(lmdb,
-AC_HELP_STRING(--with-lmdb,
-	    compile LMDB database backend module @<:@auto@:>@),,
-	    withval=auto)
+  AS_HELP_STRING(--with-lmdb,
+    compile LMDB database backend module @<:@auto@:>@),
+  , withval=auto)
 if test "$withval" = auto -o "$withval" = yes; then
   AC_CHECK_LIB(lmdb,mdb_env_create,have_lmdb=true,have_lmdb=false)
   if test "$have_lmdb" = true; then
@@ -1327,13 +1339,12 @@
 
 # Compile with libedit support in ss by default if available.  Compile
 # with readline only if asked, to avoid a default GPL dependency.
-# Building with readline also breaks the dejagnu test suite.
 AC_ARG_WITH(libedit,
-	    AC_HELP_STRING(--without-libedit, do not compile with libedit),
-	    , with_libedit=default)
+  AS_HELP_STRING(--without-libedit, do not compile with libedit),
+  , with_libedit=default)
 AC_ARG_WITH(readline,
-	    AC_HELP_STRING(--with-readline, compile with GNU Readline),
-	    , with_readline=no)
+  AS_HELP_STRING(--with-readline, compile with GNU Readline),
+  , with_readline=no)
 if test "x$with_readline" = xyes; then
   with_libedit=no
 fi
@@ -1365,7 +1376,7 @@
 AC_SUBST(RL_LIBS)
 
 AC_ARG_WITH(system-verto,
-  AC_HELP_STRING(--with-system-verto, always use system verto library),
+  AS_HELP_STRING(--with-system-verto, always use system verto library),
   , with_system_verto=default)
 VERTO_VERSION=k5
 if test "x$with_system_verto" != xno; then
@@ -1410,9 +1421,9 @@
 AC_ARG_VAR(DEFKTNAME, Default keytab name)
 AC_ARG_VAR(DEFCKTNAME, Default client keytab name)
 AC_ARG_WITH(krb5-config,
-	AC_HELP_STRING(--with-krb5-config=PATH,
-		path to existing krb5-config program for defaults), ,
-        with_krb5_config=krb5-config)
+  AS_HELP_STRING(--with-krb5-config=PATH,
+    path to existing krb5-config program for defaults),
+  , with_krb5_config=krb5-config)
 if test "x$with_krb5_config" != xno; then
 	if test "x$with_krb5_config" = xyes; then
 		with_krb5_config=krb5-config
@@ -1473,14 +1484,14 @@
 
 	lib lib/kdb
 
-	lib/crypto lib/crypto/krb lib/crypto/$CRYPTO_IMPL
-	lib/crypto/$CRYPTO_IMPL/enc_provider
-	lib/crypto/$CRYPTO_IMPL/hash_provider
-	lib/crypto/$CRYPTO_IMPL/des
-	lib/crypto/$CRYPTO_IMPL/md4 lib/crypto/$CRYPTO_IMPL/md5
-        lib/crypto/$CRYPTO_IMPL/sha1 lib/crypto/$CRYPTO_IMPL/sha2
-	lib/crypto/$CRYPTO_IMPL/aes lib/crypto/$CRYPTO_IMPL/camellia
-	lib/crypto/crypto_tests
+	lib/crypto lib/crypto/krb lib/crypto/crypto_tests
+	lib/crypto/builtin lib/crypto/builtin/des
+	lib/crypto/builtin/aes lib/crypto/builtin/camellia
+	lib/crypto/builtin/md4 lib/crypto/builtin/md5
+	lib/crypto/builtin/sha1 lib/crypto/builtin/sha2
+	lib/crypto/builtin/enc_provider lib/crypto/builtin/hash_provider
+	lib/crypto/openssl lib/crypto/openssl/des
+	lib/crypto/openssl/enc_provider lib/crypto/openssl/hash_provider
 
 	lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache
 	lib/krb5/keytab lib/krb5/krb lib/krb5/rcache lib/krb5/os
@@ -1491,7 +1502,7 @@
 
 	lib/rpc lib/rpc/unit-test
 
-	lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/unit-test
+	lib/kadm5 lib/kadm5/clnt lib/kadm5/srv
 	lib/krad
 	lib/apputils
 
@@ -1527,7 +1538,6 @@
 	clients/kdestroy clients/kpasswd clients/ksu clients/kswitch
 
 	kadmin kadmin/cli kadmin/dbutil kadmin/ktutil kadmin/server
-	kadmin/testing kadmin/testing/scripts kadmin/testing/util
 
 	appl
 	appl/sample appl/sample/sclient appl/sample/sserver
@@ -1535,5 +1545,5 @@
 	appl/gss-sample appl/user_user
 
 	tests tests/asn.1 tests/create tests/hammer tests/verify tests/gssapi
-	tests/dejagnu tests/threads tests/shlib tests/gss-threads tests/misc
+	tests/threads tests/shlib tests/gss-threads tests/misc
 )

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/autoconf.h.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/autoconf.h.in Changed

@@ -20,6 +20,9 @@
 /* Define if __attribute__((constructor)) works */
 #undef CONSTRUCTOR_ATTR_WORKS
 
+/* Define to use OpenSSL crypto library */
+#undef CRYPTO_OPENSSL
+
 /* Define to default ccache name */
 #undef DEFCCNAME
 
@@ -51,9 +54,6 @@
 /* Define as return type of endrpcent */
 #undef ENDRPCENT_TYPE
 
-/* Define if Fortuna PRNG is selected */
-#undef FORTUNA
-
 /* Define to the type of elements in the array set by `getgroups'. Usually
    this is either `int' or `gid_t'. */
 #undef GETGROUPS_T
@@ -153,6 +153,9 @@
 /* Define to 1 if you have the <errno.h> header file. */
 #undef HAVE_ERRNO_H
 
+/* Define to 1 if you have the `EVP_PKEY_get_bn_param' function. */
+#undef HAVE_EVP_PKEY_GET_BN_PARAM
+
 /* Define to 1 if you have the `explicit_bzero' function. */
 #undef HAVE_EXPLICIT_BZERO
 
@@ -542,12 +545,6 @@
 /* Define to 1 if you have the <sys/uio.h> header file. */
 #undef HAVE_SYS_UIO_H
 
-/* Define if tcl.h found */
-#undef HAVE_TCL_H
-
-/* Define if tcl/tcl.h found */
-#undef HAVE_TCL_TCL_H
-
 /* Define to 1 if you have the `timegm' function. */
 #undef HAVE_TIMEGM
 
@@ -639,9 +636,6 @@
 /* Define if references to pthread routines should be non-weak. */
 #undef NO_WEAK_PTHREADS
 
-/* Define if lex produes code with yylineno */
-#undef NO_YYLINENO
-
 /* Define to the address where bug reports for this package should be sent. */
 #undef PACKAGE_BUGREPORT
 
@@ -666,9 +660,6 @@
 /* Define if POSIX signal handling is used */
 #undef POSIX_SIGNALS
 
-/* Define if POSIX signal handlers are used */
-#undef POSIX_SIGTYPE
-
 /* Define if termios.h exists and tcsetattr exists */
 #undef POSIX_TERMIOS
 
@@ -676,9 +667,6 @@
    your system. */
 #undef PTHREAD_CREATE_JOINABLE
 
-/* Define as the return type of signal handlers (`int' or `void'). */
-#undef RETSIGTYPE
-
 /* Define as return type of setrpcent */
 #undef SETRPCENT_TYPE
 
@@ -703,9 +691,6 @@
 /* Define if sys_errlist is defined in errno.h */
 #undef SYS_ERRLIST_DECLARED
 
-/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
-#undef TIME_WITH_SYS_TIME
-
 /* Define if no TLS implementation is selected */
 #undef TLS_IMPL_NONE
 
@@ -733,10 +718,6 @@
 /* Define if wait takes int as a argument */
 #undef WAIT_USES_INT
 
-/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
-   `char'. */
-#undef YYTEXT_POINTER
-
 /* Define to enable extensions in glibc */
 #undef _GNU_SOURCE
 
@@ -755,9 +736,6 @@
 #undef inline
 #endif
 
-/* Define krb5_sigtype to type of signal handler */
-#undef krb5_sigtype
-
 /* Define to `int' if <sys/types.h> does not define. */
 #undef mode_t

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/gssrpc/auth.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/gssrpc/auth.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/gssrpc/rename.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/gssrpc/rename.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/gssrpc/svc.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/gssrpc/svc.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/gssrpc/types.hin -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/gssrpc/types.hin Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/k5-gmt_mktime.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/k5-gmt_mktime.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/k5-int-pkinit.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/k5-int-pkinit.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/k5-int.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/k5-int.h Changed

@@ -205,6 +205,7 @@
 #define KRB5_CONF_DISABLE_ENCRYPTED_TIMESTAMP  "disable_encrypted_timestamp"
 #define KRB5_CONF_DISABLE_LAST_SUCCESS         "disable_last_success"
 #define KRB5_CONF_DISABLE_LOCKOUT              "disable_lockout"
+#define KRB5_CONF_DISABLE_PAC                  "disable_pac"
 #define KRB5_CONF_DNS_CANONICALIZE_HOSTNAME    "dns_canonicalize_hostname"
 #define KRB5_CONF_DNS_FALLBACK                 "dns_fallback"
 #define KRB5_CONF_DNS_LOOKUP_KDC               "dns_lookup_kdc"
@@ -585,12 +586,8 @@
 
 #ifdef HAVE_SYS_TIME_H
 #include <sys/time.h>
-#ifdef TIME_WITH_SYS_TIME
-#include <time.h>
 #endif
-#else
 #include <time.h>
-#endif
 
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>                   /* struct stat, stat() */
@@ -820,21 +817,6 @@
     krb5_authdata **elements;
 } krb5_ad_kdcissued;
 
-typedef struct _krb5_ad_signedpath_data {
-    krb5_principal client;
-    krb5_timestamp authtime;
-    krb5_principal *delegated;
-    krb5_pa_data **method_data;
-    krb5_authdata **authorization_data;
-} krb5_ad_signedpath_data;
-
-typedef struct _krb5_ad_signedpath {
-    krb5_enctype enctype;
-    krb5_checksum checksum;
-    krb5_principal *delegated;
-    krb5_pa_data **method_data;
-} krb5_ad_signedpath;
-
 typedef struct _krb5_iakerb_header {
     krb5_data target_realm;
     krb5_data *cookie;
@@ -953,7 +935,6 @@
 void KRB5_CALLCONV krb5_free_fast_finished(krb5_context, krb5_fast_finished *);
 void KRB5_CALLCONV krb5_free_fast_response(krb5_context, krb5_fast_response *);
 void KRB5_CALLCONV krb5_free_ad_kdcissued(krb5_context, krb5_ad_kdcissued *);
-void KRB5_CALLCONV krb5_free_ad_signedpath(krb5_context, krb5_ad_signedpath *);
 void KRB5_CALLCONV krb5_free_iakerb_header(krb5_context, krb5_iakerb_header *);
 void KRB5_CALLCONV krb5_free_iakerb_finished(krb5_context,
                                              krb5_iakerb_finished *);
@@ -1518,12 +1499,6 @@
 encode_krb5_ad_kdcissued(const krb5_ad_kdcissued *, krb5_data **);
 
 krb5_error_code
-encode_krb5_ad_signedpath(const krb5_ad_signedpath *, krb5_data **);
-
-krb5_error_code
-encode_krb5_ad_signedpath_data(const krb5_ad_signedpath_data *, krb5_data **);
-
-krb5_error_code
 encode_krb5_otp_tokeninfo(const krb5_otp_tokeninfo *, krb5_data **);
 
 krb5_error_code
@@ -1700,9 +1675,6 @@
 decode_krb5_ad_kdcissued(const krb5_data *, krb5_ad_kdcissued **);
 
 krb5_error_code
-decode_krb5_ad_signedpath(const krb5_data *, krb5_ad_signedpath **);
-
-krb5_error_code
 decode_krb5_iakerb_header(const krb5_data *, krb5_iakerb_header **);
 
 krb5_error_code
@@ -2410,4 +2382,13 @@
 #define k5_prependmsg krb5_prepend_error_message
 #define k5_wrapmsg krb5_wrap_error_message
 
+/*
+ * Like krb5_principal_compare(), but with canonicalization of sname if
+ * fallback is enabled.  This function should be avoided if multiple matches
+ * are required, since repeated canonicalization is inefficient.
+ */
+krb5_boolean
+k5_sname_compare(krb5_context context, krb5_const_principal sname,
+                 krb5_const_principal princ);
+
 #endif /* _KRB5_INT_H */

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/k5-trace.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/k5-trace.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/kcm.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/kcm.h Changed

@@ -51,13 +51,32 @@
  *
  * All replies begin with a 32-bit big-endian reply code.
  *
- * Parameters are appended to the request or reply with no delimiters.  Flags
- * and time offsets are stored as 32-bit big-endian integers.  Names are
- * marshalled as zero-terminated strings.  Principals and credentials are
+ * Parameters are appended to the request or reply with no delimiters.  Flags,
+ * time offsets, and lengths are stored as 32-bit big-endian integers.  Names
+ * are marshalled as zero-terminated strings.  Principals and credentials are
  * marshalled in the v4 FILE ccache format.  UUIDs are 16 bytes.  UUID lists
  * are not delimited, so nothing can come after them.
+ *
+ * Flag words must use Heimdal flag values, which are not the same as MIT krb5
+ * values for KRB5_GC and KRB5_TC constants.  The same flag word may contain
+ * both kinds of flags in Heimdal, but not in MIT krb5.  Defines for the
+ * applicable Heimdal flag values are given below using KCM_GC and KCM_TC
+ * prefixes.
  */
 
+#define KCM_GC_CACHED                   (1U << 0)
+
+#define KCM_TC_DONT_MATCH_REALM         (1U << 31)
+#define KCM_TC_MATCH_KEYTYPE            (1U << 30)
+#define KCM_TC_MATCH_SRV_NAMEONLY       (1U << 29)
+#define KCM_TC_MATCH_FLAGS_EXACT        (1U << 28)
+#define KCM_TC_MATCH_FLAGS              (1U << 27)
+#define KCM_TC_MATCH_TIMES_EXACT        (1U << 26)
+#define KCM_TC_MATCH_TIMES              (1U << 25)
+#define KCM_TC_MATCH_AUTHDATA           (1U << 24)
+#define KCM_TC_MATCH_2ND_TKT            (1U << 23)
+#define KCM_TC_MATCH_IS_SKEY            (1U << 22)
+
 /* Opcodes without comments are currently unused in the MIT client
  * implementation. */
 typedef enum kcm_opcode {
@@ -68,7 +87,7 @@
     KCM_OP_INITIALIZE,          /*          (name, princ) -> ()          */
     KCM_OP_DESTROY,             /*                 (name) -> ()          */
     KCM_OP_STORE,               /*           (name, cred) -> ()          */
-    KCM_OP_RETRIEVE,
+    KCM_OP_RETRIEVE,            /* (name, flags, credtag) -> (cred)      */
     KCM_OP_GET_PRINCIPAL,       /*                 (name) -> (princ)     */
     KCM_OP_GET_CRED_UUID_LIST,  /*                 (name) -> (uuid, ...) */
     KCM_OP_GET_CRED_BY_UUID,    /*           (name, uuid) -> (cred)      */
@@ -89,7 +108,13 @@
     KCM_OP_HAVE_NTLM_CRED,
     KCM_OP_DEL_NTLM_CRED,
     KCM_OP_DO_NTLM_AUTH,
-    KCM_OP_GET_NTLM_USER_LIST
+    KCM_OP_GET_NTLM_USER_LIST,
+
+    /* MIT extensions */
+    KCM_OP_MIT_EXTENSION_BASE = 13000,
+    KCM_OP_GET_CRED_LIST,       /* (name) -> (count, count*{len, cred}) */
+    KCM_OP_REPLACE,             /* (name, offset, princ,
+                                 *  count, count*{len, cred}) -> () */
 } kcm_opcode;
 
 #endif /* KCM_H */

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/kdb.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/kdb.h Changed

@@ -105,12 +105,10 @@
 #define KRB5_KDB_CREATE_HASH            0x00000002
 
 /* Entry get flags */
-/* Name canonicalization requested */
-#define KRB5_KDB_FLAG_CANONICALIZE              0x00000010
-/* Include authorization data generated by backend */
-#define KRB5_KDB_FLAG_INCLUDE_PAC               0x00000020
-/* Is AS-REQ (client referrals only) */
-#define KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY     0x00000040
+/* Okay to generate a referral on lookup */
+#define KRB5_KDB_FLAG_REFERRAL_OK               0x00000010
+/* Client principal lookup (client referrals only) */
+#define KRB5_KDB_FLAG_CLIENT                    0x00000040
 /* Map cross-realm principals */
 #define KRB5_KDB_FLAG_MAP_PRINCIPALS            0x00000080
 /* Protocol transition */
@@ -656,25 +654,6 @@
                            int             count,
                            krb5_key_data * data);
 
-krb5_error_code krb5_db_sign_authdata(krb5_context kcontext,
-                                      unsigned int flags,
-                                      krb5_const_principal client_princ,
-                                      krb5_const_principal server_princ,
-                                      krb5_db_entry *client,
-                                      krb5_db_entry *server,
-                                      krb5_db_entry *header_server,
-                                      krb5_db_entry *local_tgt,
-                                      krb5_keyblock *client_key,
-                                      krb5_keyblock *server_key,
-                                      krb5_keyblock *header_key,
-                                      krb5_keyblock *local_tgt_key,
-                                      krb5_keyblock *session_key,
-                                      krb5_timestamp authtime,
-                                      krb5_authdata **tgt_auth_data,
-                                      void *ad_info,
-                                      krb5_data ***auth_indicators,
-                                      krb5_authdata ***signed_auth_data);
-
 krb5_error_code krb5_db_check_transited_realms(krb5_context kcontext,
                                                const krb5_data *tr_contents,
                                                const krb5_data *client_realm,
@@ -717,23 +696,9 @@
 krb5_error_code krb5_db_allowed_to_delegate_from(krb5_context context,
                                                  krb5_const_principal client,
                                                  krb5_const_principal server,
-                                                 void *server_ad_info,
+                                                 krb5_pac server_pac,
                                                  const krb5_db_entry *proxy);
 
-krb5_error_code krb5_db_get_authdata_info(krb5_context context,
-                                          unsigned int flags,
-                                          krb5_authdata **in_authdata,
-                                          krb5_const_principal client_princ,
-                                          krb5_const_principal server_princ,
-                                          krb5_keyblock *server_key,
-                                          krb5_keyblock *krbtgt_key,
-                                          krb5_db_entry *krbtgt,
-                                          krb5_timestamp authtime,
-                                          void **ad_info_out,
-                                          krb5_principal *client_out);
-
-void krb5_db_free_authdata_info(krb5_context context, void *ad_info);
-
 /**
  * Sort an array of @a krb5_key_data keys in descending order by their kvno.
  * Key data order within a kvno is preserved.
@@ -747,6 +712,13 @@
 void
 krb5_dbe_sort_key_data(krb5_key_data *key_data, size_t key_data_length);
 
+krb5_error_code
+krb5_db_issue_pac(krb5_context context, unsigned int flags,
+                  krb5_db_entry *client, krb5_keyblock *replaced_reply_key,
+                  krb5_db_entry *server, krb5_db_entry *krbtgt,
+                  krb5_timestamp authtime, krb5_pac old_pac, krb5_pac new_pac,
+                  krb5_data ***auth_indicators);
+
 /* default functions. Should not be directly called */
 /*
  *   Default functions prototype
@@ -894,7 +866,35 @@
  * This number indicates the date of the last incompatible change to the DAL.
  * The maj_ver field of the module's vtable structure must match this version.
  */
-#define KRB5_KDB_DAL_MAJOR_VERSION 8
+#define KRB5_KDB_DAL_MAJOR_VERSION 9
+
+/*
+ * Note the following when converting a module to DAL version 9:
+ *
+ * - get_authdata_info() and sign_authdata() have been removed, and issue_pac()
+ *   has been added.
+ *
+ * - check_allowed_to_delegate() must handle a null proxy argument, returning
+ *   success if server has any authorized delegation targets in the traditional
+ *   scheme.
+ *
+ * - allowed_to_delegate_from() accepts a krb5_pac parameter (in place
+ *   server_ad_info) for the impersonator's PAC.
+ *
+ * - check_allowed_to_delegate() and allowed_to_delegate_from() must return
+ *   KRB5KDC_ERR_BADOPTION on authorization failure.
+ *
+ * - the KRB5_KDB_FLAG_ISSUE_PAC and KRB5_FLAG_CLIENT_REFERRALS_ONLY flags have
+ *   been combined into KRB5_KDB_FLAG_CLIENT.
+ *
+ * - the KRB5_KDB_FLAG_CANONICALIZE flag has been renamed to
+ *   KRB5_KDB_FLAG_REFERRAL_OK, and is only passed to get_principal() when a
+ *   realm referral is allowed (AS client and TGS server lookups, when the
+ *   CANONICALIZE option is requested or, for AS requests, when the client is
+ *   an enterprise principal).  As of DAL version 8 the KDB module should
+ *   always canonicalize aliases within a realm; the KDC will decide whether to
+ *   use the original or canonical principal.
+ */
 
 /*
  * A krb5_context can hold one database object.  Modules should use
@@ -1008,17 +1008,14 @@
      *
      * The meaning of flags are as follows:
      *
-     * KRB5_KDB_FLAG_CANONICALIZE: Set by the KDC when looking up entries for
-     *     an AS or TGS request with canonicalization requested.  Determines
-     *     whether the module should return out-of-realm referrals.
-     *
-     * KRB5_KDB_FLAG_INCLUDE_PAC: Set by the KDC during an AS request when the
-     *     client requested PAC information during padata, and during most TGS
-     *     requests.  Indicates that the module should include PAC information
-     *     when its sign_authdata method is invoked.
+     * KRB5_KDB_FLAG_REFERRAL_OK: Set by the KDC when looking up entries for an
+     *     AS client with canonicalization requested or for an enterprise
+     *     principal, or for a TGS request server with canonicalization
+     *     requested.  Determines whether the module should return out-of-realm
+     *     referrals.
      *
-     * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY: Set by the KDC when looking up the
-     *     client entry in an AS request.  Affects how the module should return
+     * KRB5_KDB_FLAG_CLIENT: Set by the KDC when looking up a client principal
+     *     during an AS or TGS request.  Affects how the module should return
      *     out-of-realm referrals.
      *
      * KRB5_KDB_FLAG_MAP_PRINCIPALS: Set by the KDC when looking up the client
@@ -1049,18 +1046,12 @@
      * canonical name.  The KDC will decide based on the request whether to use
      * the requested name or the canonical name in the issued ticket.
      *
-     * A module can return a referral to another realm if
-     * KRB5_KDB_FLAG_CANONICALIZE is set, or if
-     * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is set and search_for->type is
-     * KRB5_NT_ENTERPRISE_PRINCIPAL.  If KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is
-     * set, the module should return a referral by simply filling in an
-     * out-of-realm name in (*entry)->princ and setting all other fields to
-     * NULL.  Otherwise, the module should return the entry for the cross-realm
-     * TGS of the referred-to realm.  For TGS referals, the module can also
-     * include tl-data of type KRB5_TL_SERVER_REFERRAL containing ASN.1-encoded
-     * Windows referral data as documented in
-     * draft-ietf-krb-wg-kerberos-referrals-11 appendix A; this will be
-     * returned to the client as encrypted padata.
+     * A module can return a referral to another realm if flags contains
+     * KRB5_KDB_FLAG_REFERRAL_OK.  If KRB5_KDB_FLAG_CLIENT is also set, the
+     * module should return a referral by simply filling in an out-of-realm
+     * name in (*entry)->princ and setting all other fields to NULL.
+     * Otherwise, the module should return the entry for the cross-realm TGS of
+     * the referred-to realm.
      */
     krb5_error_code (*get_principal)(krb5_context kcontext,
                                      krb5_const_principal search_for,
@@ -1275,91 +1266,6 @@
                                         int keyver, krb5_key_data *key_data);
 
     /*
-     * Optional: Generate signed authorization data, such as a Windows PAC, for
-     * the ticket to be returned to the client.  Place the signed authorization
-     * data, if any, in *signed_auth_data.  This function will be invoked for
-     * an AS request if the client included padata requesting a PAC.  This
-     * function will be invoked for a TGS request if there is authorization
-     * data in the TGT, if the client is from another realm, or if the TGS
-     * request is an S4U2Self or S4U2Proxy request.  This function will not be
-     * invoked during TGS requests if the server principal has the
-     * no_auth_data_required attribute set.  Input parameters are:
-     *
-     *   flags: The flags used to look up the client principal.
-     *
-     *   client_princ: For S4U2Self and S4U2Proxy TGS requests, the client
-     *     principal requested by the service; for regular TGS requests, the
-     *     possibly-canonicalized client principal.
-     *
-     *   server_princ: The server principal in the request.
-     *
-     *   client: The DB entry of the client if it is in the local realm, NULL
-     *     if not.  For S4U2Self and S4U2Proxy TGS requests, this is the DB
-     *     entry for the client principal requested by the service.
-     *
-     *   server: The DB entry of the service principal, or of a cross-realm
-     *     krbtgt principal in case of referral.
-     *
-     *   header_server: For S4U2Proxy requests, the DB entry of the second
-     *     ticket server.  For other TGS requests, the DB entry of the header
-     *     ticket server.  For AS requests, NULL.
-     *
-     *   local_tgt: the DB entry of the local krbtgt principal.
-     *
-     *   client_key: The reply key for the KDC request, before any FAST armor
-     *     is applied.  For AS requests, this may be the client's long-term key
-     *     or a key chosen by a preauth mechanism.  For TGS requests, this may
-     *     be the subkey found in the AP-REQ or the session key of the TGT.
-     *
-     *   server_key: The server key used to encrypt the returned ticket.
-     *
-     *   header_key: For S4U2Proxy requests, the key used to decrypt the second
-     *     ticket.  For TGS requests, the key used to decrypt the header
-     *     ticket.  For AS requests, NULL.
-     *
-     *   local_tgt_key: The decrypted first key of local_tgt.
-     *
-     *   session_key: The session key of the ticket being granted to the
-     *     requestor.
-     *
-     *   authtime: The timestamp of the original client authentication time.
-     *     For AS requests, this is the current time.  For TGS requests, this
-     *     is the authtime of the subject ticket (TGT or S4U2Proxy evidence
-     *     ticket).
-     *
-     *   tgt_auth_data: For TGS requests, the authorization data present in the
-     *     subject ticket.  For AS requests, NULL.
-     *
-     *   ad_info: For TGS requests, the parsed authorization data if obtained
-     *     by get_authdata_info method from the authorization data present in
-     *     the subject ticket.  Otherwise NULL.
-     *
-     *   auth_indicators: Points to NULL or a null-terminated list of krb5_data
-     *     pointers, each containing an authentication indicator (RFC 8129).
-     *     The method may modify this list, or free it and replace
-     *     *auth_indicators with NULL, to change which auth indicators will be
-     *     included in the ticket.
-     */
-    krb5_error_code (*sign_authdata)(krb5_context kcontext,
-                                     unsigned int flags,
-                                     krb5_const_principal client_princ,
-                                     krb5_const_principal server_princ,
-                                     krb5_db_entry *client,
-                                     krb5_db_entry *server,
-                                     krb5_db_entry *header_server,
-                                     krb5_db_entry *local_tgt,
-                                     krb5_keyblock *client_key,
-                                     krb5_keyblock *server_key,
-                                     krb5_keyblock *header_key,
-                                     krb5_keyblock *local_tgt_key,
-                                     krb5_keyblock *session_key,
-                                     krb5_timestamp authtime,
-                                     krb5_authdata **tgt_auth_data,
-                                     void *ad_info,
-                                     krb5_data ***auth_indicators,
-                                     krb5_authdata ***signed_auth_data);
-
-    /*
      * Optional: Perform a policy check on a cross-realm ticket's transited
      * field.  Return 0 if the check authoritatively succeeds,
      * KRB5_PLUGIN_NO_HANDLE to use the core transited-checking mechanisms, or
@@ -1424,13 +1330,15 @@
 
     /*
      * Optional: Perform a policy check on server being allowed to obtain
-     * tickets from client to proxy.  (Note that proxy is the target of the
-     * delegation, not the delegating service; the term "proxy" is from the
-     * viewpoint of the delegating service asking another service to perform
-     * some of its work in the authentication context of the client.  This
-     * terminology comes from the Microsoft S4U protocol documentation.)
-     * Return 0 if policy allows it, or an appropriate error (such as
-     * KRB5KDC_ERR_POLICY) if not.  If this method is not implemented, all
+     * tickets from client to proxy.  If proxy is NULL, check if server has any
+     * authorized delegation targets (client will also be NULL in this case).
+     * (Note that proxy is the target of the delegation, not the delegating
+     * service; the term "proxy" is from the viewpoint of the delegating
+     * service asking another service to perform some of its work in the
+     * authentication context of the client.  This terminology comes from the
+     * Microsoft S4U protocol documentation.)  Return 0 if policy allows
+     * delegation to the specified target (or to any target if proxy is NULL),
+     * or KRB5KDC_ERR_BADOPTION if not.  If this method is not implemented, all
      * S4U2Proxy delegation requests will be rejected.
      */
     krb5_error_code (*check_allowed_to_delegate)(krb5_context context,
@@ -1446,17 +1354,17 @@
     void (*free_principal_e_data)(krb5_context kcontext, krb5_octet *e_data);
 
     /*
-     * Optional: get a principal entry for S4U2Self based on X509 certificate.
+     * Optional: get a client principal entry based on an X.509 certificate.
      *
-     * If flags include KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY, princ->realm
-     * indicates the request realm, but the data components should be ignored.
-     * The module can return an out-of-realm client referral as it would for
-     * get_principal().
+     * If flags include KRB5_KDB_FLAG_REFERRAL_OK, the certificate was
+     * presented in an AS request.  princ->realm indicates the request realm,
+     * but the data components should be ignored.  The module can return an
+     * out-of-realm client referral as it would for get_principal().
      *
-     * If flags does not include KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY, princ is
-     * from PA-S4U-X509-USER.  If it contains data components (and not just a
-     * realm), the module should verify that it is the same as the lookup
-     * result for client_cert.  The module should not return a referral.
+     * Otherwise, princ is from a TGS request.  If it contains data components
+     * (and not just a realm), the module should verify that it is the same as
+     * the lookup result for client_cert.  The module should not return a
+     * referral.
      */
     krb5_error_code (*get_s4u_x509_principal)(krb5_context kcontext,
                                               const krb5_data *client_cert,
@@ -1469,11 +1377,9 @@
      * tickets from client to proxy.  This method is similar to
      * check_allowed_to_delegate, but it operates on the target server DB entry
      * (called "proxy" here as in Microsoft's protocol documentation) rather
-     * than the intermediate server entry.  server_ad_info represents the
-     * authdata of the intermediate server, as returned by the
-     * get_authdata_info method on the header ticket.  Return 0 if policy
-     * allows the delegation, or an appropriate error (such as
-     * KRB5KDC_ERR_POLICY) if not.
+     * than the intermediate server entry.  server_pac is the verified PAC from
+     * the authdata of the intermediate server.  Return 0 if policy allows the
+     * delegation, or KRB5KDC_ERR_BADOPTION if not.
      *
      * This method is called for S4U2Proxy requests and implements the
      * resource-based constrained delegation variant, which can support
@@ -1485,46 +1391,63 @@
     krb5_error_code (*allowed_to_delegate_from)(krb5_context context,
                                                 krb5_const_principal client,
                                                 krb5_const_principal server,
-                                                void *server_ad_info,
+                                                krb5_pac server_pac,
                                                 const krb5_db_entry *proxy);
 
     /*
-     * Optional: Perform verification and policy checks on authorization data,
-     * such as a Windows PAC, based on the request client lookup flags.  Return
-     * 0 if all checks have passed.  Optionally return a representation of the
-     * authdata in *ad_info_out, to be consumed by allowed_to_delegate_from and
-     * sign_authdata.  Returning *ad_info_out is required to support
-     * resource-based constrained delegation.
+     * Optional: Add buffers to new_pac using krb5_pac_add_buffer() before it
+     * is signed.
+     *
+     * The caller will handle the following buffer types, so do not copy or add
+     * them:
+     *
+     *   KRB5_PAC_SERVER_CHECKSUM
+     *   KRB5_PAC_PRIVSVR_CHECKSUM
+     *   KRB5_PAC_TICKET_CHECKSUM
+     *   KRB5_PAC_CLIENT_INFO
+     *   KRB5_PAC_DELEGATION_INFO
+     *
+     * For TGS requests, old_pac is the PAC of the header ticket, except when
+     * KRB5_KDB_FLAG_CONTRAINED_DELEGATION is present in flags, in which case
+     * it is the PAC of the second ticket.  If
+     * KRB5_KDB_FLAG_PROTOCOL_TRANSITION is present in flags and client is not
+     * NULL, old_pac is the PAC of the requesting service, not the subject of
+     * the S4U2Self request, and its buffers should not be copied into new_pac.
+     * The signatures and PAC_CLIENT_INFO of old_pac have been verified by the
+     * caller.
+     *
+     * If replaced_reply_key is not null, the request is an AS request and the
+     * reply key was replaced by a preauth mechanism such as PKINIT, meaning
+     * the Kerberos password or long-term key was not used.  The module may use
+     * this key to encrypt a PAC_CREDENTIALS_INFO buffer containing credentials
+     * (such as an NTLM hash) that the client would ordinarily derive from the
+     * Kerberos password or long-term key.
+     *
+     * server is the database entry of the server the ticket will be issued to,
+     * which may be a referral TGS.
      *
-     * If the KRB5_KDB_FLAG_CONSTRAINED_DELEGATION bit is set, a PAC must be
-     * provided and verified, and an error should be returned if the client is
-     * not allowed to delegate.  If the KRB5_KDB_FLAG_CROSS_REALM bit is also
-     * set, set *client_out to the client name in the PAC; this indicates the
-     * requested client principal for a cross-realm S4U2Proxy request.
+     * signing_krbtgt is the database entry of the krbtgt principal used to
+     * verify old_pac (or null if old_pac is null).  If
+     * KRB5_KDB_FLAG_CROSS_REALM is present in flags, this entry will be an
+     * incoming cross-realm TGS, and the PAC fields should undergo appropriate
+     * filtering based on the trust level of the cross-realm relationship.
      *
-     * This method is called for TGS requests on the authorization data from
-     * the header ticket.  For S4U2Proxy requests it is also called on the
-     * authorization data from the evidence ticket.  If the
-     * KRB5_KDB_FLAG_PROTOCOL_TRANSITION bit is set in flags, the authdata is
-     * from the header ticket of an S4U2Self referral request, and the supplied
-     * client_princ is the requested client.
+     * auth_indicators points to NULL or a null-terminated list of krb5_data
+     * pointers, each containing an authentication indicator (RFC 8129).  The
+     * method may modify this list, or free it and replace *auth_indicators
+     * with NULL, to change which auth indicators will be included in the
+     * ticket.
      */
-    krb5_error_code (*get_authdata_info)(krb5_context context,
-                                         unsigned int flags,
-                                         krb5_authdata **in_authdata,
-                                         krb5_const_principal client_princ,
-                                         krb5_const_principal server_princ,
-                                         krb5_keyblock *server_key,
-                                         krb5_keyblock *krbtgt_key,
-                                         krb5_db_entry *krbtgt,
-                                         krb5_timestamp authtime,
-                                         void **ad_info_out,
-                                         krb5_principal *client_out);
-
-    void (*free_authdata_info)(krb5_context context,
-                               void *ad_info);
-
-    /* End of minor version 0 for major version 8. */
+    krb5_error_code (*issue_pac)(krb5_context context, unsigned int flags,
+                                 krb5_db_entry *client,
+                                 krb5_keyblock *replaced_reply_key,
+                                 krb5_db_entry *server,
+                                 krb5_db_entry *signing_krbtgt,
+                                 krb5_timestamp authtime, krb5_pac old_pac,
+                                 krb5_pac new_pac,
+                                 krb5_data ***auth_indicators);
+
+    /* End of minor version 0 for major version 9. */
 } kdb_vftabl;
 
 #endif /* !defined(_WIN32) */

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/krb5/audit_plugin.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/krb5/audit_plugin.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/krb5/authdata_plugin.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/krb5/authdata_plugin.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/krb5/certauth_plugin.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/krb5/certauth_plugin.h Changed

@@ -85,16 +85,22 @@
 (*krb5_certauth_fini_fn)(krb5_context context, krb5_certauth_moddata moddata);
 
 /*
- * Mandatory: return 0 or KRB5_CERTAUTH_HWAUTH if the DER-encoded cert is
- * authorized for PKINIT authentication by princ; otherwise return one of the
- * following error codes:
+ * Mandatory: decode cert as an X.509 certificate and determine whether it is
+ * authorized to authenticate as the requested client principal princ using
+ * PKINIT.  Return 0 or KRB5_CERTAUTH_HWAUTH if the certificate is authorized.
+ * Otherwise return one of the following error codes:
+ *
  * - KRB5KDC_ERR_CLIENT_NAME_MISMATCH - incorrect SAN value
  * - KRB5KDC_ERR_INCONSISTENT_KEY_PURPOSE - incorrect EKU
  * - KRB5KDC_ERR_CERTIFICATE_MISMATCH - other extension error
- * - KRB5_PLUGIN_NO_HANDLE - the module has no opinion about cert
+ * - KRB5_PLUGIN_NO_HANDLE or KRB5_CERTAUTH_HWAUTH_PASS - the module has no
+ *   opinion about whether cert is authorized
  *
- * Returning KRB5_CERTAUTH_HWAUTH will cause the hw-authent flag to be set in
- * the issued ticket (new in release 1.19).
+ * Returning KRB5_CERTAUTH_HWAUTH will authorize the PKINIT authentication and
+ * cause the hw-authent flag to be set in the issued ticket (new in release
+ * 1.19).  Returning KRB5_CERTAUTH_HWAUTH_PASS does not authorize the PKINIT
+ * authentication, but causes the hw-authent flag to be set if another module
+ * authorizes it (new in release 1.20)
  *
  * - opts is used by built-in modules to receive internal data, and must be
  *   ignored by other modules.

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/krb5/clpreauth_plugin.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/krb5/clpreauth_plugin.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/krb5/kdcpreauth_plugin.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/krb5/kdcpreauth_plugin.h Changed

@@ -182,12 +182,12 @@
     /* End of version 2 kdcpreauth callbacks. */
 
     /*
-     * Get the decrypted client long-term key chosen according to the request
-     * enctype list, or NULL if no matching key was found.  The returned
-     * pointer is an alias and should not be freed.  If invoked from
-     * return_padata, the result will be the same as the encrypting_key
-     * parameter if it is not NULL, and will therefore reflect the modified
-     * reply key if a return_padata handler has replaced the reply key.
+     * Get the current reply key.  Initially the reply key is the decrypted
+     * client long-term key chosen according to the request enctype list, or
+     * NULL if no matching key was found.  The value may be changed by the
+     * replace_reply_key callback or a return_padata method modifying
+     * encrypting_key.  The returned pointer is an alias and should not be
+     * freed.
      */
     const krb5_keyblock *(*client_keyblock)(krb5_context context,
                                             krb5_kdcpreauth_rock rock);
@@ -257,6 +257,20 @@
 
     /* End of version 5 kdcpreauth callbacks. */
 
+    /*
+     * Replace the reply key with key.  If is_strengthen is true, key must be a
+     * derivative of the client long-term key.  This callback may be invoked
+     * from the verify or return_padata methods.  If it is invoked from the
+     * verify method, the new key will appear as the encrypting_key input to
+     * return_padata.
+     */
+    krb5_error_code (*replace_reply_key)(krb5_context context,
+                                         krb5_kdcpreauth_rock rock,
+                                         const krb5_keyblock *key,
+                                         krb5_boolean is_strengthen);
+
+    /* End of version 6 kdcpreauth callbacks. */
+
 } *krb5_kdcpreauth_callbacks;
 
 /* Optional: preauth plugin initialization function. */
@@ -350,7 +364,8 @@
 /*
  * Optional: generate preauthentication response data to send to the client as
  * part of the AS-REP.  If it needs to override the key which is used to
- * encrypt the response, it can do so.
+ * encrypt the response, it can do so by modifying encrypting_key, but it is
+ * preferrable to use the replace_reply_key callback.
  */
 typedef krb5_error_code
 (*krb5_kdcpreauth_return_fn)(krb5_context context,
@@ -380,7 +395,7 @@
 
 typedef struct krb5_kdcpreauth_vtable_st {
     /* Mandatory: name of module. */
-    char *name;
+    const char *name;
 
     /* Mandatory: pointer to zero-terminated list of pa_types which this module
      * can provide services for. */

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/krb5/krb5.hin -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/krb5/krb5.hin Changed

@@ -443,6 +443,11 @@
 #define ENCTYPE_CAMELLIA256_CTS_CMAC        0x001a /**< RFC 6803 */
 #define ENCTYPE_UNKNOWN                     0x01ff
 
+/*
+ * Historically we used the value 9 for unkeyed SHA-1.  RFC 3961 assigns this
+ * value to rsa-md5-des3, which fortunately is unused.  For ABI compatibility
+ * we allow either 9 or 14 for SHA-1.
+ */
 #define CKSUMTYPE_CRC32         0x0001
 #define CKSUMTYPE_RSA_MD4       0x0002
 #define CKSUMTYPE_RSA_MD4_DES   0x0003
@@ -453,6 +458,7 @@
 #define CKSUMTYPE_RSA_MD5_DES   0x0008
 #define CKSUMTYPE_NIST_SHA      0x0009
 #define CKSUMTYPE_HMAC_SHA1_DES3      0x000c
+#define CKSUMTYPE_SHA1          0x000e /**< RFC 3961 */
 #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with
                                                 ENCTYPE_AES128_CTS_HMAC_SHA1_96 */
 #define CKSUMTYPE_HMAC_SHA1_96_AES256 0x0010 /**< RFC 3962. Used with
@@ -464,27 +470,14 @@
 #define CKSUMTYPE_MD5_HMAC_ARCFOUR -137 /* Microsoft netlogon */
 #define CKSUMTYPE_HMAC_MD5_ARCFOUR -138 /**< RFC 4757 */
 
-/*
- * The following are entropy source designations. Whenever
- * krb5_C_random_add_entropy is called, one of these source ids is passed in.
- * This allows the library to better estimate bits of entropy in the sample and
- * to keep track of what sources of entropy have contributed enough entropy.
- * Sources marked internal MUST NOT be used by applications outside the
- * Kerberos library
- */
-
+/* Constants for the deprecated krb5_c_random_add_entropy() */
 enum {
-    KRB5_C_RANDSOURCE_OLDAPI = 0, /*calls to krb5_C_RANDOM_SEED (INTERNAL)*/
-    KRB5_C_RANDSOURCE_OSRAND = 1, /* /dev/random or equivalent (internal)*/
-    KRB5_C_RANDSOURCE_TRUSTEDPARTY = 2, /* From KDC or other trusted party*/
-    /*
-     * This source should be used carefully; data in this category
-     * should be from a third party trusted to give random bits
-     * For example keys issued by the KDC in the application server.
-     */
-    KRB5_C_RANDSOURCE_TIMING = 3, /* Timing of operations*/
-    KRB5_C_RANDSOURCE_EXTERNAL_PROTOCOL = 4, /*Protocol data possibly from attacker*/
-    KRB5_C_RANDSOURCE_MAX = 5 /*Do not use; maximum source ID*/
+    KRB5_C_RANDSOURCE_OLDAPI = 0,
+    KRB5_C_RANDSOURCE_OSRAND = 1,
+    KRB5_C_RANDSOURCE_TRUSTEDPARTY = 2,
+    KRB5_C_RANDSOURCE_TIMING = 3,
+    KRB5_C_RANDSOURCE_EXTERNAL_PROTOCOL = 4,
+    KRB5_C_RANDSOURCE_MAX = 5
 };
 
 #ifndef krb5_roundup
@@ -765,19 +758,7 @@
 krb5_c_random_to_key(krb5_context context, krb5_enctype enctype,
                      krb5_data *random_data, krb5_keyblock *k5_random_key);
 
-/**
- * Add entropy to the pseudo-random number generator.
- *
- * @param in context          Library context
- * @param in randsource       Entropy source (see KRB5_RANDSOURCE types)
- * @param in data             Data
- *
- * Contribute entropy to the PRNG used by krb5 crypto operations.  This may or
- * may not affect the output of the next crypto operation requiring random
- * data.
- *
- * @retval 0 Success; otherwise - Kerberos error codes
- */
+/** @deprecated This call is no longer necessary. */
 krb5_error_code KRB5_CALLCONV
 krb5_c_random_add_entropy(krb5_context context, unsigned int randsource,
                           const krb5_data *data);
@@ -797,24 +778,11 @@
 krb5_error_code KRB5_CALLCONV
 krb5_c_random_make_octets(krb5_context context, krb5_data *data);
 
-/**
- * Collect entropy from the OS if possible.
- *
- * @param in  context         Library context
- * @param in  strong          Strongest available source of entropy
- * @param out success         1 if OS provides entropy, 0 otherwise
- *
- * If @a strong is non-zero, this function attempts to use the strongest
- * available source of entropy.  Setting this flag may cause the function to
- * block on some operating systems.  Good uses include seeding the PRNG for
- * kadmind and realm setup.
- *
- * @retval 0 Success; otherwise - Kerberos error codes
- */
+/** @deprecated This call is no longer necessary. */
 krb5_error_code KRB5_CALLCONV
 krb5_c_random_os_entropy(krb5_context context, int strong, int *success);
 
-/** @deprecated Replaced by krb5_c_* API family. */
+/** @deprecated This call is no longer necessary. */
 krb5_error_code KRB5_CALLCONV
 krb5_c_random_seed(krb5_context context, krb5_data *data);
 
@@ -1879,6 +1847,7 @@
 #define KRB5_ENCPADATA_REQ_ENC_PA_REP   149 /**< RFC 6806 */
 #define KRB5_PADATA_AS_FRESHNESS        150 /**< RFC 8070 */
 #define KRB5_PADATA_SPAKE               151
+#define KRB5_PADATA_REDHAT_IDP_OAUTH2   152 /**< Red Hat IdP mechanism */
 #define KRB5_PADATA_PAC_OPTIONS         167 /**< MS-KILE and MS-SFU */
 
 #define KRB5_SAM_USE_SAD_AS_KEY         0x80000000
@@ -1906,7 +1875,7 @@
 #define KRB5_AUTHDATA_CAMMAC    96
 #define KRB5_AUTHDATA_WIN2K_PAC 128
 #define KRB5_AUTHDATA_ETYPE_NEGOTIATION 129     /**< RFC 4537 */
-#define KRB5_AUTHDATA_SIGNTICKET        512     /**< formerly 142 in krb5 1.8 */
+#define KRB5_AUTHDATA_SIGNTICKET        512     /**< @deprecated use PAC */
 #define KRB5_AUTHDATA_FX_ARMOR 71
 #define KRB5_AUTHDATA_AUTH_INDICATOR 97
 #define KRB5_AUTHDATA_AP_OPTIONS 143
@@ -2667,14 +2636,14 @@
 krb5_cccol_cursor_free(krb5_context context, krb5_cccol_cursor *cursor);
 
 /**
- * Check if the credential cache collection contains any credentials.
+ * Check if the credential cache collection contains any initialized caches.
  *
  * @param in  context         Library context
  *
  * @version New in 1.11
  *
- * @retval 0 Credentials are available in the collection
- * @retval KRB5_CC_NOTFOUND The collection contains no credentials
+ * @retval 0 At least one initialized cache is present in the collection
+ * @retval KRB5_CC_NOTFOUND The collection contains no caches
  */
 krb5_error_code KRB5_CALLCONV
 krb5_cccol_have_content(krb5_context context);
@@ -3119,6 +3088,42 @@
                      krb5_ccache ccache, krb5_creds *in_creds,
                      krb5_creds **out_creds);
 
+/**
+ * Serialize a @c krb5_creds object.
+ *
+ * @param in  context         Library context
+ * @param in  in_creds        The credentials object to serialize
+ * @param out data_out        The serialized credentials
+ *
+ * Serialize @a creds in the format used by the FILE ccache format (vesion 4)
+ * and KCM ccache protocol.
+ *
+ * Use krb5_free_data() to free @a data_out when it is no longer needed.
+ *
+ * @retval 0 Success; otherwise - Kerberos error codes
+ */
+krb5_error_code KRB5_CALLCONV
+krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds,
+                         krb5_data **data_out);
+
+/**
+ * Deserialize a @c krb5_creds object.
+ *
+ * @param in  context         Library context
+ * @param in  data            The serialized credentials
+ * @param out creds_out       The resulting creds object
+ *
+ * Deserialize @a data to credentials in the format used by the FILE ccache
+ * format (vesion 4) and KCM ccache protocol.
+ *
+ * Use krb5_free_creds() to free @a creds_out when it is no longer needed.
+ *
+ * @retval 0 Success; otherwise - Kerberos error codes
+ */
+krb5_error_code KRB5_CALLCONV
+krb5_unmarshal_credentials(krb5_context context, const krb5_data *data,
+                           krb5_creds **creds_out);
+
 /** @deprecated Replaced by krb5_get_validated_creds. */
 krb5_error_code KRB5_CALLCONV
 krb5_get_credentials_validate(krb5_context context, krb5_flags options,
@@ -3414,6 +3419,10 @@
  * @note The realm in a Kerberos @a name cannot contain slash, colon,
  * or NULL characters.
  *
+ * Beginning with release 1.20, the name type of the principal will be inferred
+ * as @c KRB5_NT_SRV_INST or @c KRB5_NT_WELLKNOWN based on the principal name.
+ * The type will be @c KRB5_NT_PRINCIPAL if a type cannot be inferred.
+ *
  * Use krb5_free_principal() to free @a principal_out when it is no longer
  * needed.
  *
@@ -3625,12 +3634,9 @@
  * @param in addr1            First address
  * @param in addr2            Second address
  *
- * @retval
- *  0 The two addresses are the same
- * @retval
- *  \< 0 First address is less than second
- * @retval
- *  \> 0 First address is greater than second
+ * @retval 0 if The two addresses are the same
+ * @retval < 0 First address is less than second
+ * @retval > 0 First address is greater than second
  */
 int KRB5_CALLCONV
 krb5_address_order(krb5_context context, const krb5_address *addr1,
@@ -3977,6 +3983,10 @@
  * empty component with this function).  Call krb5_free_principal() to free
  * allocated memory for principal when it is no longer needed.
  *
+ * Beginning with release 1.20, the name type of the principal will be inferred
+ * as @c KRB5_NT_SRV_INST or @c KRB5_NT_WELLKNOWN based on the principal name.
+ * The type will be @c KRB5_NT_PRINCIPAL if a type cannot be inferred.
+ *
  * @code
  * Example of how to build principal WELLKNOWN/ANONYMOUS@R
  *     krb5_build_principal_ext(context, &principal, strlen("R"), "R",
@@ -4006,6 +4016,10 @@
  *
  * Call krb5_free_principal() to free @a princ when it is no longer needed.
  *
+ * Beginning with release 1.20, the name type of the principal will be inferred
+ * as @c KRB5_NT_SRV_INST or @c KRB5_NT_WELLKNOWN based on the principal name.
+ * The type will be @c KRB5_NT_PRINCIPAL if a type cannot be inferred.
+ *
  * @note krb5_build_principal() and krb5_build_principal_alloc_va() perform the
  * same task.  krb5_build_principal() takes variadic arguments.
  * krb5_build_principal_alloc_va() takes a pre-computed @a varargs pointer.
@@ -8138,6 +8152,12 @@
 #define KRB5_PAC_CLIENT_INFO       10 /**< Client name and ticket info */
 #define KRB5_PAC_DELEGATION_INFO   11 /**< Constrained delegation info */
 #define KRB5_PAC_UPN_DNS_INFO      12 /**< User principal name and DNS info */
+#define KRB5_PAC_CLIENT_CLAIMS     13 /**< Client claims information */
+#define KRB5_PAC_DEVICE_INFO       14 /**< Device information */
+#define KRB5_PAC_DEVICE_CLAIMS     15 /**< Device claims information */
+#define KRB5_PAC_TICKET_CHECKSUM   16 /**< Ticket checksum */
+#define KRB5_PAC_ATTRIBUTES_INFO   17 /**< PAC attributes */
+#define KRB5_PAC_REQUESTOR         18 /**< PAC requestor SID */
 
 struct krb5_pac_data;
 /** PAC data structure to convey authorization information */
@@ -8295,47 +8315,46 @@
                     krb5_boolean with_realm);
 
 /**
- * Sign a PAC.
+ * Verify a PAC, possibly including ticket signature
  *
- * @param in  context         Library context
- * @param in  pac             PAC handle
- * @param in  authtime        Expected timestamp
- * @param in  principal       Expected principal name (or NULL)
- * @param in  server_key      Key for server checksum
- * @param in  privsvr_key     Key for KDC checksum
- * @param out data            Signed PAC encoding
- *
- * This function signs @a pac using the keys @a server_key and @a privsvr_key
- * and returns the signed encoding in @a data.  @a pac is modified to include
- * the server and KDC checksum buffers.  Use krb5_free_data_contents() to free
- * @a data when it is no longer needed.
+ * @param in context          Library context
+ * @param in enc_tkt          Ticket enc-part, possibly containing a PAC
+ * @param in server_princ     Canonicalized name of ticket server
+ * @param in server           Key to validate server checksum (or NULL)
+ * @param in privsvr          Key to validate KDC checksum (or NULL)
+ * @param out pac_out         Verified PAC (NULL if no PAC included)
  *
- * @version New in 1.10
+ * If a PAC is present in @a enc_tkt, verify its signatures.  If @a privsvr is
+ * not NULL and @a server_princ is not a krbtgt or kadmin/changepw service,
+ * require a ticket signature over @a enc_tkt in addition to the KDC signature.
+ * Place the verified PAC in @a pac_out.  If an invalid PAC signature is found,
+ * return an error matching the Windows KDC protocol code for that condition as
+ * closely as possible.
+ *
+ * If no PAC is present in @a enc_tkt, set @a pac_out to NULL and return
+ * successfully.
+ *
+ * @note This function does not validate the PAC_CLIENT_INFO buffer.  If a
+ * specific value is expected, the caller can make a separate call to
+ * krb5_pac_verify_ext() with a principal but no keys.
+ *
+ * @retval 0 Success; otherwise - Kerberos error codes
+ *
+ * @version New in 1.20
  */
 krb5_error_code KRB5_CALLCONV
+krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                       krb5_const_principal server_princ,
+                       const krb5_keyblock *server,
+                       const krb5_keyblock *privsvr, krb5_pac *pac_out);
+
+/** @deprecated Use krb5_kdc_sign_ticket() instead. */
+krb5_error_code KRB5_CALLCONV
 krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime,
               krb5_const_principal principal, const krb5_keyblock *server_key,
               const krb5_keyblock *privsvr_key, krb5_data *data);
 
-/**
- * Sign a PAC, possibly with a specified realm.
- *
- * @param in  context         Library context
- * @param in  pac             PAC handle
- * @param in  authtime        Expected timestamp
- * @param in  principal       Principal name (or NULL)
- * @param in  server_key      Key for server checksum
- * @param in  privsvr_key     Key for KDC checksum
- * @param in  with_realm      If true, include the realm of @a principal
- * @param out data            Signed PAC encoding
- *
- * This function is similar to krb5_pac_sign(), but adds a parameter
- * @a with_realm.  If @a with_realm is true, the PAC_CLIENT_INFO field of the
- * signed PAC will include the realm of @a principal as well as the name.  This
- * flag is necessary to generate PACs for cross-realm S4U2Self referrals.
- *
- * @version New in 1.17
- */
+/** @deprecated Use krb5_kdc_sign_ticket() instead. */
 krb5_error_code KRB5_CALLCONV
 krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime,
                   krb5_const_principal principal,
@@ -8343,8 +8362,37 @@
                   const krb5_keyblock *privsvr_key, krb5_boolean with_realm,
                   krb5_data *data);
 
+/**
+ * Sign a PAC, possibly including a ticket signature
+ *
+ * @param in  context         Library context
+ * @param in  enc_tkt         The ticket for the signature
+ * @param in  pac             PAC handle
+ * @param in  server_princ    Canonical ticket server name
+ * @param in  client_princ    PAC_CLIENT_INFO principal (or NULL)
+ * @param in  server          Key for server checksum
+ * @param in  privsvr         Key for KDC and ticket checksum
+ * @param in  with_realm      If true, include the realm of @a principal
+ *
+ * Sign @a pac using the keys @a server and @a privsvr.  Include a ticket
+ * signature over @a enc_tkt if @a server_princ is not a TGS or kadmin/changepw
+ * principal name.  Add the signed PAC's encoding to the authorization data of
+ * @a enc_tkt in the first slot, wrapped in an AD-IF-RELEVANT container.  If @a
+ * client_princ is non-null, add a PAC_CLIENT_INFO buffer, including the realm
+ * if @a with_realm is true.
+ *
+ * @retval 0 on success, otherwise - Kerberos error codes
+ *
+ * @version New in 1.20
+ */
+krb5_error_code KRB5_CALLCONV
+krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt,
+                     const krb5_pac pac, krb5_const_principal server_princ,
+                     krb5_const_principal client_princ,
+                     const krb5_keyblock *server, const krb5_keyblock *privsvr,
+                     krb5_boolean with_realm);
 
-/*
+/**
  * Read client information from a PAC.
  *
  * @param in  context         Library context
@@ -8450,14 +8498,14 @@
  * @param in  realm           The realm the message will be sent to
  * @param in  message         The original message to be sent to the KDC
  * @param out new_message_out Optional replacement message to be sent
- * @param out reply_out       Optional synthetic reply
+ * @param out new_reply_out   Optional synthetic reply
  *
  * If the hook function returns an error code, the KDC communication will be
  * aborted and the error code will be returned to the library operation which
  * initiated the communication.
  *
- * If the hook function sets @a reply_out, @a message will not be sent to the
- * KDC, and the given reply will used instead.
+ * If the hook function sets @a new_reply_out, @a message will not be sent to
+ * the KDC, and the given reply will used instead.
  *
  * If the hook function sets @a new_message_out, the given message will be sent
  * to the KDC in place of @a message.

_service:tar_scm:krb5-1.19.2.tar.gz/src/include/win-mac.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/include/win-mac.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/cli/getdate.y -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/cli/getdate.y Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/cli/kadmin.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/cli/kadmin.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/dbutil/dump.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/dbutil/dump.c Changed

@@ -668,6 +668,10 @@
     }
 
     /* Get memory for flattened principal name */
+    if (u2 > UINT_MAX / 2) {
+        load_err(fname, *linenop, _("cannot allocate principal (too large)"));
+        goto fail;
+    }
     name = malloc(u2 + 1);
     if (name == NULL)
         goto fail;
@@ -682,6 +686,10 @@
     dbentry->n_tl_data = u3;
 
     /* Get memory for key list */
+    if (u4 > INT16_MAX) {
+        load_err(fname, *linenop, _("invalid key_data size"));
+        goto fail;
+    }
     if (u4 && (kp = calloc(u4, sizeof(krb5_key_data))) == NULL)
         goto fail;
 
@@ -769,13 +777,17 @@
             load_err(fname, *linenop, _("unsupported key_data_ver version"));
             goto fail;
         }
+        if (t2 < 0 || t2 > UINT16_MAX) {
+            load_err(fname, *linenop, _("invalid kvno"));
+            goto fail;
+        }
 
         kd->key_data_ver = t1;
         kd->key_data_kvno = t2;
 
         for (j = 0; j < t1; j++) {
             nread = fscanf(filep, "%d\t%d\t", &t3, &t4);
-            if (nread != 2 || t4 < 0) {
+            if (nread != 2 || t4 < 0 || t4 > UINT16_MAX) {
                 load_err(fname, *linenop,
                          _("cannot read key type and length"));
                 goto fail;

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/dbutil/kadm5_create.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/dbutil/kadm5_create.c Changed

@@ -185,21 +185,24 @@
 int add_admin_princ(void *handle, krb5_context context,
                     char *name, char *realm, int attrs, int lifetime)
 {
-    char *fullname;
+    char *fullname = NULL;
     krb5_error_code ret;
     kadm5_principal_ent_rec ent;
     long flags;
+    int fret;
 
     memset(&ent, 0, sizeof(ent));
 
     if (asprintf(&fullname, "%s@%s", name, realm) < 0) {
         com_err(progname, ENOMEM, _("while appending realm to principal"));
-        return ERR;
+        fret = ERR;
+        goto cleanup;
     }
     ret = krb5_parse_name(context, fullname, &ent.principal);
     if (ret) {
         com_err(progname, ret, _("while parsing admin principal name"));
-        return(ERR);
+        fret = ERR;
+        goto cleanup;
     }
     ent.max_life = lifetime;
     ent.attributes = attrs;
@@ -210,13 +213,13 @@
     ret = kadm5_create_principal(handle, &ent, flags, NULL);
     if (ret && ret != KADM5_DUP) {
         com_err(progname, ret, _("while creating principal %s"), fullname);
-        krb5_free_principal(context, ent.principal);
-        free(fullname);
-        return ERR;
+        fret = ERR;
+        goto cleanup;
     }
 
+    fret = OK;
+cleanup:
     krb5_free_principal(context, ent.principal);
     free(fullname);
-
-    return OK;
+    return fret;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/dbutil/kdb5_create.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/dbutil/kdb5_create.c Changed

@@ -152,7 +152,6 @@
     krb5_data pwd, seed;
     kdb_log_context *log_ctx;
     krb5_kvno mkey_kvno;
-    int strong_random = 1;
 
     while ((optchar = getopt(argc, argv, "sW")) != -1) {
         switch(optchar) {
@@ -160,7 +159,7 @@
             do_stash++;
             break;
         case 'W':
-            strong_random = 0;
+            /* Ignore (deprecated weak random option). */
             break;
         case '?':
         default:
@@ -178,13 +177,6 @@
 
     log_ctx = util_context->kdblog_context;
 
-    printf(_("Loading random data\n"));
-    retval = krb5_c_random_os_entropy (util_context, strong_random, NULL);
-    if (retval) {
-        com_err(progname, retval, _("Loading random data"));
-        exit_status++; return;
-    }
-
     /* assemble & parse the master key name */
 
     if ((retval = krb5_db_setup_mkey_name(util_context,
@@ -393,7 +385,7 @@
     struct realm_info *pblock;
 {
     krb5_error_code       retval;
-    krb5_db_entry         *entry;
+    krb5_db_entry         *entry = NULL;
     krb5_kvno             mkey_kvno;
     krb5_timestamp        now;
     struct iterate_args   iargs;
@@ -410,20 +402,20 @@
     entry->expiration = pblock->expiration;
 
     if ((retval = krb5_copy_principal(context, princ, &entry->princ)))
-        goto error_out;
+        goto cleanup;
 
     if ((retval = krb5_timeofday(context, &now)))
-        goto error_out;
+        goto cleanup;
 
     if ((retval = krb5_dbe_update_mod_princ_data(context, entry,
                                                  now, &db_create_princ)))
-        goto error_out;
+        goto cleanup;
 
     switch (op) {
     case MASTER_KEY:
         if ((entry->key_data=(krb5_key_data*)malloc(sizeof(krb5_key_data)))
             == NULL)
-            goto error_out;
+            goto cleanup;
         memset(entry->key_data, 0, sizeof(krb5_key_data));
         entry->n_key_data = 1;
 
@@ -435,7 +427,7 @@
         if ((retval = krb5_dbe_encrypt_key_data(context, pblock->key,
                                                 &master_keyblock, NULL,
                                                 mkey_kvno, entry->key_data)))
-            return retval;
+            goto cleanup;
         /*
          * There should always be at least one "active" mkey so creating the
          * KRB5_TL_ACTKVNO entry now so the initial mkey is active.
@@ -445,11 +437,11 @@
         /* earliest possible time in case system clock is set back */
         actkvno.act_time = 0;
         if ((retval = krb5_dbe_update_actkvno(context, entry, &actkvno)))
-            return retval;
+            goto cleanup;
 
         /* so getprinc shows the right kvno */
         if ((retval = krb5_dbe_update_mkvno(context, entry, mkey_kvno)))
-            return retval;
+            goto cleanup;
 
         break;
     case TGT_KEY:
@@ -464,10 +456,11 @@
                                            1,
                                            tgt_keysalt_iterate,
                                            (krb5_pointer) &iargs)))
-            return retval;
+            goto cleanup;
         break;
     case NULL_KEY:
-        return EOPNOTSUPP;
+        retval = EOPNOTSUPP;
+        goto cleanup;
     default:
         break;
     }
@@ -479,7 +472,7 @@
 
     retval = krb5_db_put_principal(context, entry);
 
-error_out:
+cleanup:
     krb5_db_free_principal(context, entry);
     return retval;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/ktutil/ktutil_funcs.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/ktutil/ktutil_funcs.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/server/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/server/deps Changed

@@ -68,15 +68,20 @@
   $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/admin_internal.h \
   $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \
   $(BUILDTOP)/include/kadm5/kadm_rpc.h $(BUILDTOP)/include/kadm5/server_internal.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(VERTO_DEPS) \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(VERTO_DEPS) \
   $(top_srcdir)/include/adm_proto.h $(top_srcdir)/include/gssrpc/auth.h \
   $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \
   $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \
   $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \
   $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \
-  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/net-server.h $(top_srcdir)/include/port-sockets.h \
   $(top_srcdir)/include/socket-utils.h auth.h misc.h \
   server_stubs.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/server/ovsec_kadmd.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/server/ovsec_kadmd.c Changed

@@ -76,10 +76,6 @@
 static krb5_context context;
 static char *progname;
 
-#ifdef USE_PASSWORD_SERVER
-void kadm5_set_use_password_server(void);
-#endif
-
 static void
 usage()
 {
@@ -353,7 +349,7 @@
     const char *pid_file = NULL;
     char **db_args = NULL, **tmpargs;
     const char *acl_file;
-    int ret, i, db_args_size = 0, strong_random = 1, proponly = 0;
+    int ret, i, db_args_size = 0, proponly = 0;
 
     setlocale(LC_ALL, "");
     setvbuf(stderr, NULL, _IONBF, 0);
@@ -396,10 +392,6 @@
             params.mask |= KADM5_CONFIG_MKEY_FROM_KBD;
         } else if (strcmp(*argv, "-nofork") == 0) {
             nofork = 1;
-#ifdef USE_PASSWORD_SERVER
-        } else if (strcmp(*argv, "-passwordserver") == 0) {
-            kadm5_set_use_password_server();
-#endif
 #ifndef DISABLE_IPROP
         } else if (strcmp(*argv, "-proponly") == 0) {
             proponly = 1;
@@ -416,7 +408,7 @@
                 usage();
             pid_file = *argv;
         } else if (strcmp(*argv, "-W") == 0) {
-            strong_random = 0;
+            /* Ignore (deprecated weak random option). */
         } else if (strcmp(*argv, "-p") == 0) {
             argc--, argv++;
             if (!argc)
@@ -530,11 +522,6 @@
     if (ret)
         fail_to_start(ret, _("initializing"));
 
-    krb5_klog_syslog(LOG_INFO, _("Seeding random number generator"));
-    ret = krb5_c_random_os_entropy(context, strong_random, NULL);
-    if (ret)
-        fail_to_start(ret, _("getting random seed"));
-
     if (params.iprop_enabled == TRUE) {
         ulog_set_role(context, IPROP_PRIMARY);

_service:tar_scm:krb5-1.19.2.tar.gz/src/kadmin/server/server_stubs.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kadmin/server/server_stubs.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/deps Changed

@@ -173,6 +173,20 @@
   $(top_srcdir)/include/socket-utils.h extern.h kdc5_err.h \
   kdc_audit.h kdc_util.h main.c policy.h realm_data.h \
   reqstate.h
+$(OUTPRE)ndr.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(VERTO_DEPS) \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-input.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/kdb.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/kdcpreauth_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/net-server.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h kdc_util.h ndr.c \
+  realm_data.h reqstate.h
 $(OUTPRE)policy.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(VERTO_DEPS) \

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/dispatch.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/dispatch.c Changed

@@ -33,8 +33,6 @@
 #include <arpa/inet.h>
 #include <string.h>
 
-static krb5_int32 last_usec = 0, last_os_random = 0;
-
 static krb5_error_code make_too_big_error(kdc_realm_t *kdc_active_realm,
                                           krb5_data **out);
 
@@ -90,34 +88,6 @@
     finish_dispatch(state, code, response);
 }
 
-static void
-reseed_random(krb5_context kdc_err_context)
-{
-    krb5_error_code retval;
-    krb5_timestamp now;
-    krb5_int32 now_usec, usec_difference;
-    krb5_data data;
-
-    retval = krb5_crypto_us_timeofday(&now, &now_usec);
-    if (retval == 0) {
-        usec_difference = now_usec - last_usec;
-        if (last_os_random == 0)
-            last_os_random = now;
-        /* Grab random data from OS every hour*/
-        if (ts_delta(now, last_os_random) >= 60 * 60) {
-            krb5_c_random_os_entropy(kdc_err_context, 0, NULL);
-            last_os_random = now;
-        }
-
-        data.length = sizeof(krb5_int32);
-        data.data = (void *)&usec_difference;
-
-        krb5_c_random_add_entropy(kdc_err_context,
-                                  KRB5_C_RANDSOURCE_TIMING, &data);
-        last_usec = now_usec;
-    }
-}
-
 void
 dispatch(void *cb, const krb5_fulladdr *local_addr,
          const krb5_fulladdr *remote_addr, krb5_data *pkt, int is_tcp,
@@ -172,7 +142,6 @@
      * is currently being processed. */
     kdc_insert_lookaside(kdc_err_context, pkt, NULL);
 #endif
-    reseed_random(kdc_err_context);
 
     /* try TGS_REQ first; they are more common! */

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/do_as_req.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/do_as_req.c Changed

@@ -142,6 +142,7 @@
     if (pa != NULL && pa->length != 0 &&
         req->client->type == KRB5_NT_X500_PRINCIPAL) {
         cert = make_data(pa->contents, pa->length);
+        flags |= KRB5_KDB_FLAG_REFERRAL_OK;
         return krb5_db_get_s4u_x509_principal(context, &cert, req->client,
                                               flags, entry_out);
     } else {
@@ -200,6 +201,7 @@
     void *oldarg;
     kdc_realm_t *kdc_active_realm = state->active_realm;
     krb5_audit_state *au_state = state->au_state;
+    krb5_keyblock *replaced_reply_key = NULL;
 
     assert(state);
     oldrespond = state->respond;
@@ -261,10 +263,14 @@
         goto egress;
     }
 
-    errcode = handle_authdata(kdc_context, state->c_flags, state->client,
+    if (state->rock.replaced_reply_key)
+        replaced_reply_key = &state->client_keyblock;
+
+    errcode = handle_authdata(kdc_active_realm, state->c_flags, state->client,
                               state->server, NULL, state->local_tgt,
                               &state->local_tgt_key, &state->client_keyblock,
-                              &state->server_keyblock, NULL, state->req_pkt,
+                              &state->server_keyblock, NULL,
+                              replaced_reply_key, state->req_pkt,
                               state->request, NULL, NULL, NULL,
                               &state->auth_indicators, &state->enc_tkt_reply);
     if (errcode) {
@@ -473,7 +479,6 @@
                verto_ctx *vctx, loop_respond_fn respond, void *arg)
 {
     krb5_error_code errcode;
-    unsigned int s_flags = 0;
     krb5_data encoded_req_body;
     krb5_enctype useenctype;
     struct as_req_state *state;
@@ -570,19 +575,10 @@
         goto errout;
     limit_string(state->sname);
 
-    /*
-     * We set KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY as a hint
-     * to the backend to return naming information in lieu
-     * of cross realm TGS entries.
-     */
-    setflag(state->c_flags, KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY);
-
-    if (isflagset(state->request->kdc_options, KDC_OPT_CANONICALIZE)) {
-        setflag(state->c_flags, KRB5_KDB_FLAG_CANONICALIZE);
-    }
-    if (include_pac_p(kdc_context, state->request)) {
-        setflag(state->c_flags, KRB5_KDB_FLAG_INCLUDE_PAC);
-    }
+    setflag(state->c_flags, KRB5_KDB_FLAG_CLIENT);
+    if (isflagset(state->request->kdc_options, KDC_OPT_CANONICALIZE) ||
+        state->request->client->type == KRB5_NT_ENTERPRISE_PRINCIPAL)
+        setflag(state->c_flags, KRB5_KDB_FLAG_REFERRAL_OK);
     errcode = lookup_client(kdc_context, state->request, state->c_flags,
                             &state->client);
     if (errcode == KRB5_KDB_CANTLOCK_DB)
@@ -602,12 +598,8 @@
 
     au_state->stage = SRVC_PRINC;
 
-    s_flags = 0;
-    if (isflagset(state->request->kdc_options, KDC_OPT_CANONICALIZE)) {
-        setflag(s_flags, KRB5_KDB_FLAG_CANONICALIZE);
-    }
-    errcode = krb5_db_get_principal(kdc_context, state->request->server,
-                                    s_flags, &state->server);
+    errcode = krb5_db_get_principal(kdc_context, state->request->server, 0,
+                                    &state->server);
     if (errcode == KRB5_KDB_CANTLOCK_DB)
         errcode = KRB5KDC_ERR_SVC_UNAVAILABLE;
     if (errcode == KRB5_KDB_NOENTRY) {
@@ -671,7 +663,7 @@
      * (the intention is to allow support for Windows "short" realm
      * aliases, nothing more).
      */
-    if (isflagset(s_flags, KRB5_KDB_FLAG_CANONICALIZE) &&
+    if (isflagset(state->request->kdc_options, KDC_OPT_CANONICALIZE) &&
         krb5_is_tgs_principal(state->request->server) &&
         krb5_is_tgs_principal(state->server->princ)) {
         state->ticket_reply.server = state->server->princ;
@@ -692,7 +684,7 @@
      */
 
     state->enc_tkt_reply.session = &state->session_key;
-    if (isflagset(state->c_flags, KRB5_KDB_FLAG_CANONICALIZE)) {
+    if (isflagset(state->request->kdc_options, KDC_OPT_CANONICALIZE)) {
         state->client_princ = *(state->client->princ);
     } else {
         state->client_princ = *(state->request->client);
@@ -756,10 +748,9 @@
         state->status = "DECRYPT_CLIENT_KEY";
         goto errout;
     }
-    if (state->client_key != NULL) {
+    if (state->client_key != NULL)
         state->rock.client_key = state->client_key;
-        state->rock.client_keyblock = &state->client_keyblock;
-    }
+    state->rock.client_keyblock = &state->client_keyblock;
 
     errcode = kdc_fast_read_cookie(kdc_context, state->rstate, state->request,
                                    state->local_tgt, &state->local_tgt_key);

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/do_tgs_req.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/do_tgs_req.c Changed

@@ -78,7 +78,8 @@
                   krb5_principal,krb5_data **,const char *, krb5_pa_data **);
 
 static krb5_error_code
-decrypt_2ndtkt(kdc_realm_t *, krb5_kdc_req *, krb5_flags, const krb5_ticket **,
+decrypt_2ndtkt(kdc_realm_t *, krb5_kdc_req *, krb5_flags, krb5_db_entry *,
+               krb5_keyblock *, const krb5_ticket **, krb5_pac *,
                krb5_db_entry **, krb5_keyblock **, const char **);
 
 static krb5_error_code
@@ -121,7 +122,6 @@
     krb5_keyblock session_key, local_tgt_key;
     krb5_keyblock *reply_key = NULL;
     krb5_principal cprinc = NULL, sprinc = NULL, altcprinc = NULL;
-    krb5_const_principal authdata_client;
     krb5_principal stkt_authdata_client = NULL;
     krb5_last_req_entry *nolrarray2, nolrentry;
     int errcode;
@@ -142,7 +142,7 @@
     krb5_pa_data **e_data = NULL;
     krb5_audit_state *au_state = NULL;
     krb5_data **auth_indicators = NULL;
-    void *ad_info = NULL, *stkt_ad_info = NULL;
+    krb5_pac header_pac = NULL, stkt_pac = NULL, subject_pac;
 
     memset(&reply, 0, sizeof(reply));
     memset(&reply_encpart, 0, sizeof(reply_encpart));
@@ -162,17 +162,14 @@
     }
 
     errcode = kdc_make_rstate(kdc_active_realm, &state);
-    if (errcode !=0) {
-        krb5_free_kdc_req(kdc_context, request);
-        return errcode;
-    }
+    if (errcode != 0)
+        goto cleanup;
 
     /* Initialize audit state. */
     errcode = kau_init_kdc_req(kdc_context, request, from, &au_state);
-    if (errcode) {
-        krb5_free_kdc_req(kdc_context, request);
-        return errcode;
-    }
+    if (errcode)
+        goto cleanup;
+
     /* Seed the audit trail with the request ID and basic information. */
     kau_tgs_req(kdc_context, TRUE, au_state);
 
@@ -207,6 +204,11 @@
         status = "FIND_FAST";
         goto cleanup;
     }
+    if (sprinc == NULL) {
+        status = "NULL_SERVER";
+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+        goto cleanup;
+    }
 
     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
                             &local_tgt, &local_tgt_storage, &local_tgt_key);
@@ -215,6 +217,14 @@
         goto cleanup;
     }
 
+    errcode = get_verified_pac(kdc_context, header_ticket->enc_part2,
+                               header_server->princ, header_key, local_tgt,
+                               &local_tgt_key, &header_pac);
+    if (errcode) {
+        status = "HEADER_PAC";
+        goto cleanup;
+    }
+
     /* Ignore (for now) the request modification due to FAST processing. */
     au_state->request = request;
 
@@ -237,10 +247,8 @@
     /* XXX make sure server here has the proper realm...taken from AP_REQ
        header? */
 
-    if (isflagset(request->kdc_options, KDC_OPT_CANONICALIZE)) {
-        setflag(c_flags, KRB5_KDB_FLAG_CANONICALIZE);
-        setflag(s_flags, KRB5_KDB_FLAG_CANONICALIZE);
-    }
+    if (isflagset(request->kdc_options, KDC_OPT_CANONICALIZE))
+        setflag(s_flags, KRB5_KDB_FLAG_REFERRAL_OK);
 
     errcode = search_sprinc(kdc_active_realm, request, s_flags, &server,
                             &status);
@@ -274,18 +282,24 @@
         au_state->status = status;
         kau_s4u2self(kdc_context, errcode ? FALSE : TRUE, au_state);
         au_state->s4u2self_user = NULL;
+        if (errcode)
+            goto cleanup;
     }
+    if (s4u_x509_user != NULL)
+        setflag(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION);
 
     /* For user-to-user and S4U2Proxy requests, decrypt the second ticket. */
-    errcode = decrypt_2ndtkt(kdc_active_realm, request, c_flags,
-                             &stkt, &stkt_server, &stkt_server_key, &status);
+    errcode = decrypt_2ndtkt(kdc_active_realm, request, c_flags, local_tgt,
+                             &local_tgt_key, &stkt, &stkt_pac, &stkt_server,
+                             &stkt_server_key, &status);
     if (errcode)
         goto cleanup;
 
     retval = validate_tgs_request(kdc_active_realm, request, server,
-                                  header_ticket, stkt, stkt_server, kdc_time,
-                                  s4u_x509_user, client, is_crossrealm,
-                                  is_referral, &status, &e_data);
+                                  header_ticket, header_pac, stkt, stkt_pac,
+                                  stkt_server, kdc_time, s4u_x509_user,
+                                  client, is_crossrealm, is_referral,
+                                  &status, &e_data);
     if (retval) {
         if (retval == KDC_ERR_POLICY || retval == KDC_ERR_BADOPTION)
             au_state->violation = PROT_CONSTRAINT;
@@ -293,47 +307,16 @@
         goto cleanup;
     }
 
-    if (errcode)
-        goto cleanup;
-
-    if (s4u_x509_user != NULL && client == NULL) {
-        /*
-         * For an S4U2Self referral request (the requesting service is
-         * following a referral back to its own realm), the authdata in the
-         * header ticket should be for the requested client.
-         */
-        setflag(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION);
-        authdata_client = s4u_x509_user->user_id.user;
-    } else {
-        /* Otherwise (including for initial S4U2Self requests), the authdata
-         * should be for the header ticket client. */
-        authdata_client = header_enc_tkt->client;
-    }
-    errcode = krb5_db_get_authdata_info(kdc_context, c_flags,
-                                        header_enc_tkt->authorization_data,
-                                        authdata_client, request->server,
-                                        header_key, &local_tgt_key, local_tgt,
-                                        header_enc_tkt->times.authtime,
-                                        &ad_info, NULL);
-    if (errcode && errcode != KRB5_PLUGIN_OP_NOTSUPP)
-        goto cleanup;
-
-    /* Flag all S4U2Self requests now that we have checked the authdata. */
-    if (s4u_x509_user != NULL)
-        setflag(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION);
-
     if (isflagset(request->kdc_options, KDC_OPT_CNAME_IN_ADDL_TKT)) {
         /* Do constrained delegation protocol and authorization checks. */
         setflag(c_flags, KRB5_KDB_FLAG_CONSTRAINED_DELEGATION);
 
-        errcode = kdc_process_s4u2proxy_req(kdc_active_realm, c_flags, request,
-                                            stkt->enc_part2, local_tgt,
-                                            &local_tgt_key, stkt_server,
-                                            stkt_server_key,
+        errcode = kdc_process_s4u2proxy_req(kdc_active_realm, c_flags,
+                                            request, header_pac,
+                                            stkt->enc_part2, stkt_pac,
+                                            stkt_server, stkt_server_key,
                                             header_ticket->enc_part2->client,
-                                            server, request->server, ad_info,
-                                            &stkt_ad_info,
-                                            &stkt_authdata_client,
+                                            server, &stkt_authdata_client,
                                             &status);
         if (errcode == KDC_ERR_POLICY || errcode == KDC_ERR_BADOPTION)
             au_state->violation = PROT_CONSTRAINT;
@@ -350,12 +333,6 @@
             goto cleanup;
 
         assert(krb5_is_tgs_principal(header_ticket->server));
-
-        /* Use the parsed authdata from the second ticket during authdata
-         * handling. */
-        krb5_db_free_authdata_info(kdc_context, ad_info);
-        ad_info = stkt_ad_info;
-        stkt_ad_info = NULL;
     }
 
     au_state->stage = ISSUE_TKT;
@@ -374,10 +351,12 @@
 
     if (isflagset(c_flags, KRB5_KDB_FLAG_CONSTRAINED_DELEGATION)) {
         subject_tkt = stkt->enc_part2;
+        subject_pac = stkt_pac;
         subject_server = stkt_server;
         subject_key = stkt_server_key;
     } else {
         subject_tkt = header_enc_tkt;
+        subject_pac = header_pac;
         subject_server = header_server;
         subject_key = header_key;
     }
@@ -409,12 +388,12 @@
                                            server, header_enc_tkt);
     enc_tkt_reply.times.starttime = 0;
 
-    /* OK_TO_AUTH_AS_DELEGATE must be set on the service requesting S4U2Self
-     * for forwardable tickets to be issued. */
-    if (isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION) &&
-        !is_referral &&
-        !isflagset(server->attributes, KRB5_KDB_OK_TO_AUTH_AS_DELEGATE))
-        clear(enc_tkt_reply.flags, TKT_FLG_FORWARDABLE);
+    if (s4u_x509_user != NULL && !is_referral) {
+        /* Check if we need to suppress the forwardable ticket flag. */
+        errcode = s4u2self_forwardable(kdc_context, server, &enc_tkt_reply);
+        if (errcode)
+            goto cleanup;
+    }
 
     /* don't use new addresses unless forwarded, see below */
 
@@ -520,11 +499,12 @@
         encrypting_key = &server_keyblock;
     }
 
-    if (isflagset(c_flags, KRB5_KDB_FLAG_CONSTRAINED_DELEGATION)) {
+    if (isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION)) {
         /*
-         * Don't allow authorization data to be disabled if constrained
-         * delegation is requested. We don't want to deny the server
-         * the ability to validate that delegation was used.
+         * For consistency with Active Directory, don't allow authorization
+         * data to be disabled if S4U2Self is requested.  The server likely
+         * needs a PAC to inspect or for an S4U2Proxy operation, even if it
+         * doesn't need authorization data in tickets received from clients.
          */
         clear(server->attributes, KRB5_KDB_NO_AUTH_DATA_REQUIRED);
     }
@@ -532,8 +512,7 @@
         /* If we are not doing protocol transition, try to look up the subject
          * principal so that KDB modules can add additional authdata. */
         if (!isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION)) {
-            /* Generate authorization data so we can include it in ticket */
-            setflag(c_flags, KRB5_KDB_FLAG_INCLUDE_PAC);
+            setflag(c_flags, KRB5_KDB_FLAG_CLIENT);
             /* Map principals from foreign (possibly non-AD) realms */
             setflag(c_flags, KRB5_KDB_FLAG_MAP_PRINCIPALS);
 
@@ -608,12 +587,12 @@
         goto cleanup;
     }
 
-    errcode = handle_authdata(kdc_context, c_flags, client, server,
+    errcode = handle_authdata(kdc_active_realm, c_flags, client, server,
                               subject_server, local_tgt, &local_tgt_key,
                               subkey != NULL ? subkey :
                               header_ticket->enc_part2->session,
-                              encrypting_key, subject_key, pkt, request,
-                              altcprinc, ad_info, subject_tkt,
+                              encrypting_key, subject_key, NULL, pkt, request,
+                              altcprinc, subject_pac, subject_tkt,
                               &auth_indicators, &enc_tkt_reply);
     if (errcode) {
         krb5_klog_syslog(LOG_INFO, _("TGS_REQ : handle_authdata (%d)"),
@@ -693,8 +672,7 @@
     errcode = return_enc_padata(kdc_context, pkt, request,
                                 reply_key, server, &reply_encpart,
                                 is_referral &&
-                                isflagset(s_flags,
-                                          KRB5_KDB_FLAG_CANONICALIZE));
+                                isflagset(s_flags, KRB5_KDB_FLAG_REFERRAL_OK));
     if (errcode) {
         status = "KDC_RETURN_ENC_PADATA";
         goto cleanup;
@@ -733,11 +711,13 @@
     if (errcode)
         emsg = krb5_get_error_message (kdc_context, errcode);
 
-    au_state->status = status;
-    if (!errcode)
-        au_state->reply = &reply;
-    kau_tgs_req(kdc_context, errcode ? FALSE : TRUE, au_state);
-    kau_free_kdc_req(au_state);
+    if (au_state != NULL) {
+        au_state->status = status;
+        if (!errcode)
+            au_state->reply = &reply;
+        kau_tgs_req(kdc_context, errcode ? FALSE : TRUE, au_state);
+        kau_free_kdc_req(au_state);
+    }
 
     log_tgs_req(kdc_context, from, request, &reply, cprinc,
                 sprinc, altcprinc, authtime,
@@ -747,7 +727,7 @@
         emsg = NULL;
     }
 
-    if (errcode) {
+    if (errcode && state != NULL) {
         int got_err = 0;
         if (status == 0) {
             status = krb5_get_error_message (kdc_context, errcode);
@@ -799,8 +779,8 @@
         krb5_free_authdata(kdc_context, enc_tkt_reply.authorization_data);
     krb5_free_pa_data(kdc_context, e_data);
     k5_free_data_ptr_list(auth_indicators);
-    krb5_db_free_authdata_info(kdc_context, ad_info);
-    krb5_db_free_authdata_info(kdc_context, stkt_ad_info);
+    krb5_pac_free(kdc_context, header_pac);
+    krb5_pac_free(kdc_context, stkt_pac);
     krb5_free_principal(kdc_context, stkt_authdata_client);
 
     return retval;
@@ -885,9 +865,10 @@
  */
 static krb5_error_code
 decrypt_2ndtkt(kdc_realm_t *kdc_active_realm, krb5_kdc_req *req,
-               krb5_flags flags, const krb5_ticket **stkt_out,
-               krb5_db_entry **server_out, krb5_keyblock **key_out,
-               const char **status)
+               krb5_flags flags, krb5_db_entry *local_tgt,
+               krb5_keyblock *local_tgt_key, const krb5_ticket **stkt_out,
+               krb5_pac *pac_out, krb5_db_entry **server_out,
+               krb5_keyblock **key_out, const char **status)
 {
     krb5_error_code retval;
     krb5_db_entry *server = NULL;
@@ -896,6 +877,7 @@
     krb5_ticket *stkt;
 
     *stkt_out = NULL;
+    *pac_out = NULL;
     *server_out = NULL;
     *key_out = NULL;
 
@@ -915,6 +897,12 @@
         *status = "2ND_TKT_DECRYPT";
         goto cleanup;
     }
+    retval = get_verified_pac(kdc_context, stkt->enc_part2, server->princ,
+                              key, local_tgt, local_tgt_key, pac_out);
+    if (retval != 0) {
+        *status = "2ND_TKT_PAC";
+        goto cleanup;
+    }
     *stkt_out = stkt;
     *server_out = server;
     *key_out = key;
@@ -1178,7 +1166,7 @@
      * the server is supposed to match an already-issued ticket. */
     allow_referral = !(req->kdc_options & NO_REFERRAL_OPTION);
     if (!allow_referral)
-        flags &= ~KRB5_KDB_FLAG_CANONICALIZE;
+        flags &= ~KRB5_KDB_FLAG_REFERRAL_OK;
 
     ret = db_get_svc_princ(kdc_context, princ, flags, server, status);
     if (ret == 0 || ret != KRB5_KDB_NOENTRY || !allow_referral)

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/kdc_authdata.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/kdc_authdata.c Changed

@@ -149,23 +149,6 @@
     return result;
 }
 
-/* Return true if authdata contains any elements which should only come from
- * the KDC.  If desired_type is non-zero, look only for that type. */
-static krb5_boolean
-has_kdc_issued_authdata(krb5_authdata **authdata,
-                        krb5_authdatatype desired_type)
-{
-    int i;
-
-    if (authdata == NULL)
-        return FALSE;
-    for (i = 0; authdatai != NULL; i++) {
-        if (is_kdc_issued_authdatum(authdatai, desired_type))
-            return TRUE;
-    }
-    return FALSE;
-}
-
 /* Return true if authdata contains any mandatory-for-KDC elements. */
 static krb5_boolean
 has_mandatory_for_kdc_authdata(krb5_context context, krb5_authdata **authdata)
@@ -312,405 +295,6 @@
     return add_filtered_authdata(tkt_authdata, tgt_authdata);
 }
 
-/* Fetch authorization data from KDB module. */
-static krb5_error_code
-fetch_kdb_authdata(krb5_context context, unsigned int flags,
-                   krb5_db_entry *client, krb5_db_entry *server,
-                   krb5_db_entry *header_server, krb5_db_entry *local_tgt,
-                   krb5_keyblock *client_key, krb5_keyblock *server_key,
-                   krb5_keyblock *header_key, krb5_keyblock *local_tgt_key,
-                   krb5_kdc_req *req, krb5_const_principal altcprinc,
-                   void *ad_info, krb5_enc_tkt_part *enc_tkt_req,
-                   krb5_enc_tkt_part *enc_tkt_reply,
-                   krb5_data ***auth_indicators)
-{
-    krb5_error_code ret;
-    krb5_authdata **tgt_authdata, **db_authdata = NULL;
-    krb5_boolean tgs_req = (req->msg_type == KRB5_TGS_REQ);
-    krb5_const_principal actual_client;
-
-    /*
-     * Check whether KDC issued authorization data should be included.
-     * A server can explicitly disable the inclusion of authorization
-     * data by setting the KRB5_KDB_NO_AUTH_DATA_REQUIRED flag on its
-     * principal entry. Otherwise authorization data will be included
-     * if it was present in the TGT, the client is from another realm
-     * or protocol transition/constrained delegation was used, or, in
-     * the AS-REQ case, if the pre-auth data indicated the PAC should
-     * be present.
-     */
-    if (tgs_req) {
-        assert(enc_tkt_req != NULL);
-
-        if (isflagset(server->attributes, KRB5_KDB_NO_AUTH_DATA_REQUIRED))
-            return 0;
-
-        if (enc_tkt_req->authorization_data == NULL &&
-            !isflagset(flags, KRB5_KDB_FLAG_CROSS_REALM | KRB5_KDB_FLAGS_S4U))
-            return 0;
-
-        assert(enc_tkt_reply->times.authtime == enc_tkt_req->times.authtime);
-    } else {
-        if (!isflagset(flags, KRB5_KDB_FLAG_INCLUDE_PAC))
-            return 0;
-    }
-
-    /* S4U referral replies should contain authdata for the requested client,
-     * even though they use the requesting service as the ticket client. */
-    if (isflagset(flags, KRB5_KDB_FLAGS_S4U))
-        actual_client = altcprinc;
-    else
-        actual_client = enc_tkt_reply->client;
-
-    tgt_authdata = tgs_req ? enc_tkt_req->authorization_data : NULL;
-    ret = krb5_db_sign_authdata(context, flags, actual_client, req->server,
-                                client, server, header_server, local_tgt,
-                                client_key, server_key, header_key,
-                                local_tgt_key, enc_tkt_reply->session,
-                                enc_tkt_reply->times.authtime, tgt_authdata,
-                                ad_info, auth_indicators, &db_authdata);
-    if (ret)
-        return (ret == KRB5_PLUGIN_OP_NOTSUPP) ? 0 : ret;
-
-    /* Put the KDB authdata first in the ticket.  A successful merge places the
-     * combined list in db_authdata and releases the old ticket authdata. */
-    ret = merge_authdata(&db_authdata, &enc_tkt_reply->authorization_data);
-    if (ret)
-        krb5_free_authdata(context, db_authdata);
-    else
-        enc_tkt_reply->authorization_data = db_authdata;
-    return ret;
-}
-
-static krb5_error_code
-make_signedpath_data(krb5_context context, krb5_const_principal client,
-                     krb5_timestamp authtime, krb5_principal *deleg_path,
-                     krb5_pa_data **method_data, krb5_authdata **authdata,
-                     krb5_data **data)
-{
-    krb5_error_code ret;
-    krb5_ad_signedpath_data sp_data;
-    krb5_authdata **sign_authdata = NULL;
-    size_t i, j, count;
-
-    memset(&sp_data, 0, sizeof(sp_data));
-
-    for (count = 0; authdata != NULL && authdatacount != NULL; count++);
-    if (count != 0) {
-        /* Make a shallow copy with AD-SIGNTICKET filtered out. */
-        sign_authdata = k5calloc(count + 1, sizeof(krb5_authdata *), &ret);
-        if (sign_authdata == NULL)
-            return ret;
-
-        for (i = 0, j = 0; authdatai != NULL; i++) {
-            if (is_kdc_issued_authdatum(authdatai, KRB5_AUTHDATA_SIGNTICKET))
-                continue;
-
-            sign_authdataj++ = authdatai;
-        }
-
-        sign_authdataj = NULL;
-    }
-
-    sp_data.client = (krb5_principal)client;
-    sp_data.authtime = authtime;
-    sp_data.delegated = deleg_path;
-    sp_data.method_data = method_data;
-    sp_data.authorization_data = sign_authdata;
-
-    ret = encode_krb5_ad_signedpath_data(&sp_data, data);
-
-    if (sign_authdata != NULL)
-        free(sign_authdata);
-
-    return ret;
-}
-
-static krb5_error_code
-verify_signedpath_checksum(krb5_context context, krb5_db_entry *local_tgt,
-                           krb5_keyblock *local_tgt_key,
-                           krb5_enc_tkt_part *enc_tkt_part,
-                           krb5_principal *deleg_path,
-                           krb5_pa_data **method_data, krb5_checksum *cksum,
-                           krb5_boolean *valid_out)
-{
-    krb5_error_code ret;
-    krb5_data *data;
-    krb5_key_data *kd;
-    krb5_keyblock tgtkey;
-    krb5_kvno kvno;
-    krb5_boolean valid = FALSE;
-    int tries;
-
-    *valid_out = FALSE;
-    memset(&tgtkey, 0, sizeof(tgtkey));
-
-    if (!krb5_c_is_keyed_cksum(cksum->checksum_type))
-        return KRB5KRB_AP_ERR_INAPP_CKSUM;
-
-    ret = make_signedpath_data(context, enc_tkt_part->client,
-                               enc_tkt_part->times.authtime, deleg_path,
-                               method_data, enc_tkt_part->authorization_data,
-                               &data);
-    if (ret)
-        return ret;
-
-    ret = krb5_c_verify_checksum(context, local_tgt_key,
-                                 KRB5_KEYUSAGE_AD_SIGNEDPATH, data, cksum,
-                                 &valid);
-    if (ret || !valid) {
-        /* There is no kvno in AD-SIGNTICKET, so try two previous versions. */
-        kvno = local_tgt->key_data0.key_data_kvno - 1;
-        for (tries = 2; tries > 0 && kvno > 0; tries--, kvno--) {
-            /* Get the first local tgt key of this kvno. */
-            ret = krb5_dbe_find_enctype(context, local_tgt, -1, -1, kvno, &kd);
-            if (ret) {
-                ret = 0;
-                break;
-            }
-            ret = krb5_dbe_decrypt_key_data(context, NULL, kd, &tgtkey, NULL);
-            if (ret)
-                break;
-
-            ret = krb5_c_verify_checksum(context, &tgtkey,
-                                         KRB5_KEYUSAGE_AD_SIGNEDPATH, data,
-                                         cksum, &valid);
-            krb5_free_keyblock_contents(context, &tgtkey);
-            if (!ret && valid)
-                break;
-        }
-    }
-
-    *valid_out = valid;
-    krb5_free_data(context, data);
-    return ret;
-}
-
-
-static krb5_error_code
-verify_signedpath(krb5_context context, krb5_db_entry *local_tgt,
-                  krb5_keyblock *local_tgt_key,
-                  krb5_enc_tkt_part *enc_tkt_part,
-                  krb5_principal **delegated_out, krb5_boolean *pathsigned_out)
-{
-    krb5_error_code ret;
-    krb5_ad_signedpath *sp = NULL;
-    krb5_authdata **sp_authdata = NULL;
-    krb5_data enc_sp;
-
-    *delegated_out = NULL;
-    *pathsigned_out = FALSE;
-
-    ret = krb5_find_authdata(context, enc_tkt_part->authorization_data, NULL,
-                             KRB5_AUTHDATA_SIGNTICKET, &sp_authdata);
-    if (ret)
-        goto cleanup;
-
-    if (sp_authdata == NULL ||
-        sp_authdata0->ad_type != KRB5_AUTHDATA_SIGNTICKET ||
-        sp_authdata1 != NULL)
-        goto cleanup;
-
-    enc_sp.data = (char *)sp_authdata0->contents;
-    enc_sp.length = sp_authdata0->length;
-
-    ret = decode_krb5_ad_signedpath(&enc_sp, &sp);
-    if (ret) {
-        /* Treat an invalid signedpath authdata element as a missing one, since
-         * we believe MS is using the same number for something else. */
-        ret = 0;
-        goto cleanup;
-    }
-
-    ret = verify_signedpath_checksum(context, local_tgt, local_tgt_key,
-                                     enc_tkt_part, sp->delegated,
-                                     sp->method_data, &sp->checksum,
-                                     pathsigned_out);
-    if (ret)
-        goto cleanup;
-
-    if (*pathsigned_out) {
-        *delegated_out = sp->delegated;
-        sp->delegated = NULL;
-    }
-
-cleanup:
-    krb5_free_ad_signedpath(context, sp);
-    krb5_free_authdata(context, sp_authdata);
-    return ret;
-}
-
-static krb5_error_code
-make_signedpath_checksum(krb5_context context,
-                         krb5_const_principal for_user_princ,
-                         krb5_keyblock *local_tgt_key,
-                         krb5_enc_tkt_part *enc_tkt_part,
-                         krb5_principal *deleg_path,
-                         krb5_pa_data **method_data, krb5_checksum *cksum_out,
-                         krb5_enctype *enctype_out)
-{
-    krb5_error_code ret;
-    krb5_data *data = NULL;
-    krb5_const_principal client;
-
-    memset(cksum_out, 0, sizeof(*cksum_out));
-    *enctype_out = ENCTYPE_NULL;
-
-    client = (for_user_princ != NULL) ? for_user_princ : enc_tkt_part->client;
-
-    ret = make_signedpath_data(context, client, enc_tkt_part->times.authtime,
-                               deleg_path, method_data,
-                               enc_tkt_part->authorization_data, &data);
-    if (ret)
-        return ret;
-
-    ret = krb5_c_make_checksum(context, 0, local_tgt_key,
-                               KRB5_KEYUSAGE_AD_SIGNEDPATH, data, cksum_out);
-    krb5_free_data(context, data);
-    if (ret)
-        return ret;
-
-    *enctype_out = local_tgt_key->enctype;
-    return 0;
-}
-
-static krb5_error_code
-make_signedpath(krb5_context context, krb5_const_principal for_user_princ,
-                krb5_principal server, krb5_keyblock *local_tgt_key,
-                krb5_principal *deleg_path, krb5_enc_tkt_part *enc_tkt_reply)
-{
-    krb5_error_code ret;
-    krb5_ad_signedpath sp;
-    krb5_data *data = NULL;
-    krb5_authdata ad_datum, *ad_data2;
-    krb5_authdata **if_relevant = NULL;
-    size_t count;
-
-    memset(&sp, 0, sizeof(sp));
-
-    for (count = 0; deleg_path != NULL && deleg_pathcount != NULL; count++);
-
-    sp.delegated = k5calloc(count + 2, sizeof(krb5_principal), &ret);
-    if (sp.delegated == NULL)
-        goto cleanup;
-
-    /* Combine existing and new transited services, if any */
-    if (deleg_path != NULL)
-        memcpy(sp.delegated, deleg_path, count * sizeof(krb5_principal));
-    if (server != NULL)
-        sp.delegatedcount++ = server;
-    sp.delegatedcount = NULL;
-    sp.method_data = NULL;
-
-    ret = make_signedpath_checksum(context, for_user_princ, local_tgt_key,
-                                   enc_tkt_reply, sp.delegated, sp.method_data,
-                                   &sp.checksum, &sp.enctype);
-    if (ret) {
-        if (ret == KRB5KRB_AP_ERR_INAPP_CKSUM) {
-            /*
-             * In the hopefully unlikely case the TGS key enctype has an
-             * unkeyed mandatory checksum type, do not fail so we do not
-             * prevent the KDC from servicing requests.
-             */
-            ret = 0;
-        }
-        goto cleanup;
-    }
-
-    ret = encode_krb5_ad_signedpath(&sp, &data);
-    if (ret)
-        goto cleanup;
-
-    ad_datum.ad_type = KRB5_AUTHDATA_SIGNTICKET;
-    ad_datum.contents = (krb5_octet *)data->data;
-    ad_datum.length = data->length;
-
-    ad_data0 = &ad_datum;
-    ad_data1 = NULL;
-
-    ret = krb5_encode_authdata_container(context, KRB5_AUTHDATA_IF_RELEVANT,
-                                         ad_data, &if_relevant);
-    if (ret)
-        goto cleanup;
-
-    /* Add the signedpath authdata to the ticket. */
-    ret = merge_authdata(&enc_tkt_reply->authorization_data, &if_relevant);
-
-cleanup:
-    free(sp.delegated);
-    krb5_free_authdata(context, if_relevant);
-    krb5_free_data(context, data);
-    krb5_free_checksum_contents(context, &sp.checksum);
-    krb5_free_pa_data(context, sp.method_data);
-    return ret;
-}
-
-static void
-free_deleg_path(krb5_context context, krb5_principal *deleg_path)
-{
-    int i;
-
-    for (i = 0; deleg_path != NULL && deleg_pathi != NULL; i++)
-        krb5_free_principal(context, deleg_pathi);
-    free(deleg_path);
-}
-
-/* Return true if the Windows PAC is present in authorization data. */
-static krb5_boolean
-has_pac(krb5_context context, krb5_authdata **authdata)
-{
-    return has_kdc_issued_authdata(authdata, KRB5_AUTHDATA_WIN2K_PAC);
-}
-
-/* Verify AD-SIGNTICKET authdata if we need to, and insert an AD-SIGNEDPATH
- * element if we should. */
-static krb5_error_code
-handle_signticket(krb5_context context, unsigned int flags,
-                  krb5_db_entry *subject_server, krb5_db_entry *server,
-                  krb5_db_entry *local_tgt, krb5_keyblock *local_tgt_key,
-                  krb5_kdc_req *req, krb5_const_principal for_user_princ,
-                  krb5_enc_tkt_part *enc_tkt_req,
-                  krb5_enc_tkt_part *enc_tkt_reply)
-{
-    krb5_error_code ret = 0;
-    krb5_principal *deleg_path = NULL;
-    krb5_boolean signed_path = FALSE;
-    krb5_boolean s4u2proxy;
-
-    s4u2proxy = isflagset(flags, KRB5_KDB_FLAG_CONSTRAINED_DELEGATION);
-
-    /* For cross-realm the Windows PAC must have been verified, and it
-     * fulfills the same role as the signed path. */
-    if (req->msg_type == KRB5_TGS_REQ &&
-        (!isflagset(flags, KRB5_KDB_FLAG_CROSS_REALM) ||
-         !has_pac(context, enc_tkt_req->authorization_data))) {
-        ret = verify_signedpath(context, local_tgt, local_tgt_key, enc_tkt_req,
-                                &deleg_path, &signed_path);
-        if (ret)
-            goto cleanup;
-
-        if (s4u2proxy && signed_path == FALSE) {
-            ret = KRB5KDC_ERR_BADOPTION;
-            goto cleanup;
-        }
-    }
-
-    /* No point in including signedpath authdata for a cross-realm TGT, since
-     * it will be presented to a different KDC. */
-    if (!isflagset(server->attributes, KRB5_KDB_NO_AUTH_DATA_REQUIRED) &&
-        !is_cross_tgs_principal(server->princ)) {
-        ret = make_signedpath(context, for_user_princ,
-                              s4u2proxy ? subject_server->princ : NULL,
-                              local_tgt_key, deleg_path, enc_tkt_reply);
-        if (ret)
-            goto cleanup;
-    }
-
-cleanup:
-    free_deleg_path(context, deleg_path);
-    return ret;
-}
-
 /* Add authentication indicator authdata to enc_tkt_reply, wrapped in a CAMMAC
  * and an IF-RELEVANT container. */
 static krb5_error_code
@@ -723,6 +307,9 @@
     krb5_data *der_indicators = NULL;
     krb5_authdata ad, *list2, **cammac = NULL;
 
+    if (auth_indicators == NULL || *auth_indicators == NULL)
+        return 0;
+
     /* Format the authentication indicators into an authdata list. */
     ret = encode_utf8_strings(auth_indicators, &der_indicators);
     if (ret)
@@ -792,21 +379,211 @@
     return ret;
 }
 
+static krb5_error_code
+update_delegation_info(krb5_context context, krb5_kdc_req *req,
+                       krb5_pac old_pac, krb5_pac new_pac)
+{
+    krb5_error_code ret;
+    krb5_data ndr_di_in = empty_data(), ndr_di_out = empty_data();
+    struct pac_s4u_delegation_info *di = NULL;
+    char *namestr = NULL;
+
+    ret = krb5_pac_get_buffer(context, old_pac, KRB5_PAC_DELEGATION_INFO,
+                              &ndr_di_in);
+    if (ret && ret != ENOENT)
+        goto cleanup;
+    if (ret) {
+        /* Create new delegation info. */
+        di = k5alloc(sizeof(*di), &ret);
+        if (di == NULL)
+            goto cleanup;
+        di->transited_services = k5calloc(1, sizeof(char *), &ret);
+        if (di->transited_services == NULL)
+            goto cleanup;
+    } else {
+        /* Decode and modify old delegation info. */
+        ret = ndr_dec_delegation_info(&ndr_di_in, &di);
+        if (ret)
+            goto cleanup;
+    }
+
+    /* Set proxy_target to the requested server, without realm. */
+    ret = krb5_unparse_name_flags(context, req->server,
+                                  KRB5_PRINCIPAL_UNPARSE_DISPLAY |
+                                  KRB5_PRINCIPAL_UNPARSE_NO_REALM,
+                                  &namestr);
+    if (ret)
+        goto cleanup;
+    free(di->proxy_target);
+    di->proxy_target = namestr;
+
+    /* Add a transited entry for the requesting service, with realm. */
+    assert(req->second_ticket != NULL && req->second_ticket0 != NULL);
+    ret = krb5_unparse_name(context, req->second_ticket0->server, &namestr);
+    if (ret)
+        goto cleanup;
+    di->transited_servicesdi->transited_services_length++ = namestr;
+
+    ret = ndr_enc_delegation_info(di, &ndr_di_out);
+    if (ret)
+        goto cleanup;
+
+    ret = krb5_pac_add_buffer(context, new_pac, KRB5_PAC_DELEGATION_INFO,
+                              &ndr_di_out);
+
+cleanup:
+    krb5_free_data_contents(context, &ndr_di_in);
+    krb5_free_data_contents(context, &ndr_di_out);
+    ndr_free_delegation_info(di);
+    return ret;
+}
+
+static krb5_error_code
+copy_pac_buffer(krb5_context context, uint32_t buffer_type, krb5_pac old_pac,
+                krb5_pac new_pac)
+{
+    krb5_error_code ret;
+    krb5_data data;
+
+    ret = krb5_pac_get_buffer(context, old_pac, buffer_type, &data);
+    if (ret)
+        return ret;
+    ret = krb5_pac_add_buffer(context, new_pac, buffer_type, &data);
+    krb5_free_data_contents(context, &data);
+    return ret;
+}
+
+/*
+ * Possibly add a signed PAC to enc_tkt_reply.  Also possibly add auth
+ * indicators; these are handled here so that the KDB module's issue_pac()
+ * method can alter the auth indicator list.
+ */
+static krb5_error_code
+handle_pac(kdc_realm_t *kdc_active_realm, unsigned int flags,
+           krb5_db_entry *client, krb5_db_entry *server,
+           krb5_db_entry *subject_server, krb5_db_entry *local_tgt,
+           krb5_keyblock *local_tgt_key, krb5_keyblock *server_key,
+           krb5_keyblock *subject_key, krb5_keyblock *replaced_reply_key,
+           krb5_enc_tkt_part *subject_tkt, krb5_pac subject_pac,
+           krb5_kdc_req *req, krb5_const_principal altcprinc,
+           krb5_timestamp authtime, krb5_enc_tkt_part *enc_tkt_reply,
+           krb5_data ***auth_indicators)
+{
+    krb5_error_code ret;
+    krb5_context context = kdc_context;
+    krb5_pac new_pac = NULL;
+    krb5_const_principal pac_client = NULL;
+    krb5_boolean with_realm, is_as_req = (req->msg_type == KRB5_AS_REQ);
+    krb5_db_entry *signing_tgt;
+
+    /* Don't add a PAC or auth indicators if the server disables authdata. */
+    if (server->attributes & KRB5_KDB_NO_AUTH_DATA_REQUIRED)
+        return 0;
+
+    /*
+     * Don't add a PAC if the realm disables them, or to an anonymous ticket,
+     * or for an AS-REQ if the client requested not to get one, or for a
+     * TGS-REQ if the subject ticket didn't contain one.
+     */
+    if (kdc_active_realm->realm_disable_pac ||
+        (enc_tkt_reply->flags & TKT_FLG_ANONYMOUS) ||
+        (is_as_req && !include_pac_p(context, req)) ||
+        (!is_as_req && subject_pac == NULL)) {
+        return add_auth_indicators(context, *auth_indicators, server_key,
+                                   local_tgt, local_tgt_key, enc_tkt_reply);
+    }
+
+    ret = krb5_pac_init(context, &new_pac);
+    if (ret)
+        goto cleanup;
+
+    if (subject_pac == NULL)
+        signing_tgt = NULL;
+    else if (krb5_is_tgs_principal(subject_server->princ))
+        signing_tgt = subject_server;
+    else
+        signing_tgt = local_tgt;
+
+    ret = krb5_db_issue_pac(context, flags, client, replaced_reply_key, server,
+                            signing_tgt, authtime, subject_pac, new_pac,
+                            auth_indicators);
+    if (ret) {
+        if (ret == KRB5_PLUGIN_OP_NOTSUPP)
+            ret = 0;
+        if (ret)
+            goto cleanup;
+    }
+
+    ret = add_auth_indicators(context, *auth_indicators, server_key,
+                              local_tgt, local_tgt_key, enc_tkt_reply);
+
+    if ((flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) &&
+        !(flags & KRB5_KDB_FLAG_CROSS_REALM)) {
+        /* Add delegation info for the first S4U2Proxy request. */
+        ret = update_delegation_info(context, req, subject_pac, new_pac);
+        if (ret)
+            goto cleanup;
+    } else if (subject_pac != NULL) {
+        /* Copy delegation info if it was present in the subject PAC. */
+        ret = copy_pac_buffer(context, KRB5_PAC_DELEGATION_INFO, subject_pac,
+                              new_pac);
+        if (ret && ret != ENOENT)
+            goto cleanup;
+    }
+
+    if ((flags & KRB5_KDB_FLAGS_S4U) &&
+        (flags & KRB5_KDB_FLAG_ISSUING_REFERRAL)) {
+        /* When issuing a referral for either kind of S4U request, add client
+         * info for the subject with realm. */
+        pac_client = altcprinc;
+        with_realm = TRUE;
+    } else if (subject_pac == NULL || (flags & KRB5_KDB_FLAGS_S4U)) {
+        /* For a new PAC or when issuing a final ticket for either kind of S4U
+         * request, add client info for the ticket client without the realm. */
+        pac_client = enc_tkt_reply->client;
+        with_realm = FALSE;
+    } else {
+        /*
+         * For regular TGS and transitive RBCD requests, copy the client info
+         * from the incoming PAC, and don't add client info during signing.  We
+         * validated the incoming client info in validate_tgs_request().
+         */
+        ret = copy_pac_buffer(context, KRB5_PAC_CLIENT_INFO, subject_pac,
+                              new_pac);
+        if (ret)
+            goto cleanup;
+        pac_client = NULL;
+        with_realm = FALSE;
+    }
+
+    ret = krb5_kdc_sign_ticket(context, enc_tkt_reply, new_pac, server->princ,
+                               pac_client, server_key, local_tgt_key,
+                               with_realm);
+    if (ret)
+        goto cleanup;
+
+    ret = 0;
+
+cleanup:
+    krb5_pac_free(context, new_pac);
+    return ret;
+}
+
 krb5_error_code
-handle_authdata(krb5_context context, unsigned int flags,
+handle_authdata(kdc_realm_t *kdc_active_realm, unsigned int flags,
                 krb5_db_entry *client, krb5_db_entry *server,
                 krb5_db_entry *subject_server, krb5_db_entry *local_tgt,
                 krb5_keyblock *local_tgt_key, krb5_keyblock *client_key,
                 krb5_keyblock *server_key, krb5_keyblock *subject_key,
-                krb5_data *req_pkt, krb5_kdc_req *req,
-                krb5_const_principal altcprinc, void *ad_info,
-                krb5_enc_tkt_part *enc_tkt_req,
-                krb5_data ***auth_indicators,
-                krb5_enc_tkt_part *enc_tkt_reply)
+                krb5_keyblock *replaced_reply_key, krb5_data *req_pkt,
+                krb5_kdc_req *req, krb5_const_principal altcprinc,
+                krb5_pac subject_pac, krb5_enc_tkt_part *enc_tkt_req,
+                krb5_data ***auth_indicators, krb5_enc_tkt_part *enc_tkt_reply)
 {
     kdcauthdata_handle *h;
     krb5_error_code ret = 0;
     size_t i;
+    krb5_context context = kdc_active_realm->realm_context;
 
     if (req->msg_type == KRB5_TGS_REQ &&
         req->authorization_data.ciphertext.data != NULL) {
@@ -839,35 +616,9 @@
             return ret;
     }
 
-    if (!isflagset(enc_tkt_reply->flags, TKT_FLG_ANONYMOUS)) {
-        /* Fetch authdata from the KDB if appropriate. */
-        ret = fetch_kdb_authdata(context, flags, client, server,
-                                 subject_server, local_tgt, client_key,
-                                 server_key, subject_key, local_tgt_key,
-                                 req, altcprinc, ad_info, enc_tkt_req,
-                                 enc_tkt_reply, auth_indicators);
-        if (ret)
-            return ret;
-    }
-
-    /* Add auth indicators if any were given. */
-    if (auth_indicators != NULL && *auth_indicators != NULL &&
-        !isflagset(server->attributes, KRB5_KDB_NO_AUTH_DATA_REQUIRED)) {
-        ret = add_auth_indicators(context, *auth_indicators, server_key,
-                                  local_tgt, local_tgt_key, enc_tkt_reply);
-        if (ret)
-            return ret;
-    }
-
-    if (!isflagset(enc_tkt_reply->flags, TKT_FLG_ANONYMOUS)) {
-        /* Validate and insert AD-SIGNTICKET authdata.  This must happen last
-         * since it contains a signature over the other authdata. */
-        ret = handle_signticket(context, flags, subject_server, server,
-                                local_tgt, local_tgt_key, req, altcprinc,
-                                enc_tkt_req, enc_tkt_reply);
-        if (ret)
-            return ret;
-    }
-
-    return 0;
+    return handle_pac(kdc_active_realm, flags, client, server, subject_server,
+                      local_tgt, local_tgt_key, server_key, subject_key,
+                      replaced_reply_key, enc_tkt_req, subject_pac, req,
+                      altcprinc, enc_tkt_reply->times.authtime, enc_tkt_reply,
+                      auth_indicators);
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/kdc_preauth.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/kdc_preauth.c Changed

@@ -449,6 +449,8 @@
 static const krb5_keyblock *
 client_keyblock(krb5_context context, krb5_kdcpreauth_rock rock)
 {
+    if (rock->client_keyblock->enctype == ENCTYPE_NULL)
+        return NULL;
     return rock->client_keyblock;
 }
 
@@ -489,7 +491,7 @@
         krb5_principal_compare(context, princ, client))
         return TRUE;
 
-    if (krb5_db_get_principal(context, princ, 0, &ent))
+    if (krb5_db_get_principal(context, princ, KRB5_KDB_FLAG_CLIENT, &ent))
         return FALSE;
     match = krb5_principal_compare(context, ent->princ, client);
     krb5_db_free_principal(context, ent);
@@ -562,8 +564,23 @@
     return valid ? 0 : KRB5KDC_ERR_PREAUTH_EXPIRED;
 }
 
+static krb5_error_code
+replace_reply_key(krb5_context context, krb5_kdcpreauth_rock rock,
+                  const krb5_keyblock *key, krb5_boolean is_strengthen)
+{
+    krb5_keyblock copy;
+
+    if (krb5_copy_keyblock_contents(context, key, &copy) != 0)
+        return ENOMEM;
+    krb5_free_keyblock_contents(context, rock->client_keyblock);
+    *rock->client_keyblock = copy;
+    if (!is_strengthen)
+        rock->replaced_reply_key = TRUE;
+    return 0;
+}
+
 static struct krb5_kdcpreauth_callbacks_st callbacks = {
-    5,
+    6,
     max_time_skew,
     client_keys,
     free_keys,
@@ -581,7 +598,8 @@
     match_client,
     client_name,
     send_freshness_token,
-    check_freshness_token
+    check_freshness_token,
+    replace_reply_key
 };
 
 static krb5_error_code

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/kdc_preauth_ec.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/kdc_preauth_ec.c Changed

@@ -55,9 +55,9 @@
           krb5_kdcpreauth_moddata moddata,
           krb5_kdcpreauth_verify_respond_fn respond, void *arg)
 {
-    krb5_error_code retval = 0;
+    krb5_error_code ret;
     krb5_enc_data *enc = NULL;
-    krb5_data scratch, plain;
+    krb5_data der_enc_ts = empty_data(), der_enc_data;
     krb5_keyblock *armor_key = cb->fast_armor(context, rock);
     krb5_pa_enc_ts *ts = NULL;
     krb5_keyblock *client_keys = NULL;
@@ -68,89 +68,87 @@
     char *ai = NULL, *realmstr = NULL;
     krb5_data realm = request->server->realm;
 
-    plain.data = NULL;
-
     if (armor_key == NULL) {
-        retval = ENOENT;
-        k5_setmsg(context, ENOENT,
+        ret = ENOENT;
+        k5_setmsg(context, ret,
                   _("Encrypted Challenge used outside of FAST tunnel"));
+        goto cleanup;
     }
-    scratch.data = (char *) data->contents;
-    scratch.length = data->length;
-    if (retval == 0)
-        retval = decode_krb5_enc_data(&scratch, &enc);
-    if (retval == 0) {
-        plain.data =  malloc(enc->ciphertext.length);
-        plain.length = enc->ciphertext.length;
-        if (plain.data == NULL)
-            retval = ENOMEM;
+
+    der_enc_data = make_data(data->contents, data->length);
+    ret = decode_krb5_enc_data(&der_enc_data, &enc);
+    if (ret)
+        goto cleanup;
+
+    ret = alloc_data(&der_enc_ts, enc->ciphertext.length);
+    if (ret)
+        goto cleanup;
+
+    /* Check for a configured auth indicator. */
+    realmstr = k5memdup0(realm.data, realm.length, &ret);
+    if (realmstr == NULL)
+        goto cleanup;
+    ret = profile_get_string(context->profile, KRB5_CONF_REALMS, realmstr,
+                             KRB5_CONF_ENCRYPTED_CHALLENGE_INDICATOR, NULL,
+                             &ai);
+    if (ret)
+        goto cleanup;
+
+    ret = cb->client_keys(context, rock, &client_keys);
+    if (ret)
+        goto cleanup;
+    for (i = 0; client_keysi.enctype != ENCTYPE_NULL; i++) {
+        ret = krb5_c_fx_cf2_simple(context, armor_key, "clientchallengearmor",
+                                   &client_keysi, "challengelongterm",
+                                   &challenge_key);
+        if (ret)
+            goto cleanup;
+        ret = krb5_c_decrypt(context, challenge_key,
+                             KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT, NULL, enc,
+                             &der_enc_ts);
+        krb5_free_keyblock(context, challenge_key);
+        if (!ret)
+            break;
     }
 
-    /* Check for a configured FAST ec auth indicator. */
-    if (retval == 0)
-        realmstr = k5memdup0(realm.data, realm.length, &retval);
-    if (realmstr != NULL)
-        retval = profile_get_string(context->profile, KRB5_CONF_REALMS,
-                                    realmstr,
-                                    KRB5_CONF_ENCRYPTED_CHALLENGE_INDICATOR,
-                                    NULL, &ai);
-
-    if (retval == 0)
-        retval = cb->client_keys(context, rock, &client_keys);
-    if (retval == 0) {
-        for (i = 0; client_keysi.enctype&& (retval == 0); i++ ) {
-            retval = krb5_c_fx_cf2_simple(context,
-                                          armor_key, "clientchallengearmor",
-                                          &client_keysi, "challengelongterm",
-                                          &challenge_key);
-            if (retval == 0)
-                retval  = krb5_c_decrypt(context, challenge_key,
-                                         KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT,
-                                         NULL, enc, &plain);
-            if (challenge_key)
-                krb5_free_keyblock(context, challenge_key);
-            challenge_key = NULL;
-            if (retval == 0)
-                break;
-            /*We failed to decrypt. Try next key*/
-            retval = 0;
-        }
-        if (client_keysi.enctype == 0) {
-            retval = KRB5KDC_ERR_PREAUTH_FAILED;
-            k5_setmsg(context, retval,
-                      _("Incorrect password in encrypted challenge"));
-        }
+    if (client_keysi.enctype == ENCTYPE_NULL) {
+        ret = KRB5KDC_ERR_PREAUTH_FAILED;
+        k5_setmsg(context, ret,
+                  _("Incorrect password in encrypted challenge"));
+        goto cleanup;
     }
-    if (retval == 0)
-        retval = decode_krb5_pa_enc_ts(&plain, &ts);
-    if (retval == 0)
-        retval = krb5_check_clockskew(context, ts->patimestamp);
-    if (retval == 0) {
-        enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
-        /*
-         * If this fails, we won't generate a reply to the client.  That may
-         * cause the client to fail, but at this point the KDC has considered
-         * this a success, so the return value is ignored.
-         */
-        if (krb5_c_fx_cf2_simple(context, armor_key, "kdcchallengearmor",
-                                 &client_keysi, "challengelongterm",
-                                 &kdc_challenge_key) == 0) {
-            modreq = (krb5_kdcpreauth_modreq)kdc_challenge_key;
-            if (ai != NULL)
-                cb->add_auth_indicator(context, rock, ai);
-        }
+
+    ret = decode_krb5_pa_enc_ts(&der_enc_ts, &ts);
+    if (ret)
+        goto cleanup;
+    ret = krb5_check_clockskew(context, ts->patimestamp);
+    if (ret)
+        goto cleanup;
+
+    enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
+
+    /*
+     * If this fails, we won't generate a reply to the client.  That may cause
+     * the client to fail, but at this point the KDC has considered this a
+     * success, so the return value is ignored.
+     */
+    if (krb5_c_fx_cf2_simple(context, armor_key, "kdcchallengearmor",
+                             &client_keysi, "challengelongterm",
+                             &kdc_challenge_key) == 0) {
+        modreq = (krb5_kdcpreauth_modreq)kdc_challenge_key;
+        if (ai != NULL)
+            cb->add_auth_indicator(context, rock, ai);
     }
+
+cleanup:
     cb->free_keys(context, rock, client_keys);
-    if (plain.data)
-        free(plain.data);
-    if (enc)
-        krb5_free_enc_data(context, enc);
-    if (ts)
-        krb5_free_pa_enc_ts(context, ts);
+    free(der_enc_ts.data);
+    krb5_free_enc_data(context, enc);
+    krb5_free_pa_enc_ts(context, ts);
     free(realmstr);
     free(ai);
 
-    (*respond)(arg, retval, modreq, NULL, NULL);
+    (*respond)(arg, ret, modreq, NULL, NULL);
 }
 
 static krb5_error_code
@@ -160,49 +158,50 @@
           krb5_kdcpreauth_callbacks cb, krb5_kdcpreauth_rock rock,
           krb5_kdcpreauth_moddata moddata, krb5_kdcpreauth_modreq modreq)
 {
-    krb5_error_code retval = 0;
+    krb5_error_code ret;
     krb5_keyblock *challenge_key = (krb5_keyblock *)modreq;
     krb5_pa_enc_ts ts;
-    krb5_data *plain = NULL;
+    krb5_data *der_enc_ts = NULL, *der_enc_data = NULL;
     krb5_enc_data enc;
-    krb5_data *encoded = NULL;
     krb5_pa_data *pa = NULL;
 
+    enc.ciphertext.data = NULL;
+
     if (challenge_key == NULL)
         return 0;
-    enc.ciphertext.data = NULL; /* In case of error pass through */
-
-    retval = krb5_us_timeofday(context, &ts.patimestamp, &ts.pausec);
-    if (retval == 0)
-        retval = encode_krb5_pa_enc_ts(&ts, &plain);
-    if (retval == 0)
-        retval = krb5_encrypt_helper(context, challenge_key,
-                                     KRB5_KEYUSAGE_ENC_CHALLENGE_KDC,
-                                     plain, &enc);
-    if (retval == 0)
-        retval = encode_krb5_enc_data(&enc, &encoded);
-    if (retval == 0) {
-        pa = calloc(1, sizeof(krb5_pa_data));
-        if (pa == NULL)
-            retval = ENOMEM;
-    }
-    if (retval == 0) {
-        pa->pa_type = KRB5_PADATA_ENCRYPTED_CHALLENGE;
-        pa->contents = (unsigned char *) encoded->data;
-        pa->length = encoded->length;
-        encoded->data = NULL;
-        *send_pa = pa;
-        pa = NULL;
-    }
-    if (challenge_key)
-        krb5_free_keyblock(context, challenge_key);
-    if (encoded)
-        krb5_free_data(context, encoded);
-    if (plain)
-        krb5_free_data(context, plain);
-    if (enc.ciphertext.data)
-        krb5_free_data_contents(context, &enc.ciphertext);
-    return retval;
+
+    ret = krb5_us_timeofday(context, &ts.patimestamp, &ts.pausec);
+    if (ret)
+        goto cleanup;
+    ret = encode_krb5_pa_enc_ts(&ts, &der_enc_ts);
+    if (ret)
+        goto cleanup;
+    ret = krb5_encrypt_helper(context, challenge_key,
+                              KRB5_KEYUSAGE_ENC_CHALLENGE_KDC, der_enc_ts,
+                              &enc);
+    if (ret)
+        goto cleanup;
+    ret = encode_krb5_enc_data(&enc, &der_enc_data);
+    if (ret)
+        goto cleanup;
+
+    pa = k5alloc(sizeof(*pa), &ret);
+    if (pa == NULL)
+        goto cleanup;
+    pa->pa_type = KRB5_PADATA_ENCRYPTED_CHALLENGE;
+    pa->length = der_enc_data->length;
+    /* Steal the data pointer from der_enc_data. */
+    pa->contents = (unsigned char *)der_enc_data->data;
+    der_enc_data->data = NULL;
+
+    *send_pa = pa;
+
+cleanup:
+    krb5_free_keyblock(context, challenge_key);
+    krb5_free_data(context, der_enc_data);
+    krb5_free_data(context, der_enc_ts);
+    krb5_free_data_contents(context, &enc.ciphertext);
+    return ret;
 }
 
 static krb5_preauthtype ec_types = {

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/kdc_util.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/kdc_util.c Changed

@@ -520,6 +520,100 @@
     return ret;
 }
 
+/*
+ * If a PAC is present in enc_tkt, verify it and place it in *pac_out.  sprinc
+ * is the canonical name of the server principal entry used to decrypt enc_tkt.
+ * server_key is the ticket decryption key.  tgt is the local krbtgt entry for
+ * the ticket server realm, and tgt_key is its first key.
+ */
+krb5_error_code
+get_verified_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                 krb5_const_principal sprinc, krb5_keyblock *server_key,
+                 krb5_db_entry *tgt, krb5_keyblock *tgt_key, krb5_pac *pac_out)
+{
+    krb5_error_code ret;
+    krb5_key_data *kd;
+    krb5_keyblock old_key;
+    krb5_kvno kvno;
+    int tries;
+
+    *pac_out = NULL;
+
+    /* For local or cross-realm TGTs we only check the server signature. */
+    if (krb5_is_tgs_principal(sprinc)) {
+        return krb5_kdc_verify_ticket(context, enc_tkt, sprinc, server_key,
+                                      NULL, pac_out);
+    }
+
+    ret = krb5_kdc_verify_ticket(context, enc_tkt, sprinc, server_key,
+                                 tgt_key, pac_out);
+    if (ret != KRB5KRB_AP_ERR_MODIFIED && ret != KRB5_BAD_ENCTYPE)
+        return ret;
+
+    /* There is no kvno in PAC signatures, so try two previous versions. */
+    kvno = tgt->key_data0.key_data_kvno - 1;
+    for (tries = 2; tries > 0 && kvno > 0; tries--, kvno--) {
+        ret = krb5_dbe_find_enctype(context, tgt, -1, -1, kvno, &kd);
+        if (ret)
+            return KRB5KRB_AP_ERR_MODIFIED;
+        ret = krb5_dbe_decrypt_key_data(context, NULL, kd, &old_key, NULL);
+        if (ret)
+            return ret;
+        ret = krb5_kdc_verify_ticket(context, enc_tkt, sprinc, server_key,
+                                     &old_key, pac_out);
+        krb5_free_keyblock_contents(context, &old_key);
+        if (!ret)
+            return 0;
+    }
+
+    return KRB5KRB_AP_ERR_MODIFIED;
+}
+
+/*
+ * Fetch the client info from pac and parse it into a principal name, expecting
+ * a realm in the string.  Set *authtime_out to the client info authtime if it
+ * is not null.
+ */
+krb5_error_code
+get_pac_princ_with_realm(krb5_context context, krb5_pac pac,
+                         krb5_principal *princ_out,
+                         krb5_timestamp *authtime_out)
+{
+    krb5_error_code ret;
+    int n_atsigns, flags = KRB5_PRINCIPAL_PARSE_REQUIRE_REALM;
+    char *client_str = NULL;
+    const char *p;
+
+    *princ_out = NULL;
+
+    ret = krb5_pac_get_client_info(context, pac, authtime_out, &client_str);
+    if (ret)
+        return ret;
+
+    n_atsigns = 0;
+    for (p = client_str; *p != '\0'; p++) {
+        if (*p == '@')
+            n_atsigns++;
+    }
+
+    if (n_atsigns == 2) {
+        flags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
+    } else if (n_atsigns != 1) {
+        ret = KRB5_PARSE_MALFORMED;
+        goto cleanup;
+    }
+
+    ret = krb5_parse_name_flags(context, client_str, flags, princ_out);
+    if (ret)
+        return ret;
+
+    (*princ_out)->type = KRB5_NT_MS_PRINCIPAL;
+
+cleanup:
+    free(client_str);
+    return 0;
+}
+
 /* This probably wants to be updated if you support last_req stuff */
 
 static krb5_last_req_entry nolrentry = { KV5M_LAST_REQ_ENTRY, KRB5_LRQ_NONE, 0 };
@@ -1387,8 +1481,7 @@
     krb5_db_entry *self;
     krb5_boolean is_self = FALSE;
 
-    ret = krb5_db_get_principal(context, princ,
-                                KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY, &self);
+    ret = krb5_db_get_principal(context, princ, KRB5_KDB_FLAG_CLIENT, &self);
     if (!ret) {
         is_self = krb5_principal_compare(context, entry->princ, self->princ);
         krb5_db_free_principal(context, self);
@@ -1451,7 +1544,7 @@
         if (id->subject_cert.length != 0) {
             code = krb5_db_get_s4u_x509_principal(kdc_context,
                                                   &id->subject_cert, id->user,
-                                                  KRB5_KDB_FLAG_INCLUDE_PAC,
+                                                  KRB5_KDB_FLAG_CLIENT,
                                                   &princ);
             if (code == 0 && id->user->length == 0) {
                 krb5_free_principal(kdc_context, id->user);
@@ -1460,7 +1553,7 @@
             }
         } else {
             code = krb5_db_get_principal(kdc_context, id->user,
-                                         KRB5_KDB_FLAG_INCLUDE_PAC, &princ);
+                                         KRB5_KDB_FLAG_CLIENT, &princ);
         }
         if (code == KRB5_KDB_NOENTRY) {
             *status = "UNKNOWN_S4U2SELF_PRINCIPAL";
@@ -1481,6 +1574,29 @@
     return 0;
 }
 
+/* Clear the forwardable flag in tkt if server cannot obtain forwardable
+ * S4U2Self tickets according to MS-SFU 3.2.5.1.2. */
+krb5_error_code
+s4u2self_forwardable(krb5_context context, krb5_db_entry *server,
+                     krb5_enc_tkt_part *tkt)
+{
+    krb5_error_code ret;
+
+    /* Allow the forwardable flag if server has ok-to-auth-as-delegate set. */
+    if (server->attributes & KRB5_KDB_OK_TO_AUTH_AS_DELEGATE)
+        return 0;
+
+    /* Deny the forwardable flag if server has any authorized delegation
+     * targets for traditional S4U2Proxy. */
+    ret = krb5_db_check_allowed_to_delegate(context, NULL, server, NULL);
+    if (!ret)
+        tkt->flags &= ~TKT_FLG_FORWARDABLE;
+
+    if (ret == KRB5KDC_ERR_BADOPTION || ret == KRB5_PLUGIN_OP_NOTSUPP)
+        return 0;
+    return ret;
+}
+
 /*
  * Determine if an S4U2Proxy request is authorized.  Set **stkt_ad_info to the
  * KDB authdata handle for the second ticket if the KDB module supplied one.
@@ -1489,97 +1605,80 @@
  */
 krb5_error_code
 kdc_process_s4u2proxy_req(kdc_realm_t *kdc_active_realm, unsigned int flags,
-                          krb5_kdc_req *request,
-                          const krb5_enc_tkt_part *t2enc,
-                          krb5_db_entry *krbtgt, krb5_keyblock *krbtgt_key,
+                          krb5_kdc_req *request, krb5_pac header_pac,
+                          const krb5_enc_tkt_part *t2enc, krb5_pac t2_pac,
                           const krb5_db_entry *server,
                           krb5_keyblock *server_key,
                           krb5_const_principal server_princ,
                           const krb5_db_entry *proxy,
-                          krb5_const_principal proxy_princ,
-                          void *ad_info, void **stkt_ad_info,
-                          krb5_principal *stkt_authdata_client,
+                          krb5_principal *stkt_pac_client,
                           const char **status)
 {
     krb5_error_code errcode;
     krb5_boolean support_rbcd;
-    krb5_principal client_princ = t2enc->client;
+    krb5_principal client_princ = t2enc->client, t2_pac_princ = NULL;
+
+    *stkt_pac_client = NULL;
 
     /* Check if the client supports resource-based constrained delegation. */
     errcode = kdc_get_pa_pac_rbcd(kdc_context, request->padata, &support_rbcd);
     if (errcode)
         return errcode;
 
-    errcode = krb5_db_get_authdata_info(kdc_context, flags,
-                                        t2enc->authorization_data,
-                                        t2enc->client, proxy_princ, server_key,
-                                        krbtgt_key, krbtgt,
-                                        t2enc->times.authtime, stkt_ad_info,
-                                        stkt_authdata_client);
-    if (errcode != 0 && errcode != KRB5_PLUGIN_OP_NOTSUPP) {
-        *status = "NOT_ALLOWED_TO_DELEGATE";
-        return errcode;
-    }
-
-    /* For RBCD we require that both client and impersonator's authdata have
-     * been verified. */
-    if (errcode != 0 || ad_info == NULL)
-        support_rbcd = FALSE;
-
-    /* For an RBCD final request, the KDB module must be able to recover the
-     * reply ticket client name from the evidence ticket authorization data. */
-    if (isflagset(flags, KRB5_KDB_FLAG_CROSS_REALM)) {
-        if (*stkt_authdata_client == NULL ||
-            (*stkt_authdata_client)->realm.length == 0) {
-            *status = "UNSUPPORTED_S4U2PROXY_REQUEST";
-            return KRB5KDC_ERR_BADOPTION;
+    /* For an RBCD final request, recover the reply ticket client name from
+     * the evidence ticket PAC. */
+    if (flags & KRB5_KDB_FLAG_CROSS_REALM) {
+        if (get_pac_princ_with_realm(kdc_context, t2_pac, &t2_pac_princ,
+                                     NULL) != 0) {
+            *status = "RBCD_PAC_PRINC";
+            errcode = KRB5KDC_ERR_BADOPTION;
+            goto done;
         }
-
-        client_princ = *stkt_authdata_client;
+        client_princ = t2_pac_princ;
     }
 
     /* If both are in the same realm, try allowed_to_delegate first. */
-    if (krb5_realm_compare(kdc_context, server->princ, proxy_princ)) {
+    if (krb5_realm_compare(kdc_context, server->princ, request->server)) {
 
         errcode = krb5_db_check_allowed_to_delegate(kdc_context, client_princ,
-                                                    server, proxy_princ);
-        if (errcode != 0 && errcode != KRB5KDC_ERR_POLICY &&
+                                                    server, request->server);
+        if (errcode != KRB5KDC_ERR_BADOPTION &&
             errcode != KRB5_PLUGIN_OP_NOTSUPP)
-            return errcode;
-
-        if (errcode == 0) {
-
-            /*
-             * In legacy constrained-delegation, the evidence ticket must be
-             * forwardable.  This check deliberately causes an error response
-             * even if the delegation is also authorized by resource-based
-             * constrained delegation (which does not require a forwardable
-             * evidence ticket).  Windows KDCs behave the same way.
-             */
-            if (!isflagset(t2enc->flags, TKT_FLG_FORWARDABLE)) {
-                *status = "EVIDENCE_TKT_NOT_FORWARDABLE";
-                return KRB5KDC_ERR_BADOPTION;
-            }
+            goto done;
 
-            return 0;
-        }
         /* Fall back to resource-based constrained-delegation. */
     }
 
     if (!support_rbcd) {
         *status = "UNSUPPORTED_S4U2PROXY_REQUEST";
-        return KRB5KDC_ERR_BADOPTION;
+        errcode = KRB5KDC_ERR_BADOPTION;
+        goto done;
     }
 
     /* If we are issuing a referral, the KDC in the resource realm will check
      * if delegation is allowed. */
-    if (isflagset(flags, KRB5_KDB_FLAG_ISSUING_REFERRAL))
-        return 0;
+    if (isflagset(flags, KRB5_KDB_FLAG_ISSUING_REFERRAL)) {
+        errcode = 0;
+        goto done;
+    }
 
     errcode = krb5_db_allowed_to_delegate_from(kdc_context, client_princ,
-                                               server_princ, ad_info, proxy);
-    if (errcode)
+                                               server_princ, header_pac,
+                                               proxy);
+    if (errcode == KRB5_PLUGIN_OP_NOTSUPP) {
+        *status = "UNSUPPORTED_S4U2PROXY_REQUEST";
+        errcode = KRB5KDC_ERR_BADOPTION;
+        goto done;
+    } else if (errcode) {
         *status = "NOT_ALLOWED_TO_DELEGATE";
+        goto done;
+    }
+
+    *stkt_pac_client = t2_pac_princ;
+    t2_pac_princ = NULL;
+
+done:
+    krb5_free_principal(kdc_context, t2_pac_princ);
     return errcode;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/kdc_util.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/kdc_util.h Changed

@@ -86,7 +86,8 @@
 int
 validate_tgs_request(kdc_realm_t *kdc_active_realm,
                      krb5_kdc_req *request, krb5_db_entry *server,
-                     krb5_ticket *ticket, const krb5_ticket *stkt,
+                     krb5_ticket *ticket, krb5_pac pac,
+                     const krb5_ticket *stkt, krb5_pac stkt_pac,
                      krb5_db_entry *stkt_server, krb5_timestamp kdc_time,
                      krb5_pa_s4u_x509_user *s4u_x509_user,
                      krb5_db_entry *s4u2self_client,
@@ -225,7 +226,7 @@
                     krb5_data ***indicators_out);
 
 krb5_error_code
-handle_authdata (krb5_context context,
+handle_authdata (kdc_realm_t *kdc_active_realm,
                  unsigned int flags,
                  krb5_db_entry *client,
                  krb5_db_entry *server,
@@ -235,10 +236,11 @@
                  krb5_keyblock *client_key,
                  krb5_keyblock *server_key,
                  krb5_keyblock *header_key,
+                 krb5_keyblock *replaced_reply_key,
                  krb5_data *req_pkt,
                  krb5_kdc_req *request,
                  krb5_const_principal altcprinc,
-                 void *ad_info,
+                 krb5_pac subject_pac,
                  krb5_enc_tkt_part *enc_tkt_request,
                  krb5_data ***auth_indicators,
                  krb5_enc_tkt_part *enc_tkt_reply);
@@ -253,6 +255,17 @@
 /* kdc_util.c */
 void reset_for_hangup(void *);
 
+krb5_error_code
+get_verified_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                 krb5_const_principal sprinc, krb5_keyblock *server_key,
+                 krb5_db_entry *tgt, krb5_keyblock *tgt_key,
+                 krb5_pac *pac_out);
+
+krb5_error_code
+get_pac_princ_with_realm(krb5_context context, krb5_pac pac,
+                         krb5_principal *princ_out,
+                         krb5_timestamp *authtime_out);
+
 krb5_boolean
 include_pac_p(krb5_context context, krb5_kdc_req *request);
 
@@ -275,6 +288,10 @@
                           const char **status);
 
 krb5_error_code
+s4u2self_forwardable(krb5_context context, krb5_db_entry *server,
+                     krb5_enc_tkt_part *enc_tkt);
+
+krb5_error_code
 kdc_make_s4u2self_rep (krb5_context context,
                        krb5_keyblock *tgs_subkey,
                        krb5_keyblock *tgs_session,
@@ -283,21 +300,15 @@
                        krb5_enc_kdc_rep_part *reply_encpart);
 
 krb5_error_code
-kdc_process_s4u2proxy_req (kdc_realm_t *kdc_active_realm,
-                           unsigned int flags,
-                           krb5_kdc_req *request,
-                           const krb5_enc_tkt_part *t2enc,
-                           krb5_db_entry *krbtgt,
-                           krb5_keyblock *krbtgt_key,
-                           const krb5_db_entry *server,
-                           krb5_keyblock *server_key,
-                           krb5_const_principal server_princ,
-                           const krb5_db_entry *proxy,
-                           krb5_const_principal proxy_princ,
-                           void *ad_info,
-                           void **stkt_ad_info,
-                           krb5_principal *stkt_ad_client,
-                           const char **status);
+kdc_process_s4u2proxy_req(kdc_realm_t *kdc_active_realm, unsigned int flags,
+                          krb5_kdc_req *request, krb5_pac header_pac,
+                          const krb5_enc_tkt_part *t2enc, krb5_pac t2_pac,
+                          const krb5_db_entry *server,
+                          krb5_keyblock *server_key,
+                          krb5_const_principal server_princ,
+                          const krb5_db_entry *proxy,
+                          krb5_principal *stkt_ad_client,
+                          const char **status);
 
 krb5_error_code
 kdc_check_transited_list (kdc_realm_t *kdc_active_realm,
@@ -437,6 +448,7 @@
     verto_ctx *vctx;
     krb5_data ***auth_indicators;
     krb5_boolean send_freshness_token;
+    krb5_boolean replaced_reply_key;
 };
 
 #define isflagset(flagfield, flag) (flagfield & (flag))
@@ -546,4 +558,22 @@
     return (entry->n_key_data == 0) ? 0 : entry->key_data0.key_data_kvno;
 }
 
+/* MS-PAC section 2.9 */
+struct pac_s4u_delegation_info {
+    char *proxy_target;
+    uint32_t transited_services_length;
+    char **transited_services;
+};
+
+/* Leaves room for one additional service. */
+krb5_error_code
+ndr_dec_delegation_info(krb5_data *data,
+                        struct pac_s4u_delegation_info **res);
+
+krb5_error_code
+ndr_enc_delegation_info(struct pac_s4u_delegation_info *in,
+                        krb5_data *out);
+
+void ndr_free_delegation_info(struct pac_s4u_delegation_info *in);
+
 #endif /* __KRB5_KDC_UTIL__ */

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/main.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/main.c Changed

@@ -62,7 +62,6 @@
 static int workers = 0;
 static int time_offset = 0;
 static const char *pid_file = NULL;
-static int rkey_init_done = 0;
 static volatile int signal_received = 0;
 static volatile int sighup_received = 0;
 
@@ -334,6 +333,11 @@
     free(svalue);
     svalue = NULL;
 
+    hierarchy2 = KRB5_CONF_DISABLE_PAC;
+    if (krb5_aprof_get_boolean(aprof, hierarchy, TRUE,
+                               &rdp->realm_disable_pac))
+        rdp->realm_disable_pac = FALSE;
+
     /*
      * We've got our parameters, now go and setup our realm context.
      */
@@ -409,22 +413,6 @@
         goto whoops;
     }
 
-    if (!rkey_init_done) {
-        krb5_data seed;
-        /*
-         * If all that worked, then initialize the random key
-         * generators.
-         */
-
-        seed.length = rdp->realm_mkey.length;
-        seed.data = (char *)rdp->realm_mkey.contents;
-
-        if ((kret = krb5_c_random_add_entropy(rdp->realm_context,
-                                              KRB5_C_RANDSOURCE_TRUSTEDPARTY, &seed)))
-            goto whoops;
-
-        rkey_init_done = 1;
-    }
 whoops:
     /*
      * If we choked, then clean up any dirt we may have dropped on the floor.
@@ -436,28 +424,16 @@
     return(kret);
 }
 
-static krb5_sigtype
+static void
 on_monitor_signal(int signo)
 {
     signal_received = signo;
-
-#ifdef POSIX_SIGTYPE
-    return;
-#else
-    return(0);
-#endif
 }
 
-static krb5_sigtype
+static void
 on_monitor_sighup(int signo)
 {
     sighup_received = 1;
-
-#ifdef POSIX_SIGTYPE
-    return;
-#else
-    return(0);
-#endif
 }
 
 /*
@@ -1065,7 +1041,6 @@
     kau_kdc_start(kcontext, TRUE);
 
     verto_run(ctx);
-    loop_free(ctx);
     kau_kdc_stop(kcontext, TRUE);
     krb5_klog_syslog(LOG_INFO, _("shutting down"));
     unload_preauth_plugins(kcontext);
@@ -1079,6 +1054,7 @@
 #ifndef NOCACHE
     kdc_free_lookaside(kcontext);
 #endif
+    loop_free(ctx);
     krb5_free_context(kcontext);
     return errout;
 }

_service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/ndr.c Added

@@ -0,0 +1,332 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* kdc/ndr.c - NDR encoding and decoding functions */
+/*
+ * Copyright (C) 2021 by Red Hat, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "k5-int.h"
+#include "k5-input.h"
+#include "k5-buf.h"
+#include "k5-utf8.h"
+#include "kdc_util.h"
+
+struct encoded_wchars {
+    uint16_t bytes_len;
+    uint16_t num_wchars;
+    uint8_t *encoded;
+};
+
+/*
+ * MS-DTYP 2.3.10:
+ *
+ * typedef struct _RPC_UNICODE_STRING {
+ *     unsigned short Length;
+ *     unsigned short MaximumLength;
+ *     size_is(MaximumLength/2), length_is(Length/2) WCHAR* Buffer;
+ * } RPC_UNICODE_STRING, *PRPC_UNICODE_STRING;
+ *
+ * Note that Buffer is not a String - there's no termination.
+ *
+ * We don't actually decode Length and MaximumLength here - this is a
+ * conformant-varying array, which means that (per DCE-1.1-RPC 14.3.7.2) where
+ * those actually appear in the serialized data is variable depending on
+ * whether the string is at top level of the struct or not.  (This also
+ * affects where the pointer identifier appears.)
+ *
+ * See MS-RPCE 4.7 for what an RPC_UNICODE_STRING looks like when not at
+ * top-level.
+ */
+static krb5_error_code
+dec_wchar_pointer(struct k5input *in, char **out)
+{
+    const uint8_t *bytes;
+    uint32_t actual_count;
+
+    /* Maximum count. */
+    (void)k5_input_get_uint32_le(in);
+    /* Offset - all zeroes, "should" not be checked. */
+    (void)k5_input_get_uint32_le(in);
+
+    actual_count = k5_input_get_uint32_le(in);
+    if (actual_count > UINT32_MAX / 2)
+        return ERANGE;
+
+    bytes = k5_input_get_bytes(in, actual_count * 2);
+    if (bytes == NULL || k5_utf16le_to_utf8(bytes, actual_count * 2, out) != 0)
+        return EINVAL;
+
+    /* Always align on 4. */
+    if (actual_count % 2 == 1)
+        (void)k5_input_get_uint16_le(in);
+
+    return 0;
+}
+
+static krb5_error_code
+enc_wchar_pointer(const char *utf8, struct encoded_wchars *encoded_out)
+{
+    krb5_error_code ret;
+    struct k5buf b;
+    size_t utf16len, num_wchars;
+    uint8_t *utf16;
+
+    k5_buf_init_dynamic(&b);
+
+    ret = k5_utf8_to_utf16le(utf8, &utf16, &utf16len);
+    if (ret)
+        return ret;
+
+    num_wchars = utf16len / 2;
+
+    k5_buf_add_uint32_le(&b, num_wchars + 1);
+    k5_buf_add_uint32_le(&b, 0);
+    k5_buf_add_uint32_le(&b, num_wchars);
+    k5_buf_add_len(&b, utf16, utf16len);
+
+    free(utf16);
+
+    if (num_wchars % 2 == 1)
+        k5_buf_add_uint16_le(&b, 0);
+
+    ret = k5_buf_status(&b);
+    if (ret)
+        return ret;
+
+    encoded_out->bytes_len = b.len;
+    encoded_out->num_wchars = num_wchars;
+    encoded_out->encoded = b.data;
+    return 0;
+}
+
+/*
+ * Decode a delegation info structure, leaving room to add an additional
+ * service.
+ *
+ * MS-PAC 2.9:
+ *
+ * typedef struct _S4U_DELEGATION_INFO {
+ *     RPC_UNICODE_STRING S4U2proxyTarget;
+ *     ULONG TransitedListSize;
+ *     size_is(TransitedListSize) PRPC_UNICODE_STRING S4UTransitedServices;
+ * } S4U_DELEGATION_INFO, *PS4U_DELEGATION_INFO;
+ */
+krb5_error_code
+ndr_dec_delegation_info(krb5_data *data, struct pac_s4u_delegation_info **out)
+{
+    krb5_error_code ret;
+    struct pac_s4u_delegation_info *di = NULL;
+    struct k5input in;
+    uint32_t i, object_buffer_length, nservices;
+    uint8_t version, endianness, common_header_length;
+
+    *out = NULL;
+
+    di = k5alloc(sizeof(*di), &ret);
+    if (di == NULL)
+        return ret;
+
+    k5_input_init(&in, data->data, data->length);
+
+    /* Common Type Header - MS-RPCE 2.2.6.1 */
+    version = k5_input_get_byte(&in);
+    endianness = k5_input_get_byte(&in);
+    common_header_length = k5_input_get_uint16_le(&in);
+    (void)k5_input_get_uint32_le(&in); /* Filler - 0xcccccccc. */
+    if (version != 1 || endianness != 0x10 || common_header_length != 8) {
+        ret = EINVAL;
+        goto error;
+    }
+
+    /* Private Header for Constructed Type - MS-RPCE 2.2.6.2 */
+    object_buffer_length = k5_input_get_uint32_le(&in);
+    if (data->length < 16 || object_buffer_length != data->length - 16) {
+        ret = EINVAL;
+        goto error;
+    }
+
+    (void)k5_input_get_uint32_le(&in); /* Filler - 0. */
+
+    /* This code doesn't handle re-used pointers, which could come into play in
+     * the unlikely case of a delegation loop. */
+
+    /* Pointer.  Microsoft always starts at 00 00 02 00 */
+    (void)k5_input_get_uint32_le(&in);
+    /* Length of proxy target - 2 */
+    (void)k5_input_get_uint16_le(&in);
+    /* Length of proxy target */
+    (void)k5_input_get_uint16_le(&in);
+    /* Another pointer - 04 00 02 00.  Microsoft increments by 4 (le). */
+    (void)k5_input_get_uint32_le(&in);
+
+    /* Transited services length - header version. */
+    (void)k5_input_get_uint32_le(&in);
+
+    /* More pointer: 08 00 02 00 */
+    (void)k5_input_get_uint32_le(&in);
+
+    ret = dec_wchar_pointer(&in, &di->proxy_target);
+    if (ret)
+        goto error;
+    nservices = k5_input_get_uint32_le(&in);
+
+    /* Here, we have encoded 2 bytes of length, 2 bytes of (length + 2), and 4
+     * bytes of pointer, for each element (deferred pointers). */
+    if (nservices > data->length / 8) {
+        ret = ERANGE;
+        goto error;
+    }
+    (void)k5_input_get_bytes(&in, 8 * nservices);
+
+    /* Since we're likely to add another entry, leave a blank at the end. */
+    di->transited_services = k5calloc(nservices + 1, sizeof(char *), &ret);
+    if (di->transited_services == NULL)
+        goto error;
+
+    for (i = 0; i < nservices; i++) {
+        ret = dec_wchar_pointer(&in, &di->transited_servicesi);
+        if (ret)
+            goto error;
+        di->transited_services_length++;
+    }
+
+    ret = in.status;
+    if (ret)
+        goto error;
+
+    *out = di;
+    return 0;
+
+error:
+    ndr_free_delegation_info(di);
+    return ret;
+}
+
+/* Empirically, Microsoft starts pointers at 00 00 02 00, and if treated little
+ * endian, they increase by 4. */
+static inline void
+write_ptr(struct k5buf *buf, uint32_t *pointer)
+{
+    if (*pointer == 0)
+        *pointer = 0x00020000;
+    k5_buf_add_uint32_le(buf, *pointer);
+    *pointer += 4;
+}
+
+krb5_error_code
+ndr_enc_delegation_info(struct pac_s4u_delegation_info *in, krb5_data *out)
+{
+    krb5_error_code ret;
+    size_t i;
+    struct k5buf b;
+    struct encoded_wchars pt_encoded = { 0 }, *tss_encoded = NULL;
+    uint32_t pointer = 0;
+
+    /* Encode ahead of time since we need the lengths. */
+    ret = enc_wchar_pointer(in->proxy_target, &pt_encoded);
+    if (ret)
+        goto cleanup;
+
+    tss_encoded = k5calloc(in->transited_services_length, sizeof(*tss_encoded),
+                           &ret);
+    if (tss_encoded == NULL)
+        goto cleanup;
+
+    k5_buf_init_dynamic(&b);
+
+    /* Common Type Header - MS-RPCE 2.2.6.1 */
+    k5_buf_add_len(&b, "\x01\x10\x08\x00", 4);
+    k5_buf_add_uint32_le(&b, 0xcccccccc);
+
+    /* Private Header for Constructed Type - MS-RPCE 2.2.6.2 */
+    k5_buf_add_uint32_le(&b, 0); /* Skip over where payload length goes. */
+    k5_buf_add_uint32_le(&b, 0); /* Filler - all zeroes. */
+
+    write_ptr(&b, &pointer);
+    k5_buf_add_uint16_le(&b, 2 * pt_encoded.num_wchars);
+    k5_buf_add_uint16_le(&b, 2 * (pt_encoded.num_wchars + 1));
+    write_ptr(&b, &pointer);
+
+    k5_buf_add_uint32_le(&b, in->transited_services_length);
+    write_ptr(&b, &pointer);
+
+    k5_buf_add_len(&b, pt_encoded.encoded, pt_encoded.bytes_len);
+
+    k5_buf_add_uint32_le(&b, in->transited_services_length);
+
+    /* Deferred pointers. */
+    for (i = 0; i < in->transited_services_length; i++) {
+        ret = enc_wchar_pointer(in->transited_servicesi, &tss_encodedi);
+        if (ret)
+            goto cleanup;
+
+        k5_buf_add_uint16_le(&b, 2 * tss_encodedi.num_wchars);
+        k5_buf_add_uint16_le(&b, 2 * (tss_encodedi.num_wchars + 1));
+        write_ptr(&b, &pointer);
+    }
+
+    for (i = 0; i < in->transited_services_length; i++)
+        k5_buf_add_len(&b, tss_encodedi.encoded, tss_encodedi.bytes_len);
+
+    /* Now, pad to 8 bytes.  RPC_UNICODE_STRING is aligned on 4 bytes. */
+    if (b.len % 8 != 0)
+        k5_buf_add_uint32_le(&b, 0);
+
+    /* Record the payload length where we skipped over it previously. */
+    if (b.data != NULL)
+        store_32_le(b.len - 0x10, ((uint8_t *)b.data) + 8);
+
+    ret = k5_buf_status(&b);
+    if (ret)
+        goto cleanup;
+
+    *out = make_data(b.data, b.len);
+    b.data = NULL;
+
+cleanup:
+    free(b.data);
+    free(pt_encoded.encoded);
+    for (i = 0; tss_encoded != NULL && i < in->transited_services_length; i++)
+        free(tss_encodedi.encoded);
+    free(tss_encoded);
+    return ret;
+}
+
+void
+ndr_free_delegation_info(struct pac_s4u_delegation_info *di)
+{
+    uint32_t i;
+
+    if (di == NULL)
+        return;
+    free(di->proxy_target);
+    for (i = 0; i < di->transited_services_length; i++)
+        free(di->transited_servicesi);
+    free(di->transited_services);
+    free(di);
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/realm_data.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/realm_data.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/t_bigreply.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/t_bigreply.py Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/t_ndr.c Added

@@ -0,0 +1,187 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* kdc/t_ndr.c - tests for ndr.c */
+/*
+ * Copyright (C) 2021 by Red Hat, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Unit tests for the NDR marshalling/unmarshalling in ndr.c
+ */
+
+#include "k5-int.h"
+#include "kdc_util.h"
+
+/*
+ * Three S4U_DELEGATION_INFO buffers decoded from communication with AD 2019:
+ *
+ * - svc1/adserver.ad.test@AD.TEST to svc2/adserver.ad.test@AD.TEST
+ * - svc1/adserver.ad.test@AD.TEST to longsvc/adserver.ad.test@AD.TEST
+ * - svc1/adserver.ad.test@AD.TEST to svc2/adserver.ad.test@AD.TEST then
+ *                                 to longsvc/adserver.ad.test@AD.TEST
+ */
+static uint8_t s4u_di_short = {
+    0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0xa0, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x2a, 0x00, 0x2c, 0x00,
+    0x04, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00,
+    0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00,
+    0x73, 0x00, 0x76, 0x00, 0x63, 0x00, 0x32, 0x00, 0x2f, 0x00, 0x61, 0x00,
+    0x64, 0x00, 0x73, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00,
+    0x72, 0x00, 0x2e, 0x00, 0x61, 0x00, 0x64, 0x00, 0x2e, 0x00, 0x74, 0x00,
+    0x65, 0x00, 0x73, 0x00, 0x74, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x3a, 0x00, 0x3c, 0x00, 0x0c, 0x00, 0x02, 0x00, 0x1e, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x00, 0x73, 0x00, 0x76, 0x00,
+    0x63, 0x00, 0x31, 0x00, 0x2f, 0x00, 0x61, 0x00, 0x64, 0x00, 0x73, 0x00,
+    0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x2e, 0x00,
+    0x61, 0x00, 0x64, 0x00, 0x2e, 0x00, 0x74, 0x00, 0x65, 0x00, 0x73, 0x00,
+    0x74, 0x00, 0x40, 0x00, 0x41, 0x00, 0x44, 0x00, 0x2e, 0x00, 0x54, 0x00,
+    0x45, 0x00, 0x53, 0x00, 0x54, 0x00, 0x00, 0x00,
+};
+
+static uint8_t s4u_di_long = {
+    0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0xa8, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x30, 0x00, 0x32, 0x00,
+    0x04, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00,
+    0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
+    0x6c, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x67, 0x00, 0x73, 0x00, 0x76, 0x00,
+    0x63, 0x00, 0x2f, 0x00, 0x61, 0x00, 0x64, 0x00, 0x73, 0x00, 0x65, 0x00,
+    0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x2e, 0x00, 0x61, 0x00,
+    0x64, 0x00, 0x2e, 0x00, 0x74, 0x00, 0x65, 0x00, 0x73, 0x00, 0x74, 0x00,
+    0x01, 0x00, 0x00, 0x00, 0x3a, 0x00, 0x3c, 0x00, 0x0c, 0x00, 0x02, 0x00,
+    0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x00,
+    0x73, 0x00, 0x76, 0x00, 0x63, 0x00, 0x31, 0x00, 0x2f, 0x00, 0x61, 0x00,
+    0x64, 0x00, 0x73, 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00,
+    0x72, 0x00, 0x2e, 0x00, 0x61, 0x00, 0x64, 0x00, 0x2e, 0x00, 0x74, 0x00,
+    0x65, 0x00, 0x73, 0x00, 0x74, 0x00, 0x40, 0x00, 0x41, 0x00, 0x44, 0x00,
+    0x2e, 0x00, 0x54, 0x00, 0x45, 0x00, 0x53, 0x00, 0x54, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00,
+};
+
+static uint8_t s4u_di_double = {
+    0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0xf8, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x30, 0x00, 0x32, 0x00,
+    0x04, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00,
+    0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
+    0x6c, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x67, 0x00, 0x73, 0x00, 0x76, 0x00,
+    0x63, 0x00, 0x2f, 0x00, 0x61, 0x00, 0x64, 0x00, 0x73, 0x00, 0x65, 0x00,
+    0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x2e, 0x00, 0x61, 0x00,
+    0x64, 0x00, 0x2e, 0x00, 0x74, 0x00, 0x65, 0x00, 0x73, 0x00, 0x74, 0x00,
+    0x02, 0x00, 0x00, 0x00, 0x3a, 0x00, 0x3c, 0x00, 0x0c, 0x00, 0x02, 0x00,
+    0x3a, 0x00, 0x3c, 0x00, 0x10, 0x00, 0x02, 0x00, 0x1e, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x00, 0x73, 0x00, 0x76, 0x00,
+    0x63, 0x00, 0x31, 0x00, 0x2f, 0x00, 0x61, 0x00, 0x64, 0x00, 0x73, 0x00,
+    0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x2e, 0x00,
+    0x61, 0x00, 0x64, 0x00, 0x2e, 0x00, 0x74, 0x00, 0x65, 0x00, 0x73, 0x00,
+    0x74, 0x00, 0x40, 0x00, 0x41, 0x00, 0x44, 0x00, 0x2e, 0x00, 0x54, 0x00,
+    0x45, 0x00, 0x53, 0x00, 0x54, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x00, 0x73, 0x00, 0x76, 0x00,
+    0x63, 0x00, 0x32, 0x00, 0x2f, 0x00, 0x61, 0x00, 0x64, 0x00, 0x73, 0x00,
+    0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x2e, 0x00,
+    0x61, 0x00, 0x64, 0x00, 0x2e, 0x00, 0x74, 0x00, 0x65, 0x00, 0x73, 0x00,
+    0x74, 0x00, 0x40, 0x00, 0x41, 0x00, 0x44, 0x00, 0x2e, 0x00, 0x54, 0x00,
+    0x45, 0x00, 0x53, 0x00, 0x54, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+static uint8_t fuzz1 = {
+    0x01, 0x10, 0x08, 0x20, 0x20, 0x20, 0x20, 0x20, 0x24, 0x00, 0x00, 0x00,
+    0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+    0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0xff, 0xff, 0xff,
+    0xff, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x00, 0x00, 0x00,
+    0x20, 0x20, 0x20, 0x20
+};
+
+static uint8_t fuzz2 = {
+    0x01, 0x10, 0x08, 0x00, 0x00, 0xff, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x1e, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x16, 0x00, 0x00,
+    0x1e, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x1e
+};
+
+static void
+test_dec_enc(uint8_t *blob, size_t len, char *name, int fail)
+{
+    krb5_data data_in, data_out;
+    struct pac_s4u_delegation_info *di = NULL;
+    krb5_error_code ret;
+    int eq;
+    size_t i;
+
+    printf("Checking blob %s...\n", name);
+
+    data_in = make_data(blob, len);
+    ret = ndr_dec_delegation_info(&data_in, &di);
+    if (fail) {
+        if (!ret) {
+            printf("%s: unexpected decode success\n", name);
+            exit(1);
+        }
+        printf("%s: failed as expected\n", name);
+        return;
+    } else if (ret) {
+        printf("%s: bad decode (%d): %s\n", name, ret, strerror(ret));
+        exit(1);
+    }
+
+    printf("%s, %d\n", di->proxy_target, di->transited_services_length);
+    for (i = 0; i < di->transited_services_length; i++)
+        printf("    %s\n", di->transited_servicesi);
+
+    ret = ndr_enc_delegation_info(di, &data_out);
+    ndr_free_delegation_info(di);
+    if (ret) {
+        printf("%s: bad encode (%d): %s\n", name, ret, strerror(ret));
+        exit(1);
+    }
+
+    eq = data_eq(data_in, data_out);
+    krb5_free_data_contents(NULL, &data_out);
+    if (!eq) {
+        printf("%s: re-encoding did not produce the same result\n", name);
+        exit(1);
+    }
+
+    printf("%s matched\n\n", name);
+}
+
+#define RUN_TEST(blob) test_dec_enc(blob, sizeof(blob), #blob, 0)
+#define RUN_TEST_FAIL(blob) test_dec_enc(blob, sizeof(blob), #blob, 1)
+
+int
+main()
+{
+    printf("Running NDR tests...\n");
+
+    RUN_TEST(s4u_di_short);
+    RUN_TEST(s4u_di_long);
+    RUN_TEST(s4u_di_double);
+    RUN_TEST_FAIL(fuzz1);
+    RUN_TEST_FAIL(fuzz2);
+
+    printf("Passed NDR tests\n");
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kdc/tgs_policy.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kdc/tgs_policy.c Changed

@@ -260,7 +260,7 @@
 
 static int
 check_tgs_s4u2self(kdc_realm_t *kdc_active_realm, krb5_kdc_req *req,
-                   krb5_db_entry *server, krb5_ticket *tkt,
+                   krb5_db_entry *server, krb5_ticket *tkt, krb5_pac pac,
                    krb5_timestamp kdc_time,
                    krb5_pa_s4u_x509_user *s4u_x509_user, krb5_db_entry *client,
                    krb5_boolean is_crossrealm, krb5_boolean is_referral,
@@ -272,7 +272,7 @@
     if (!is_referral &&
         !is_client_db_alias(kdc_context, server, tkt->enc_part2->client)) {
         *status = "INVALID_S4U2SELF_REQUEST_SERVER_MISMATCH";
-        return KDC_ERR_C_PRINCIPAL_UNKNOWN; /* match Windows error */
+        return KRB_AP_ERR_BADMATCH;
     }
 
     /* S4U2Self requests must use options valid for AS requests. */
@@ -325,28 +325,117 @@
         return KDC_ERR_POLICY; /* match Windows error */
     }
 
+    /* The header ticket PAC must be present. */
+    if (pac == NULL) {
+        *status = "S4U2SELF_NO_PAC";
+        return KDC_ERR_TGT_REVOKED;
+    }
+
     if (client != NULL) {
+        /* The header ticket PAC must be for the impersonator. */
+        if (krb5_pac_verify(kdc_context, pac, tkt->enc_part2->times.authtime,
+                            tkt->enc_part2->client, NULL, NULL) != 0) {
+            *status = "S4U2SELF_LOCAL_PAC_CLIENT";
+            return KDC_ERR_BADOPTION;
+        }
+
         /* Validate the client policy.  Use an empty server principal to bypass
          * server policy checks. */
         return validate_as_request(kdc_active_realm, req, client,
                                    &empty_server, kdc_time, status, e_data);
+    } else {
+        /* The header ticket PAC must be for the subject, with realm. */
+        if (krb5_pac_verify_ext(kdc_context, pac,
+                                tkt->enc_part2->times.authtime,
+                                s4u_x509_user->user_id.user, NULL, NULL,
+                                TRUE) != 0) {
+            *status = "S4U2SELF_FOREIGN_PAC_CLIENT";
+            return KDC_ERR_BADOPTION;
+        }
     }
 
     return 0;
 }
 
+/*
+ * Validate pac as an S4U2Proxy subject PAC contained within a cross-realm TGT.
+ * If target_server is non-null, verify that it matches the PAC proxy target.
+ * Return 0 on success, non-zero on failure.
+ */
+static int
+verify_deleg_pac(krb5_context context, krb5_pac pac,
+                 krb5_enc_tkt_part *enc_tkt,
+                 krb5_const_principal target_server)
+{
+    krb5_timestamp pac_authtime;
+    krb5_data deleg_buf = empty_data();
+    krb5_principal princ = NULL;
+    struct pac_s4u_delegation_info *di = NULL;
+    char *client_str = NULL, *target_str = NULL;
+    const char *last_transited;
+    int result = -1;
+
+    /* Make sure the PAC client string can be parsed as a principal with
+     * realm. */
+    if (get_pac_princ_with_realm(context, pac, &princ, &pac_authtime) != 0)
+        goto cleanup;
+    if (pac_authtime != enc_tkt->times.authtime)
+        goto cleanup;
+
+    if (krb5_pac_get_buffer(context, pac, KRB5_PAC_DELEGATION_INFO,
+                            &deleg_buf) != 0)
+        goto cleanup;
+
+    if (ndr_dec_delegation_info(&deleg_buf, &di) != 0)
+        goto cleanup;
+
+    if (target_server != NULL) {
+        if (krb5_unparse_name_flags(context, target_server,
+                                    KRB5_PRINCIPAL_UNPARSE_DISPLAY |
+                                    KRB5_PRINCIPAL_UNPARSE_NO_REALM,
+                                    &target_str) != 0)
+            goto cleanup;
+        if (strcmp(target_str, di->proxy_target) != 0)
+            goto cleanup;
+    }
+
+    /* Check that the most recently added PAC transited service matches the
+     * requesting impersonator. */
+    if (di->transited_services_length == 0)
+        goto cleanup;
+    if (krb5_unparse_name(context, enc_tkt->client, &client_str) != 0)
+        goto cleanup;
+    last_transited = di->transited_servicesdi->transited_services_length - 1;
+    if (strcmp(last_transited, client_str) != 0)
+        goto cleanup;
+
+    result = 0;
+
+cleanup:
+    free(target_str);
+    free(client_str);
+    ndr_free_delegation_info(di);
+    krb5_free_principal(context, princ);
+    krb5_free_data_contents(context, &deleg_buf);
+    return result;
+}
+
 static int
 check_tgs_s4u2proxy(kdc_realm_t *kdc_active_realm, krb5_kdc_req *req,
-                    krb5_db_entry *server, krb5_ticket *tkt,
-                    const krb5_ticket *stkt, krb5_db_entry *stkt_server,
-                    krb5_boolean is_crossrealm, krb5_boolean is_referral,
-                    const char **status)
+                    krb5_db_entry *server, krb5_ticket *tkt, krb5_pac pac,
+                    const krb5_ticket *stkt, krb5_pac stkt_pac,
+                    krb5_db_entry *stkt_server, krb5_boolean is_crossrealm,
+                    krb5_boolean is_referral, const char **status)
 {
-    /* A second ticket must be present in the request. */
+    /* A forwardable second ticket must be present in the request. */
     if (stkt == NULL) {
         *status = "NO_2ND_TKT";
         return KDC_ERR_BADOPTION;
     }
+    if (!(stkt->enc_part2->flags & TKT_FLG_FORWARDABLE)) {
+        *status = "EVIDENCE_TKT_NOT_FORWARDABLE";
+        return KDC_ERR_BADOPTION;
+    }
 
     /* Constrained delegation is mutually exclusive with renew/forward/etc.
      * (and therefore requires the header ticket to be a TGT). */
@@ -361,6 +450,17 @@
         return KDC_ERR_POLICY;
     }
 
+    /* The header ticket PAC must be present and for the impersonator. */
+    if (pac == NULL) {
+        *status = "S4U2PROXY_NO_HEADER_PAC";
+        return KDC_ERR_TGT_REVOKED;
+    }
+    if (krb5_pac_verify(kdc_context, pac, tkt->enc_part2->times.authtime,
+                        tkt->enc_part2->client, NULL, NULL) != 0) {
+        *status = "S4U2PROXY_HEADER_PAC";
+        return KDC_ERR_BADOPTION;
+    }
+
     /*
      * An S4U2Proxy request must be an initial request to the impersonator's
      * realm (possibly for a target resource in the same realm), or a final
@@ -368,27 +468,51 @@
      * referral-chasing requests do not use the CNAME-IN-ADDL-TKT flag.
      */
 
-    /* For an initial or same-realm request, the second ticket server and
-     * header ticket client must be the same principal. */
-    if (!is_crossrealm && !is_client_db_alias(kdc_context, stkt_server,
-                                              tkt->enc_part2->client)) {
-        *status = "EVIDENCE_TICKET_MISMATCH";
-        return KDC_ERR_SERVER_NOMATCH;
-    }
+    if (stkt_pac == NULL) {
+        *status = "S4U2PROXY_NO_STKT_PAC";
+        return KRB_AP_ERR_MODIFIED;
+    }
+    if (!is_crossrealm) {
+        /* For an initial or same-realm request, the second ticket server and
+         * header ticket client must be the same principal. */
+        if (!is_client_db_alias(kdc_context, stkt_server,
+                                tkt->enc_part2->client)) {
+            *status = "EVIDENCE_TICKET_MISMATCH";
+            return KDC_ERR_SERVER_NOMATCH;
+        }
 
-    /*
-     * For a cross-realm request, the second ticket must be a referral TGT to
-     * our realm with the impersonator as client.  (Unlike the header ticket,
-     * the second ticket contains authdata for the subject client.)  The target
-     * server must also be local, so we must not be issuing a referral.
-     */
-    if (is_crossrealm &&
-        (is_referral || !is_cross_tgs_principal(stkt_server->princ) ||
-         !data_eq(stkt_server->princ->data1, server->princ->realm) ||
-         !krb5_principal_compare(kdc_context, stkt->enc_part2->client,
-                                 tkt->enc_part2->client))) {
-        *status = "XREALM_EVIDENCE_TICKET_MISMATCH";
-        return KDC_ERR_BADOPTION;
+        /* The second ticket client and PAC client are the subject, and must
+         * match. */
+        if (krb5_pac_verify(kdc_context, stkt_pac,
+                            stkt->enc_part2->times.authtime,
+                            stkt->enc_part2->client, NULL, NULL) != 0) {
+            *status = "S4U2PROXY_LOCAL_STKT_PAC";
+            return KDC_ERR_BADOPTION;
+        }
+
+    } else {
+
+        /*
+         * For a cross-realm request, the second ticket must be a referral TGT
+         * to our realm with the impersonator as client.  The target server
+         * must also be local, so we must not be issuing a referral.
+         */
+        if (is_referral || !is_cross_tgs_principal(stkt_server->princ) ||
+            !data_eq(stkt_server->princ->data1, server->princ->realm) ||
+            !krb5_principal_compare(kdc_context, stkt->enc_part2->client,
+                                    tkt->enc_part2->client)) {
+            *status = "XREALM_EVIDENCE_TICKET_MISMATCH";
+            return KDC_ERR_BADOPTION;
+        }
+
+        /* The second ticket PAC must be present and for the impersonated
+         * client, with delegation info. */
+        if (stkt_pac == NULL ||
+            verify_deleg_pac(kdc_context, stkt_pac, stkt->enc_part2,
+                             req->server) != 0) {
+            *status = "S4U2PROXY_CROSS_STKT_PAC";
+            return KDC_ERR_BADOPTION;
+        }
     }
 
     return 0;
@@ -421,6 +545,32 @@
     return 0;
 }
 
+/* Validate the PAC of a non-S4U TGS request, if one is present. */
+static int
+check_normal_tgs_pac(krb5_context context, krb5_enc_tkt_part *enc_tkt,
+                     krb5_pac pac, krb5_db_entry *server,
+                     krb5_boolean is_crossrealm, const char **status)
+{
+    /* We don't require a PAC for regular TGS requests. */
+    if (pac == NULL)
+        return 0;
+
+    /* For most requests the header ticket PAC will be for the ticket
+     * client. */
+    if (krb5_pac_verify(context, pac, enc_tkt->times.authtime, enc_tkt->client,
+                        NULL, NULL) == 0)
+        return 0;
+
+    /* For intermediate RBCD requests the header ticket PAC will be for the
+     * impersonated client. */
+    if (is_crossrealm && is_cross_tgs_principal(server->princ) &&
+        verify_deleg_pac(context, pac, enc_tkt, NULL) == 0)
+        return 0;
+
+    *status = "HEADER_PAC";
+    return KDC_ERR_BADOPTION;
+}
+
 /*
  * Some TGS-REQ options allow for a non-TGS principal in the ticket.  Do some
  * checks that are peculiar to these cases.  (e.g., ticket service principal
@@ -468,7 +618,8 @@
 int
 validate_tgs_request(kdc_realm_t *kdc_active_realm,
                      krb5_kdc_req *request, krb5_db_entry *server,
-                     krb5_ticket *ticket, const krb5_ticket *stkt,
+                     krb5_ticket *ticket, krb5_pac pac,
+                     const krb5_ticket *stkt, krb5_pac stkt_pac,
                      krb5_db_entry *stkt_server, krb5_timestamp kdc_time,
                      krb5_pa_s4u_x509_user *s4u_x509_user,
                      krb5_db_entry *s4u2self_client,
@@ -508,9 +659,9 @@
 
     if (s4u_x509_user != NULL) {
         errcode = check_tgs_s4u2self(kdc_active_realm, request, server, ticket,
-                                     kdc_time, s4u_x509_user, s4u2self_client,
-                                     is_crossrealm, is_referral,
-                                     status, e_data);
+                                     pac, kdc_time, s4u_x509_user,
+                                     s4u2self_client, is_crossrealm,
+                                     is_referral, status, e_data);
     } else {
         errcode = check_tgs_lineage(server, ticket, is_crossrealm, status);
     }
@@ -526,8 +677,13 @@
 
     if (request->kdc_options & KDC_OPT_CNAME_IN_ADDL_TKT) {
         errcode = check_tgs_s4u2proxy(kdc_active_realm, request, server,
-                                      ticket, stkt, stkt_server, is_crossrealm,
-                                      is_referral, status);
+                                      ticket, pac, stkt, stkt_pac, stkt_server,
+                                      is_crossrealm, is_referral, status);
+        if (errcode != 0)
+            return errcode;
+    } else if (s4u_x509_user == NULL) {
+        errcode = check_normal_tgs_pac(kdc_context, ticket->enc_part2, pac,
+                                       server, is_crossrealm, status);
         if (errcode != 0)
             return errcode;
     }

_service:tar_scm:krb5-1.19.2.tar.gz/src/kprop/kprop.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kprop/kprop.c Changed

@@ -25,6 +25,7 @@
  */
 
 #include "k5-int.h"
+#include <inttypes.h>
 #include <locale.h>
 #include <sys/file.h>
 #include <signal.h>
@@ -60,7 +61,6 @@
 
 static krb5_creds creds;
 static krb5_address *sender_addr;
-static krb5_address *receiver_addr;
 static const char *port = KPROP_SERVICE;
 static char *dbpathname;
 
@@ -71,11 +71,11 @@
 static void kerberos_authenticate(krb5_context context,
                                   krb5_auth_context *auth_context, int fd,
                                   krb5_principal me, krb5_creds **new_creds);
-static int open_database(krb5_context context, char *data_fn, int *size);
+static int open_database(krb5_context context, char *data_fn, off_t *size);
 static void close_database(krb5_context context, int fd);
 static void xmit_database(krb5_context context,
                           krb5_auth_context auth_context, krb5_creds *my_creds,
-                          int fd, int database_fd, int in_database_size);
+                          int fd, int database_fd, off_t in_database_size);
 static void send_error(krb5_context context, krb5_creds *my_creds, int fd,
                        char *err_text, krb5_error_code err_code);
 static void update_last_prop_file(char *hostname, char *file_name);
@@ -90,7 +90,8 @@
 int
 main(int argc, char **argv)
 {
-    int fd, database_fd, database_size;
+    int fd, database_fd;
+    off_t database_size;
     krb5_error_code retval;
     krb5_context context;
     krb5_creds *my_creds;
@@ -251,12 +252,6 @@
 
         /* We successfully connect()ed */
         *fd_out = s;
-        retval = sockaddr2krbaddr(context, res->ai_family, res->ai_addr,
-                                  &receiver_addr);
-        if (retval != 0) {
-            com_err(progname, retval, _("while converting server address"));
-            exit(1);
-        }
 
         break;
     }
@@ -296,8 +291,7 @@
     krb5_auth_con_setflags(context, *auth_context,
                            KRB5_AUTH_CONTEXT_DO_SEQUENCE);
 
-    retval = krb5_auth_con_setaddrs(context, *auth_context, sender_addr,
-                                    receiver_addr);
+    retval = krb5_auth_con_setaddrs(context, *auth_context, sender_addr, NULL);
     if (retval) {
         com_err(progname, retval, _("in krb5_auth_con_setaddrs"));
         exit(1);
@@ -339,7 +333,7 @@
  * in the size of the database file.
  */
 static int
-open_database(krb5_context context, char *data_fn, int *size)
+open_database(krb5_context context, char *data_fn, off_t *size)
 {
     struct stat stbuf, stbuf_ok;
     char *data_ok_fn;
@@ -413,19 +407,18 @@
 static void
 xmit_database(krb5_context context, krb5_auth_context auth_context,
               krb5_creds *my_creds, int fd, int database_fd,
-              int in_database_size)
+              off_t in_database_size)
 {
     krb5_int32 n;
     krb5_data inbuf, outbuf;
-    char bufKPROP_BUFSIZ;
+    char bufKPROP_BUFSIZ, dbsize_bufKPROP_DBSIZE_MAX_BUFSIZ;
     krb5_error_code retval;
     krb5_error *error;
-    krb5_ui_4 database_size = in_database_size, send_size, sent_size;
+    uint64_t database_size = in_database_size, send_size, sent_size;
 
     /* Send over the size. */
-    send_size = htonl(database_size);
-    inbuf.data = (char *)&send_size;
-    inbuf.length = sizeof(send_size); /* must be 4, really */
+    inbuf = make_data(dbsize_buf, sizeof(dbsize_buf));
+    encode_database_size(database_size, &inbuf);
     /* KPROP_CKSUMTYPE */
     retval = krb5_mk_safe(context, auth_context, &inbuf, &outbuf, NULL);
     if (retval) {
@@ -460,7 +453,7 @@
         retval = krb5_mk_priv(context, auth_context, &inbuf, &outbuf, NULL);
         if (retval) {
             snprintf(buf, sizeof(buf),
-                     "while encoding database block starting at %d",
+                     "while encoding database block starting at %"PRIu64,
                      sent_size);
             com_err(progname, retval, "%s", buf);
             send_error(context, my_creds, fd, buf, retval);
@@ -471,14 +464,14 @@
         if (retval) {
             krb5_free_data_contents(context, &outbuf);
             com_err(progname, retval,
-                    _("while sending database block starting at %d"),
+                    _("while sending database block starting at %"PRIu64),
                     sent_size);
             exit(1);
         }
         krb5_free_data_contents(context, &outbuf);
         sent_size += n;
         if (debug)
-            printf("%d bytes sent.\n", sent_size);
+            printf("%"PRIu64" bytes sent.\n", sent_size);
     }
     if (sent_size != database_size) {
         com_err(progname, 0, _("Premature EOF found for database file!"));
@@ -533,10 +526,14 @@
         exit(1);
     }
 
-    memcpy(&send_size, outbuf.data, sizeof(send_size));
-    send_size = ntohl(send_size);
+    retval = decode_database_size(&outbuf, &send_size);
+    if (retval) {
+        com_err(progname, retval, _("malformed sent database size message"));
+        exit(1);
+    }
     if (send_size != database_size) {
-        com_err(progname, 0, _("Kpropd sent database size %d, expecting %d"),
+        com_err(progname, 0, _("Kpropd sent database size %"PRIu64
+                               ", expecting %"PRIu64),
                 send_size, database_size);
         exit(1);
     }

_service:tar_scm:krb5-1.19.2.tar.gz/src/kprop/kprop.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kprop/kprop.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/kprop/kprop_util.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kprop/kprop_util.c Changed

@@ -92,3 +92,45 @@
     *princ_out = princ;
     return 0;
 }
+
+void
+encode_database_size(uint64_t size, krb5_data *buf)
+{
+    assert(buf->length >= 12);
+    if (size > 0 && size <= UINT32_MAX) {
+        /* Encode in 32 bits for backward compatibility. */
+        store_32_be(size, buf->data);
+        buf->length = 4;
+    } else {
+        /* Set the first 32 bits to 0 and encode in the following 64 bits. */
+        store_32_be(0, buf->data);
+        store_64_be(size, buf->data + 4);
+        buf->length = 12;
+    }
+}
+
+krb5_error_code
+decode_database_size(const krb5_data *buf, uint64_t *size_out)
+{
+    uint64_t size;
+
+    if (buf->length == 12) {
+        /* A 12-byte buffer must have the first four bytes zeroed. */
+        if (load_32_be(buf->data) != 0)
+            return KRB5KRB_ERR_GENERIC;
+
+        /* The size is stored in the next 64 bits.  Values from 1..2^32-1 must
+         * be encoded in four bytes. */
+        size = load_64_be(buf->data + 4);
+        if (size > 0 && size <= UINT32_MAX)
+            return KRB5KRB_ERR_GENERIC;
+    } else if (buf->length == 4) {
+        size = load_32_be(buf->data);
+    } else {
+        /* Invalid buffer size. */
+        return KRB5KRB_ERR_GENERIC;
+    }
+
+    *size_out = size;
+    return 0;
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/kprop/kpropd.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kprop/kpropd.c Changed

@@ -55,6 +55,7 @@
 #include "com_err.h"
 #include "fake-addrinfo.h"
 
+#include <inttypes.h>
 #include <locale.h>
 #include <ctype.h>
 #include <sys/file.h>
@@ -632,7 +633,7 @@
 do_iprop()
 {
     kadm5_ret_t retval;
-    krb5_principal iprop_svc_principal;
+    krb5_principal iprop_svc_principal = NULL;
     void *server_handle = NULL;
     char *iprop_svc_princstr = NULL, *primary_svc_princstr = NULL;
     unsigned int pollin, backoff_time;
@@ -652,16 +653,13 @@
     if (pollin == 0)
         pollin = 10;
 
-    if (primary_svc_princstr == NULL) {
-        retval = kadm5_get_kiprop_host_srv_name(kpropd_context, realm,
-                                                &primary_svc_princstr);
-        if (retval) {
-            com_err(progname, retval,
-                    _("%s: unable to get kiprop host based "
-                      "service name for realm %s\n"),
-                    progname, realm);
-            return retval;
-        }
+    retval = kadm5_get_kiprop_host_srv_name(kpropd_context, realm,
+                                            &primary_svc_princstr);
+    if (retval) {
+        com_err(progname, retval, _("%s: unable to get kiprop host based "
+                                    "service name for realm %s\n"),
+                progname, realm);
+        goto done;
     }
 
     retval = sn2princ_realm(kpropd_context, NULL, KIPROP_SVC_NAME, realm,
@@ -669,7 +667,7 @@
     if (retval) {
         com_err(progname, retval,
                 _("while trying to construct host service principal"));
-        return retval;
+        goto done;
     }
 
     retval = krb5_unparse_name(kpropd_context, iprop_svc_principal,
@@ -677,10 +675,8 @@
     if (retval) {
         com_err(progname, retval,
                 _("while canonicalizing principal name"));
-        krb5_free_principal(kpropd_context, iprop_svc_principal);
-        return retval;
+        goto done;
     }
-    krb5_free_principal(kpropd_context, iprop_svc_principal);
 
 reinit:
     /*
@@ -995,6 +991,7 @@
 done:
     free(iprop_svc_princstr);
     free(primary_svc_princstr);
+    krb5_free_principal(kpropd_context, iprop_svc_principal);
     krb5_free_default_realm(kpropd_context, def_realm);
     kadm5_destroy(server_handle);
     krb5_db_fini(kpropd_context);
@@ -1349,9 +1346,10 @@
 recv_database(krb5_context context, int fd, int database_fd,
               krb5_data *confmsg)
 {
-    krb5_ui_4 database_size, received_size;
+    uint64_t database_size, received_size;
     int n;
     char buf1024;
+    char dbsize_bufKPROP_DBSIZE_MAX_BUFSIZ;
     krb5_data inbuf, outbuf;
     krb5_error_code retval;
 
@@ -1373,10 +1371,17 @@
                 _("while decoding database size from client"));
         exit(1);
     }
-    memcpy(&database_size, outbuf.data, sizeof(database_size));
+
+    retval = decode_database_size(&outbuf, &database_size);
+    if (retval) {
+        send_error(context, fd, retval, "malformed database size message");
+        com_err(progname, retval,
+                _("malformed database size message from client"));
+        exit(1);
+    }
+
     krb5_free_data_contents(context, &inbuf);
     krb5_free_data_contents(context, &outbuf);
-    database_size = ntohl(database_size);
 
     /* Initialize the initial vector. */
     retval = krb5_auth_con_initivector(context, auth_context);
@@ -1396,7 +1401,7 @@
         retval = krb5_read_message(context, &fd, &inbuf);
         if (retval) {
             snprintf(buf, sizeof(buf),
-                     "while reading database block starting at offset %d",
+                     "while reading database block starting at offset %"PRIu64,
                      received_size);
             com_err(progname, retval, "%s", buf);
             send_error(context, fd, retval, buf);
@@ -1407,8 +1412,8 @@
         retval = krb5_rd_priv(context, auth_context, &inbuf, &outbuf, NULL);
         if (retval) {
             snprintf(buf, sizeof(buf),
-                     "while decoding database block starting at offset %d",
-                     received_size);
+                     "while decoding database block starting at offset %"
+                     PRIu64, received_size);
             com_err(progname, retval, "%s", buf);
             send_error(context, fd, retval, buf);
             krb5_free_data_contents(context, &inbuf);
@@ -1418,13 +1423,13 @@
         krb5_free_data_contents(context, &inbuf);
         if (n < 0) {
             snprintf(buf, sizeof(buf),
-                     "while writing database block starting at offset %d",
+                     "while writing database block starting at offset %"PRIu64,
                      received_size);
             send_error(context, fd, errno, buf);
         } else if ((unsigned int)n != outbuf.length) {
             snprintf(buf, sizeof(buf),
                      "incomplete write while writing database block starting "
-                     "at \noffset %d (%d written, %d expected)",
+                     "at \noffset %"PRIu64" (%d written, %d expected)",
                      received_size, n, outbuf.length);
             send_error(context, fd, KRB5KRB_ERR_GENERIC, buf);
         }
@@ -1435,7 +1440,8 @@
     /* OK, we've seen the entire file.  Did we get too many bytes? */
     if (received_size > database_size) {
         snprintf(buf, sizeof(buf),
-                 "Received %d bytes, expected %d bytes for database file",
+                 "Received %"PRIu64" bytes, expected %"PRIu64
+                 " bytes for database file",
                  received_size, database_size);
         send_error(context, fd, KRB5KRB_ERR_GENERIC, buf);
     }
@@ -1445,9 +1451,8 @@
 
     /* Create message acknowledging number of bytes received, but
      * don't send it until kdb5_util returns successfully. */
-    database_size = htonl(database_size);
-    inbuf.data = (char *)&database_size;
-    inbuf.length = sizeof(database_size);
+    inbuf = make_data(dbsize_buf, sizeof(dbsize_buf));
+    encode_database_size(database_size, &inbuf);
     retval = krb5_mk_safe(context,auth_context,&inbuf,confmsg,NULL);
     if (retval) {
         com_err(progname, retval, "while encoding # of received bytes");

_service:tar_scm:krb5-1.19.2.tar.gz/src/kprop/kproplog.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/kprop/kproplog.c Changed

@@ -398,28 +398,36 @@
     }
 }
 
-/* Return a read-only mmap of the ulog, or NULL on failure.  Assumes fd is
- * released on process exit. */
+/* Return a read-only mmap of the ulog, or NULL on failure. */
 static kdb_hlog_t *
-map_ulog(const char *filename)
+map_ulog(const char *filename, int *fd_out)
 {
     int fd;
     struct stat st;
-    kdb_hlog_t *ulog;
+    kdb_hlog_t *ulog = MAP_FAILED;
+
+    *fd_out = -1;
 
     fd = open(filename, O_RDONLY);
     if (fd == -1)
         return NULL;
-    if (fstat(fd, &st) < 0)
+    if (fstat(fd, &st) < 0) {
+        close(fd);
         return NULL;
+    }
     ulog = mmap(0, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-    return (ulog == MAP_FAILED) ? NULL : ulog;
+    if (ulog == MAP_FAILED) {
+        close(fd);
+        return NULL;
+    }
+    *fd_out = fd;
+    return ulog;
 }
 
 int
 main(int argc, char **argv)
 {
-    int c;
+    int c, ulog_fd = -1;
     unsigned int verbose = 0;
     bool_t headeronly = FALSE, reset = FALSE;
     uint32_t entry = 0;
@@ -480,7 +488,7 @@
         goto done;
     }
 
-    ulog = map_ulog(params.iprop_logfile);
+    ulog = map_ulog(params.iprop_logfile, &ulog_fd);
     if (ulog == NULL) {
         fprintf(stderr, _("Unable to map log file %s\n\n"),
                 params.iprop_logfile);
@@ -546,6 +554,7 @@
     printf("\n");
 
 done:
+    close(ulog_fd);
     kadm5_free_config_params(context, &params);
     krb5_free_context(context);
     return 0;

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/apputils/net-server.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/apputils/net-server.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/Makefile.in Changed

@@ -1,34 +1,28 @@
 mydir=lib$(S)crypto
 BUILDTOP=$(REL)..$(S)..
-SUBDIRS= krb $(CRYPTO_IMPL) crypto_tests
+SUBDIRS= krb builtin openssl crypto_tests
+WINSUBDIRS= krb builtin crypto_tests
+LOCALINCLUDES=$(CRYPTO_IMPL_CFLAGS)
 
 LIBBASE=k5crypto
 LIBMAJOR=3
 LIBMINOR=1
-LIBINITFUNC=cryptoint_initialize_library
-LIBFINIFUNC=cryptoint_cleanup_library
 RELDIR=crypto
 
-STOBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST				\
-	$(CRYPTO_IMPL)/hash_provider/OBJS.ST				\
-	$(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST		\
-	$(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST		\
-	$(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST		\
-	$(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST			\
-	$(CRYPTO_IMPL)/OBJS.ST
-
-SUBDIROBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST			\
-	$(CRYPTO_IMPL)/hash_provider/OBJS.ST				\
-	$(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST		\
-	$(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST		\
-	$(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST		\
-	$(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST			\
-	$(CRYPTO_IMPL)/OBJS.ST
+STOBJLISTS=krb/OBJS.ST						\
+	builtin/OBJS.ST builtin/des/OBJS.ST			\
+	builtin/aes/OBJS.ST builtin/camellia/OBJS.ST		\
+	builtin/md4/OBJS.ST builtin/md5/OBJS.ST			\
+	builtin/sha1/OBJS.ST builtin/sha2/OBJS.ST		\
+	builtin/enc_provider/OBJS.ST builtin/hash_provider/OBJS.ST \
+	openssl/OBJS.ST openssl/des/OBJS.ST			\
+	openssl/enc_provider/OBJS.ST openssl/hash_provider/OBJS.ST
+
+SUBDIROBJLISTS=$(STOBJLISTS)
 
 # No dependencies.  Record places to find this shared object if the target
 # link editor and loader support it.
 DEPLIBS=
-CRYPTO_IMPL_LIBS=@CRYPTO_IMPL_LIBS@
 SHLIB_EXPLIBS= $(SUPPORT_LIB) $(CRYPTO_IMPL_LIBS) $(LIBS)
 SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB)
 SHLIB_LDFLAGS= $(LDFLAGS) @SHLIB_RPATH_DIRS@

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/aes/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/aes/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/aes/aescrypt.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/aes/aescrypt.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/aes/aeskey.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/aes/aeskey.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/aes/aestab.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/aes/aestab.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/aes/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/aes/deps Changed

@@ -2,8 +2,36 @@
 # Generated makefile dependencies follow.
 #
 aescrypt.so aescrypt.po $(OUTPRE)aescrypt.$(OBJEXT): \
-  aes.h aescrypt.c aesopt.h aestab.h brg_endian.h brg_types.h
-aestab.so aestab.po $(OUTPRE)aestab.$(OBJEXT): aes.h \
-  aesopt.h aestab.c aestab.h brg_endian.h brg_types.h
-aeskey.so aeskey.po $(OUTPRE)aeskey.$(OBJEXT): aes.h \
-  aeskey.c aesopt.h aestab.h brg_endian.h brg_types.h
+  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h aes.h aescrypt.c \
+  aesopt.h aestab.h brg_endian.h brg_types.h
+aestab.so aestab.po $(OUTPRE)aestab.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  aes.h aesopt.h aestab.c aestab.h brg_endian.h brg_types.h
+aeskey.so aeskey.po $(OUTPRE)aeskey.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  aes.h aeskey.c aesopt.h aestab.h brg_endian.h brg_types.h

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/camellia/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/camellia/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/camellia/camellia.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/camellia/camellia.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/camellia/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/camellia/deps Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/cmac.c Added

@@ -0,0 +1,204 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* lib/crypto/krb/cmac.c */
+/*
+ * Copyright 2010 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ */
+
+#include "crypto_int.h"
+
+#ifdef K5_BUILTIN_CMAC
+
+#define BLOCK_SIZE 16
+
+static unsigned char const_RbBLOCK_SIZE = {
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x87
+};
+
+static void
+xor_128(unsigned char *a, unsigned char *b, unsigned char *out)
+{
+    int z;
+
+    for (z = 0; z < BLOCK_SIZE / 4; z++) {
+        unsigned char *aptr = &az * 4;
+        unsigned char *bptr = &bz * 4;
+        unsigned char *outptr = &outz * 4;
+
+        store_32_n(load_32_n(aptr) ^ load_32_n(bptr), outptr);
+    }
+}
+
+static void
+leftshift_onebit(unsigned char *input, unsigned char *output)
+{
+    int i;
+    unsigned char overflow = 0;
+
+    for (i = BLOCK_SIZE - 1; i >= 0; i--) {
+        outputi = inputi << 1;
+        outputi |= overflow;
+        overflow = (inputi & 0x80) ? 1 : 0;
+    }
+}
+
+/* Generate subkeys K1 and K2 as described in RFC 4493 figure 2.2. */
+static krb5_error_code
+generate_subkey(const struct krb5_enc_provider *enc,
+                krb5_key key,
+                unsigned char *K1,
+                unsigned char *K2)
+{
+    unsigned char LBLOCK_SIZE;
+    unsigned char tmpBLOCK_SIZE;
+    krb5_data d;
+    krb5_error_code ret;
+
+    /* L := encrypt(K, const_Zero) */
+    memset(L, 0, sizeof(L));
+    d = make_data(L, BLOCK_SIZE);
+    ret = encrypt_block(enc, key, &d);
+    if (ret != 0)
+        return ret;
+
+    /* K1 := (MSB(L) == 0) ? L << 1 : (L << 1) XOR const_Rb */
+    if ((L0 & 0x80) == 0) {
+        leftshift_onebit(L, K1);
+    } else {
+        leftshift_onebit(L, tmp);
+        xor_128(tmp, const_Rb, K1);
+    }
+
+    /* K2 := (MSB(K1) == 0) ? K1 << 1 : (K1 << 1) XOR const_Rb */
+    if ((K10 & 0x80) == 0) {
+        leftshift_onebit(K1, K2);
+    } else {
+        leftshift_onebit(K1, tmp);
+        xor_128(tmp, const_Rb, K2);
+    }
+
+    return 0;
+}
+
+/* Pad out lastb with a 1 bit followed by 0 bits, placing the result in pad. */
+static void
+padding(unsigned char *lastb, unsigned char *pad, int length)
+{
+    int j;
+
+    /* original last block */
+    for (j = 0; j < BLOCK_SIZE; j++) {
+        if (j < length) {
+            padj = lastbj;
+        } else if (j == length) {
+            padj = 0x80;
+        } else {
+            padj = 0x00;
+        }
+    }
+}
+
+/*
+ * Implementation of CMAC algorithm. When used with AES, this function
+ * is compatible with RFC 4493 figure 2.3.
+ */
+krb5_error_code
+krb5int_cmac_checksum(const struct krb5_enc_provider *enc, krb5_key key,
+                      const krb5_crypto_iov *data, size_t num_data,
+                      krb5_data *output)
+{
+    unsigned char YBLOCK_SIZE, M_lastBLOCK_SIZE, paddedBLOCK_SIZE;
+    unsigned char K1BLOCK_SIZE, K2BLOCK_SIZE;
+    unsigned char inputBLOCK_SIZE;
+    unsigned int n, i, flag;
+    krb5_error_code ret;
+    struct iov_cursor cursor;
+    size_t length;
+    krb5_crypto_iov iov1;
+    krb5_data d;
+
+    assert(enc->cbc_mac != NULL);
+
+    if (enc->block_size != BLOCK_SIZE)
+        return KRB5_BAD_MSIZE;
+
+    length = iov_total_length(data, num_data, TRUE);
+
+    /* Step 1. */
+    ret = generate_subkey(enc, key, K1, K2);
+    if (ret != 0)
+        return ret;
+
+    /* Step 2. */
+    n = (length + BLOCK_SIZE - 1) / BLOCK_SIZE;
+
+    /* Step 3. */
+    if (n == 0) {
+        n = 1;
+        flag = 0;
+    } else {
+        flag = ((length % BLOCK_SIZE) == 0);
+    }
+
+    iov0.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov0.data = make_data(input, BLOCK_SIZE);
+
+    /* Step 5 (we'll do step 4 in a bit). */
+    memset(Y, 0, BLOCK_SIZE);
+    d = make_data(Y, BLOCK_SIZE);
+
+    /* Step 6 (all but last block). */
+    k5_iov_cursor_init(&cursor, data, num_data, BLOCK_SIZE, TRUE);
+    for (i = 0; i < n - 1; i++) {
+        k5_iov_cursor_get(&cursor, input);
+
+        ret = enc->cbc_mac(key, iov, 1, &d, &d);
+        if (ret != 0)
+            return ret;
+    }
+
+    /* Step 4. */
+    k5_iov_cursor_get(&cursor, input);
+    if (flag) {
+        /* last block is complete block */
+        xor_128(input, K1, M_last);
+    } else {
+        padding(input, padded, length % BLOCK_SIZE);
+        xor_128(padded, K2, M_last);
+    }
+
+    /* Step 6 (last block). */
+    iov0.data = make_data(M_last, BLOCK_SIZE);
+    ret = enc->cbc_mac(key, iov, 1, &d, &d);
+    if (ret != 0)
+        return ret;
+
+    assert(output->length >= d.length);
+
+    output->length = d.length;
+    memcpy(output->data, d.data, d.length);
+
+    return 0;
+}
+
+#endif /* K5_BUILTIN_CMAC */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/deps Changed

@@ -1,10 +1,20 @@
 #
 # Generated makefile dependencies follow.
 #
+cmac.so cmac.po $(OUTPRE)cmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  cmac.c
 hmac.so hmac.po $(OUTPRE)hmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
-  $(srcdir)/aes/aes.h $(srcdir)/aes/brg_types.h $(srcdir)/sha2/sha2.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -12,11 +22,10 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_mod.h hmac.c
-init.so init.po $(OUTPRE)init.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  hmac.c
+kdf.so kdf.po $(OUTPRE)kdf.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
-  $(srcdir)/aes/aes.h $(srcdir)/aes/brg_types.h $(srcdir)/sha2/sha2.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -24,11 +33,10 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_mod.h init.c
+  kdf.c
 pbkdf2.so pbkdf2.po $(OUTPRE)pbkdf2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
-  $(srcdir)/aes/aes.h $(srcdir)/aes/brg_types.h $(srcdir)/sha2/sha2.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -36,4 +44,4 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_mod.h pbkdf2.c
+  pbkdf2.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/d3_aead.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/d3_aead.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/d3_kysched.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/d3_kysched.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/deps Changed

@@ -4,8 +4,6 @@
 d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-  $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
-  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -17,20 +15,18 @@
 d3_kysched.so d3_kysched.po $(OUTPRE)d3_kysched.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  d3_kysched.c des_int.h
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h d3_kysched.c des_int.h
 des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
-  $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \
-  $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -41,8 +37,6 @@
 f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-  $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
-  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -53,69 +47,71 @@
   des_int.h f_aead.c f_tables.h
 f_cksum.so f_cksum.po $(OUTPRE)f_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h des_int.h f_cksum.c \
-  f_tables.h
-f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  des_int.h f_parity.c
-f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
+  des_int.h f_cksum.c f_tables.h
+f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
   $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h des_int.h f_sched.c
-f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/socket-utils.h des_int.h f_parity.c
+f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  des_int.h f_tables.c f_tables.h
+  des_int.h f_sched.c
+f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h des_int.h f_tables.c \
+  f_tables.h
 key_sched.so key_sched.po $(OUTPRE)key_sched.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  des_int.h key_sched.c
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h des_int.h key_sched.c
 weak_key.so weak_key.po $(OUTPRE)weak_key.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  des_int.h weak_key.c
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h des_int.h weak_key.c
 destest.so destest.po $(OUTPRE)destest.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/des_keys.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/des_keys.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/f_aead.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/f_aead.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/f_cksum.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/f_cksum.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/f_parity.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/f_parity.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/f_sched.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/f_sched.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/f_tables.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/f_tables.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/key_sched.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/key_sched.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/des/weak_key.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/des/weak_key.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/enc_provider/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/enc_provider/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/enc_provider/aes.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/enc_provider/aes.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/enc_provider/camellia.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/enc_provider/camellia.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/enc_provider/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/enc_provider/deps Changed

@@ -4,9 +4,7 @@
 des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-  $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
-  $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \
-  $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(srcdir)/../des/des_int.h $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -18,7 +16,6 @@
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
   $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
-  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -30,9 +27,7 @@
 camellia.so camellia.po $(OUTPRE)camellia.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
-  $(srcdir)/../aes/brg_types.h $(srcdir)/../camellia/camellia.h \
-  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../camellia/camellia.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -44,8 +39,6 @@
 rc4.so rc4.po $(OUTPRE)rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-  $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \
-  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/enc_provider/des3.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/enc_provider/des3.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/enc_provider/rc4.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/enc_provider/rc4.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/hash_provider/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/hash_provider/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/hash_provider/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/hash_provider/deps Changed

@@ -4,9 +4,7 @@
 hash_md4.so hash_md4.po $(OUTPRE)hash_md4.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
-  $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \
-  $(srcdir)/../md4/rsa-md4.h $(srcdir)/../sha2/sha2.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../md4/rsa-md4.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -18,9 +16,7 @@
 hash_md5.so hash_md5.po $(OUTPRE)hash_md5.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
-  $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \
-  $(srcdir)/../md5/rsa-md5.h $(srcdir)/../sha2/sha2.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../md5/rsa-md5.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -32,26 +28,24 @@
 hash_sha1.so hash_sha1.po $(OUTPRE)hash_sha1.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
-  $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \
-  $(srcdir)/../sha1/shs.h $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h hash_sha1.c
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../sha1/shs.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  hash_sha1.c
 hash_sha2.so hash_sha2.po $(OUTPRE)hash_sha2.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
-  $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \
-  $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h hash_sha2.c
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../sha2/sha2.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  hash_sha2.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/hash_provider/hash_md4.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/hash_provider/hash_md4.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/hash_provider/hash_md5.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/hash_provider/hash_md5.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/hash_provider/hash_sha1.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/hash_provider/hash_sha1.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/hash_provider/hash_sha2.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/hash_provider/hash_sha2.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/hmac.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/hmac.c Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/kdf.c Added

@@ -0,0 +1,190 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ * Copyright (C) 1998 by the FundsXpress, INC.
+ *
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may require
+ * a specific license from the United States Government.  It is the
+ * responsibility of any person or organization contemplating export to
+ * obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of FundsXpress. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  FundsXpress makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+#include "crypto_int.h"
+
+#ifdef K5_BUILTIN_KDF
+
+krb5_error_code
+k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash,
+                          krb5_key key, const krb5_data *label,
+                          const krb5_data *context, krb5_data *rnd_out)
+{
+    krb5_crypto_iov iov5;
+    krb5_error_code ret;
+    krb5_data prf;
+    unsigned char ibuf4, lbuf4;
+
+    if (hash == NULL || rnd_out->length > hash->hashsize)
+        return KRB5_CRYPTO_INTERNAL;
+
+    /* Allocate encryption data buffer. */
+    ret = alloc_data(&prf, hash->hashsize);
+    if (ret)
+        return ret;
+
+    /* i2: four-byte big-endian binary string giving the block counter (1) */
+    iov0.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov0.data = make_data(ibuf, sizeof(ibuf));
+    store_32_be(1, ibuf);
+    /* Label */
+    iov1.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov1.data = *label;
+    /* 0x00: separator byte */
+    iov2.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov2.data = make_data("", 1);
+    /* Context */
+    iov3.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov3.data = *context;
+    /* L2: four-byte big-endian binary string giving the output length */
+    iov4.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov4.data = make_data(lbuf, sizeof(lbuf));
+    store_32_be(rnd_out->length * 8, lbuf);
+
+    ret = krb5int_hmac(hash, key, iov, 5, &prf);
+    if (!ret)
+        memcpy(rnd_out->data, prf.data, rnd_out->length);
+    zapfree(prf.data, prf.length);
+    return ret;
+}
+
+krb5_error_code
+k5_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, krb5_key key,
+                           const krb5_data *label, krb5_data *rnd_out)
+{
+    size_t blocksize, keybytes, n;
+    krb5_crypto_iov iov6;
+    krb5_error_code ret;
+    krb5_data prf;
+    unsigned int i;
+    unsigned char ibuf4, Lbuf4;
+
+    blocksize = enc->block_size;
+    keybytes = enc->keybytes;
+
+    if (key->keyblock.length != enc->keylength || rnd_out->length != keybytes)
+        return KRB5_CRYPTO_INTERNAL;
+
+    /* Allocate encryption data buffer. */
+    ret = alloc_data(&prf, blocksize);
+    if (ret)
+        return ret;
+
+    /* K(i-1): the previous block of PRF output, initially all-zeros. */
+    iov0.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov0.data = prf;
+    /* i2: four-byte big-endian binary string giving the block counter */
+    iov1.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov1.data = make_data(ibuf, sizeof(ibuf));
+    /* Label: the fixed derived-key input */
+    iov2.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov2.data = *label;
+    /* 0x00: separator byte */
+    iov3.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov3.data = make_data("", 1);
+    /* Context: (unused) */
+    iov4.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov4.data = empty_data();
+    /* L2: four-byte big-endian binary string giving the output length */
+    iov5.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov5.data = make_data(Lbuf, sizeof(Lbuf));
+    store_32_be(rnd_out->length * 8, Lbuf);
+
+    for (i = 1, n = 0; n < keybytes; i++) {
+        /* Update the block counter. */
+        store_32_be(i, ibuf);
+
+        /* Compute a CMAC checksum, storing the result into K(i-1). */
+        ret = krb5int_cmac_checksum(enc, key, iov, 6, &prf);
+        if (ret)
+            goto cleanup;
+
+        /* Copy the result into the appropriate part of the output buffer. */
+        if (keybytes - n <= blocksize) {
+            memcpy(rnd_out->data + n, prf.data, keybytes - n);
+            break;
+        }
+        memcpy(rnd_out->data + n, prf.data, blocksize);
+        n += blocksize;
+    }
+
+cleanup:
+    zapfree(prf.data, blocksize);
+    return ret;
+}
+
+krb5_error_code
+k5_derive_random_rfc3961(const struct krb5_enc_provider *enc, krb5_key key,
+                         const krb5_data *constant, krb5_data *rnd_out)
+{
+    size_t blocksize, keybytes, n;
+    krb5_error_code ret;
+    krb5_data block = empty_data();
+
+    blocksize = enc->block_size;
+    keybytes = enc->keybytes;
+
+    if (blocksize == 1)
+        return KRB5_BAD_ENCTYPE;
+    if (key->keyblock.length != enc->keylength || rnd_out->length != keybytes)
+        return KRB5_CRYPTO_INTERNAL;
+
+    /* Allocate encryption data buffer. */
+    ret = alloc_data(&block, blocksize);
+    if (ret)
+        return ret;
+
+    /* Initialize the input block. */
+    if (constant->length == blocksize) {
+        memcpy(block.data, constant->data, blocksize);
+    } else {
+        krb5int_nfold(constant->length * 8, (uint8_t *)constant->data,
+                      blocksize * 8, (uint8_t *)block.data);
+    }
+
+    /* Loop encrypting the blocks until enough key bytes are generated. */
+    n = 0;
+    while (n < keybytes) {
+        ret = encrypt_block(enc, key, &block);
+        if (ret)
+            goto cleanup;
+
+        if ((keybytes - n) <= blocksize) {
+            memcpy(rnd_out->data + n, block.data, (keybytes - n));
+            break;
+        }
+
+        memcpy(rnd_out->data + n, block.data, blocksize);
+        n += blocksize;
+    }
+
+cleanup:
+    zapfree(block.data, blocksize);
+    return ret;
+}
+
+#endif /* K5_BUILTIN_KDF */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/md4/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/md4/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/md4/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/md4/deps Changed

@@ -3,11 +3,12 @@
 #
 md4.so md4.po $(OUTPRE)md4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h md4.c rsa-md4.h
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  md4.c rsa-md4.h

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/md4/md4.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/md4/md4.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/md5/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/md5/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/md5/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/md5/deps Changed

@@ -3,11 +3,12 @@
 #
 md5.so md5.po $(OUTPRE)md5.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h md5.c rsa-md5.h
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  md5.c rsa-md5.h

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/md5/md5.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/md5/md5.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/pbkdf2.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/pbkdf2.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha1/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha1/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha1/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha1/deps Changed

@@ -3,11 +3,12 @@
 #
 shs.so shs.po $(OUTPRE)shs.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h shs.c shs.h
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  shs.c shs.h

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha1/shs.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha1/shs.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha1/shs.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha1/shs.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha2/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha2/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha2/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha2/deps Changed

@@ -3,21 +3,23 @@
 #
 sha256.so sha256.po $(OUTPRE)sha256.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h sha2.h sha256.c
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  sha2.h sha256.c
 sha512.so sha512.po $(OUTPRE)sha512.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h sha2.h sha512.c
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  sha2.h sha512.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha2/sha2.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha2/sha2.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha2/sha256.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha2/sha256.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/builtin/sha2/sha512.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/builtin/sha2/sha512.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/crypto_tests/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/crypto_tests/Makefile.in Changed

@@ -1,13 +1,12 @@
 mydir=lib$(S)crypto$(S)crypto_tests
 BUILDTOP=$(REL)..$(S)..$(S)..
-LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir)/../$(CRYPTO_IMPL)
+LOCALINCLUDES = -I$(srcdir)/../krb
 
 EXTRADEPSRCS=\
 	$(srcdir)/t_nfold.c	\
 	$(srcdir)/t_encrypt.c	\
 	$(srcdir)/t_decrypt.c	\
 	$(srcdir)/t_prf.c 	\
-	$(srcdir)/t_prng.c	\
 	$(srcdir)/t_cmac.c	\
 	$(srcdir)/t_hmac.c	\
 	$(srcdir)/t_pkcs5.c	\
@@ -27,7 +26,7 @@
 
 ##DOS##BUILDTOP = ..\..\..
 
-check-unix: t_nfold t_encrypt t_decrypt t_prf t_prng t_cmac t_hmac \
+check-unix: t_nfold t_encrypt t_decrypt t_prf t_cmac t_hmac \
 		t_cksums \
 		aes-test  \
 		camellia-test  \
@@ -36,7 +35,6 @@
 	$(RUN_TEST) ./t_nfold
 	$(RUN_TEST) ./t_encrypt
 	$(RUN_TEST) ./t_decrypt
-	$(RUN_TEST) ./t_prng <$(srcdir)/t_prng.seed >t_prng.output
 	$(RUN_TEST) ./t_cmac
 	$(RUN_TEST) ./t_hmac
 	$(RUN_TEST) ./t_prf
@@ -71,9 +69,6 @@
 t_prf$(EXEEXT): t_prf.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o $@ t_prf.$(OBJEXT) $(KRB5_BASE_LIBS)
 
-t_prng$(EXEEXT): t_prng.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o $@ t_prng.$(OBJEXT) $(KRB5_BASE_LIBS)
-
 t_cmac$(EXEEXT): t_cmac.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o $@ t_cmac.$(OBJEXT) $(KRB5_BASE_LIBS)
 
@@ -133,7 +128,7 @@
 
 clean:
 	$(RM) t_nfold.o t_nfold t_encrypt t_encrypt.o \
-		t_decrypt.o t_decrypt t_prng.o t_prng t_cmac.o t_cmac \
+		t_decrypt.o t_decrypt t_cmac.o t_cmac \
 		t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o \
 		aes-test.o aes-test vt.txt vk.txt kresults.out \
 		t_cts.o t_cts \
@@ -145,7 +140,6 @@
 		camellia-test camellia-test.o camellia-vt.txt \
 		t_cf2 t_cf2.o t_cf2.output
 
-	-$(RM) t_prng.output
 	-$(RM) t_prf.output
 
 @lib_frag@

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/crypto_tests/camellia-test.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/crypto_tests/camellia-test.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/crypto_tests/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/crypto_tests/deps Changed

@@ -3,9 +3,7 @@
 #
 $(OUTPRE)t_nfold.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -16,9 +14,7 @@
   t_nfold.c
 $(OUTPRE)t_encrypt.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -47,21 +43,9 @@
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
   $(top_srcdir)/include/socket-utils.h t_prf.c
-$(OUTPRE)t_prng.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h t_prng.c
 $(OUTPRE)t_cmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -72,9 +56,7 @@
   t_cmac.c
 $(OUTPRE)t_hmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-hex.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
@@ -95,9 +77,7 @@
   $(top_srcdir)/include/socket-utils.h t_pkcs5.c
 $(OUTPRE)t_cts.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -108,9 +88,7 @@
   t_cts.c
 $(OUTPRE)vectors.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -121,9 +99,7 @@
   vectors.c
 $(OUTPRE)aes-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -134,9 +110,7 @@
   aes-test.c
 $(OUTPRE)camellia-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -159,9 +133,7 @@
   $(top_srcdir)/include/socket-utils.h t_cksums.c
 $(OUTPRE)t_mddriver.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -182,9 +154,7 @@
   $(top_srcdir)/include/socket-utils.h t_kperf.c
 $(OUTPRE)t_sha2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -215,9 +185,7 @@
   $(top_srcdir)/include/socket-utils.h t_str2key.c
 $(OUTPRE)t_derive.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(srcdir)/../krb/crypto_int.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/crypto_tests/t_cksums.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/crypto_tests/t_cksums.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/Makefile.in Changed

@@ -1,6 +1,5 @@
 mydir=lib$(S)crypto$(S)krb
 BUILDTOP=$(REL)..$(S)..$(S)..
-LOCALINCLUDES = -I$(srcdir)/../$(CRYPTO_IMPL)
 
 ##DOS##BUILDTOP = ..\..\..
 ##DOS##PREFIXDIR = krb
@@ -18,10 +17,8 @@
 	checksum_length.o	\
 	cksumtype_to_string.o	\
 	cksumtypes.o		\
-	cmac.o			\
 	coll_proof_cksum.o	\
 	crypto_length.o		\
-	crypto_libinit.o	\
 	default_state.o 	\
 	decrypt.o		\
 	decrypt_iov.o		\
@@ -54,7 +51,6 @@
 	prf_dk.o		\
 	prf_rc4.o		\
 	prng.o			\
-	prng_$(PRNG_ALG).o	\
 	random_to_key.o		\
 	s2k_pbkdf2.o		\
 	s2k_rc4.o		\
@@ -77,10 +73,8 @@
 	$(OUTPRE)checksum_length.$(OBJEXT)	\
 	$(OUTPRE)cksumtype_to_string.$(OBJEXT)	\
 	$(OUTPRE)cksumtypes.$(OBJEXT)		\
-	$(OUTPRE)cmac.$(OBJEXT)			\
 	$(OUTPRE)coll_proof_cksum.$(OBJEXT)	\
 	$(OUTPRE)crypto_length.$(OBJEXT)	\
-	$(OUTPRE)crypto_libinit.$(OBJEXT)	\
 	$(OUTPRE)default_state.$(OBJEXT) 	\
 	$(OUTPRE)decrypt.$(OBJEXT)		\
 	$(OUTPRE)decrypt_iov.$(OBJEXT)		\
@@ -113,7 +107,6 @@
 	$(OUTPRE)prf_dk.$(OBJEXT)		\
 	$(OUTPRE)prf_rc4.$(OBJEXT)		\
 	$(OUTPRE)prng.$(OBJEXT)			\
-	$(OUTPRE)prng_$(PRNG_ALG).$(OBJEXT)	\
 	$(OUTPRE)random_to_key.$(OBJEXT)	\
 	$(OUTPRE)s2k_pbkdf2.$(OBJEXT)		\
 	$(OUTPRE)s2k_rc4.$(OBJEXT)		\
@@ -136,10 +129,8 @@
 	$(srcdir)/checksum_length.c	\
 	$(srcdir)/cksumtype_to_string.c	\
 	$(srcdir)/cksumtypes.c		\
-	$(srcdir)/cmac.c		\
 	$(srcdir)/coll_proof_cksum.c	\
 	$(srcdir)/crypto_length.c	\
-	$(srcdir)/crypto_libinit.c	\
 	$(srcdir)/default_state.c 	\
 	$(srcdir)/decrypt.c		\
 	$(srcdir)/decrypt_iov.c		\
@@ -172,7 +163,6 @@
 	$(srcdir)/prf_dk.c		\
 	$(srcdir)/prf_rc4.c		\
 	$(srcdir)/prng.c 		\
-	$(srcdir)/prng_$(PRNG_ALG).c	\
 	$(srcdir)/cf2.c 		\
 	$(srcdir)/random_to_key.c	\
 	$(srcdir)/s2k_pbkdf2.c		\
@@ -180,7 +170,6 @@
 	$(srcdir)/state.c 		\
 	$(srcdir)/string_to_cksumtype.c	\
 	$(srcdir)/string_to_key.c	\
-	$(srcdir)/t_fortuna.c		\
 	$(srcdir)/valid_cksumtype.c	\
 	$(srcdir)/verify_checksum.c	\
 	$(srcdir)/verify_checksum_iov.c
@@ -192,17 +181,7 @@
 
 depend: $(SRCS)
 
-check-unix: t_fortuna
-	if  $(PRNG_ALG) = fortuna ; then \
-		$(RUN_TEST) ./t_fortuna > t_fortuna.output && \
-		cmp t_fortuna.output $(srcdir)/t_fortuna.expected; \
-	fi
-
-t_fortuna: t_fortuna.o $(SUPPORT_DEPLIB) $(CRYPTO_DEPLIB)
-	$(CC_LINK) -o $@ t_fortuna.o $(K5CRYPTO_LIB) $(SUPPORT_LIB) $(LIBS)
-
 clean-unix:: clean-libobjs
-	$(RM) t_fortuna.o t_fortuna t_fortuna.output
 
 @lib_frag@
 @libobj_frag@

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/cksumtypes.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/cksumtypes.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/crypto_int.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/crypto_int.h Changed

@@ -25,13 +25,69 @@
  */
 
 /* This header is the entry point for libk5crypto sources, and also documents
- * requirements for crypto modules and PRNG modules.  */
+ * requirements for crypto modules. */
 
 #ifndef CRYPTO_INT_H
 #define CRYPTO_INT_H
 
 #include <k5-int.h>
 
+#if defined(CRYPTO_OPENSSL)
+
+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+/*
+ * OpenSSL 3.0 relegates MD4 and RC4 to the legacy provider, which must be
+ * explicitly loaded into a library context.  Performing this loading within a
+ * library carries complications, so use the built-in implementations of these
+ * primitives instead.  OpenSSL 3.0 also deprecates DES_set_odd_parity() with
+ * no replacement.
+ *
+ * OpenSSL 3.0 adds KDF implementations matching the ones we use to derive
+ * encryption and authentication keys from protocol keys.  It also adds
+ * the EVP_MAC interface which can be used for CMAC.  (We could use the CMAC
+ * interface with OpenSSL 1.1 but currently do not.)
+ */
+#define K5_BUILTIN_DES_KEY_PARITY
+#define K5_BUILTIN_MD4
+#define K5_BUILTIN_RC4
+#define K5_OPENSSL_KDF
+#define K5_OPENSSL_CMAC
+#else
+#define K5_OPENSSL_DES_KEY_PARITY
+#define K5_OPENSSL_MD4
+#define K5_OPENSSL_RC4
+#define K5_BUILTIN_KDF
+#define K5_BUILTIN_CMAC
+#endif
+
+#define K5_OPENSSL_AES
+#define K5_OPENSSL_CAMELLIA
+#define K5_OPENSSL_DES
+#define K5_OPENSSL_HMAC
+#define K5_OPENSSL_MD5
+#define K5_OPENSSL_PBKDF2
+#define K5_OPENSSL_SHA1
+#define K5_OPENSSL_SHA2
+
+#else
+
+#define K5_BUILTIN_AES
+#define K5_BUILTIN_CAMELLIA
+#define K5_BUILTIN_CMAC
+#define K5_BUILTIN_DES
+#define K5_BUILTIN_DES_KEY_PARITY
+#define K5_BUILTIN_HMAC
+#define K5_BUILTIN_KDF
+#define K5_BUILTIN_MD4
+#define K5_BUILTIN_MD5
+#define K5_BUILTIN_PBKDF2
+#define K5_BUILTIN_RC4
+#define K5_BUILTIN_SHA1
+#define K5_BUILTIN_SHA2
+
+#endif
+
 /* Enc providers and hash providers specify well-known ciphers and hashes to be
  * implemented by the crypto module. */
 
@@ -276,8 +332,6 @@
 /* Random to key */
 krb5_error_code k5_rand2key_direct(const krb5_data *randombits,
                                    krb5_keyblock *keyblock);
-krb5_error_code k5_rand2key_des(const krb5_data *randombits,
-                                krb5_keyblock *keyblock);
 krb5_error_code k5_rand2key_des3(const krb5_data *randombits,
                                  krb5_keyblock *keyblock);
 
@@ -344,10 +398,6 @@
                                       krb5_key inkey, krb5_data *outrnd,
                                       const krb5_data *in_constant,
                                       enum deriv_alg alg);
-krb5_error_code
-k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash,
-                          krb5_key inkey, krb5_data *outrnd,
-                          const krb5_data *label, const krb5_data *context);
 
 /*** Miscellaneous prototypes ***/
 
@@ -355,13 +405,6 @@
 void krb5int_nfold(unsigned int inbits, const unsigned char *in,
                    unsigned int outbits, unsigned char *out);
 
-/* Compute a CMAC checksum over data. */
-krb5_error_code krb5int_cmac_checksum(const struct krb5_enc_provider *enc,
-                                      krb5_key key,
-                                      const krb5_crypto_iov *data,
-                                      size_t num_data,
-                                      krb5_data *output);
-
 /* Translate an RFC 3961 key usage to a Microsoft RC4 usage. */
 krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage);
 
@@ -445,15 +488,18 @@
 /* Set the parity bits to the correct values in keybits. */
 void k5_des_fixup_key_parity(unsigned char *keybits);
 
-/* Return true if keybits is a weak or semi-weak DES key. */
-krb5_boolean k5_des_is_weak_key(unsigned char *keybits);
-
 /* Compute an HMAC using the provided hash function, key, and data, storing the
  * result into output (caller-allocated). */
 krb5_error_code krb5int_hmac(const struct krb5_hash_provider *hash,
                              krb5_key key, const krb5_crypto_iov *data,
                              size_t num_data, krb5_data *output);
 
+/* Compute a CMAC checksum over data. */
+krb5_error_code krb5int_cmac_checksum(const struct krb5_enc_provider *enc,
+                                      krb5_key key,
+                                      const krb5_crypto_iov *data,
+                                      size_t num_data, krb5_data *output);
+
 /* As above, using a keyblock as the key input. */
 krb5_error_code krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
                                       const krb5_keyblock *keyblock,
@@ -470,64 +516,48 @@
                                     const krb5_data *password,
                                     const krb5_data *salt);
 
-/* The following are used by test programs and are just handler functions from
- * the AES and Camellia enc providers. */
-krb5_error_code krb5int_aes_encrypt(krb5_key key, const krb5_data *ivec,
-                                    krb5_crypto_iov *data, size_t num_data);
-krb5_error_code krb5int_aes_decrypt(krb5_key key, const krb5_data *ivec,
-                                    krb5_crypto_iov *data, size_t num_data);
-krb5_error_code krb5int_camellia_cbc_mac(krb5_key key,
-                                         const krb5_crypto_iov *data,
-                                         size_t num_data, const krb5_data *iv,
-                                         krb5_data *output);
-
-/* These can be used to safely set up and tear down module global state. */
-int krb5int_crypto_impl_init(void);
-void krb5int_crypto_impl_cleanup(void);
-
 /*
- * Modules must provide a crypto_mod.h header at the top level.  To work with
- * the default PRNG module (prng_fortuna.c), crypto_mod.h must #define or
- * prototype the following symbols:
+ * Compute the NIST SP800-108 KDF in counter mode (section 5.1) with the
+ * following parameters:
+ *   - HMAC (with hash as the hash provider) is the PRF.
+ *   - A block counter of four bytes is used.
+ *   - Four bytes are used to encode the output length in the PRF input.
  *
- *   aes_encrypt_ctx - Stack-allocatable type for an AES-256 key schedule
- *   k5_aes_encrypt_key256(key, ctxptr) -- initialize an AES-256 key schedule
- *   k5_aes_encrypt(in, out, ctxptr) -- encrypt a block
- *   SHA256_CTX - Stack-allocatable type for a SHA-256 hash state
- *   k5_sha256_init(ctxptr) - Initialize a hash state
- *   k5_sha256_update(ctxptr, data, size) -- Hash some data
- *   k5_sha256_final(ctxptr, out) -- Finalize a state, writing hash into out
- *
- * These functions must never fail on valid inputs, and contexts must remain
- * valid across forks.  If the module cannot meet those constraints, then it
- * should provide its own PRNG module and the build system should ensure that
- * it is used.
- *
- * The function symbols named above are also in the library export list (so
- * they can be used by the t_fortuna.c test code), so even if the module
- * defines them away or doesn't work with Fortuna, the module must provide
- * stubs; see stubs.c in the openssl module for examples.
+ * There are no uses requiring more than a single PRF invocation.
  */
-
-#include <crypto_mod.h>
-
-/*** PRNG module declarations ***/
+krb5_error_code
+k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash,
+                          krb5_key key, const krb5_data *label,
+                          const krb5_data *context, krb5_data *rnd_out);
 
 /*
- * PRNG modules must implement the following APIs from krb5.h:
- *   krb5_c_random_add_entropy
- *   krb5_c_random_make_octets
- *   krb5_c_random_os_entropy
- *
- * PRNG modules should implement these functions.  They are called from the
- * crypto library init and cleanup functions, and can be used to setup and tear
- * down static state without thread safety concerns.
+ * Compute the NIST SP800-108 KDF in feedback mode (section 5.2) with the
+ * following parameters:
+ *   - CMAC (with enc as the enc provider) is the PRF.
+ *   - A block counter of four bytes is used.
+ *   - Label is the key derivation constant.
+ *   - Context is empty.
+ *   - Four bytes are used to encode the output length in the PRF input.
  */
-int k5_prng_init(void);
-void k5_prng_cleanup(void);
+krb5_error_code
+k5_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, krb5_key key,
+                           const krb5_data *label, krb5_data *rnd_out);
 
-/* Used by PRNG modules to gather OS entropy.  Returns true on success. */
-krb5_boolean k5_get_os_entropy(unsigned char *buf, size_t len, int strong);
+/* Compute the RFC 3961 section 5.1 KDF (which uses n-fold) with enc as E,
+ * inkey as Key, and in_constant as Constant. */
+krb5_error_code
+k5_derive_random_rfc3961(const struct krb5_enc_provider *enc, krb5_key key,
+                         const krb5_data *constant, krb5_data *rnd_out);
+
+/* The following are used by test programs and are just handler functions from
+ * the AES and Camellia enc providers. */
+krb5_error_code krb5int_aes_encrypt(krb5_key key, const krb5_data *ivec,
+                                    krb5_crypto_iov *data, size_t num_data);
+krb5_error_code krb5int_aes_decrypt(krb5_key key, const krb5_data *ivec,
+                                    krb5_crypto_iov *data, size_t num_data);
+krb5_error_code krb5int_camellia_encrypt(krb5_key key, const krb5_data *ivec,
+                                         krb5_crypto_iov *data,
+                                         size_t num_data);
 
 /*** Inline helper functions ***/

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/deps Changed

@@ -3,9 +3,7 @@
 #
 aead.so aead.po $(OUTPRE)aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -16,9 +14,7 @@
 block_size.so block_size.po $(OUTPRE)block_size.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -28,9 +24,7 @@
   block_size.c crypto_int.h
 cf2.so cf2.po $(OUTPRE)cf2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -41,9 +35,7 @@
 checksum_dk_cmac.so checksum_dk_cmac.po $(OUTPRE)checksum_dk_cmac.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -54,9 +46,7 @@
 checksum_dk_hmac.so checksum_dk_hmac.po $(OUTPRE)checksum_dk_hmac.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -67,9 +57,7 @@
 checksum_etm.so checksum_etm.po $(OUTPRE)checksum_etm.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -80,9 +68,7 @@
 checksum_hmac_md5.so checksum_hmac_md5.po $(OUTPRE)checksum_hmac_md5.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -93,9 +79,7 @@
 checksum_unkeyed.so checksum_unkeyed.po $(OUTPRE)checksum_unkeyed.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -106,9 +90,7 @@
 checksum_length.so checksum_length.po $(OUTPRE)checksum_length.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -119,9 +101,7 @@
 cksumtype_to_string.so cksumtype_to_string.po $(OUTPRE)cksumtype_to_string.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -132,9 +112,7 @@
 cksumtypes.so cksumtypes.po $(OUTPRE)cksumtypes.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -142,24 +120,10 @@
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
   cksumtypes.c crypto_int.h
-cmac.so cmac.po $(OUTPRE)cmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h cmac.c crypto_int.h
 coll_proof_cksum.so coll_proof_cksum.po $(OUTPRE)coll_proof_cksum.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -170,9 +134,7 @@
 crypto_length.so crypto_length.po $(OUTPRE)crypto_length.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -180,25 +142,10 @@
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
   crypto_int.h crypto_length.c
-crypto_libinit.so crypto_libinit.po $(OUTPRE)crypto_libinit.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_int.h crypto_libinit.c
 default_state.so default_state.po $(OUTPRE)default_state.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -208,9 +155,7 @@
   crypto_int.h default_state.c
 decrypt.so decrypt.po $(OUTPRE)decrypt.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -221,9 +166,7 @@
 decrypt_iov.so decrypt_iov.po $(OUTPRE)decrypt_iov.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -233,9 +176,7 @@
   crypto_int.h decrypt_iov.c
 derive.so derive.po $(OUTPRE)derive.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -245,9 +186,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h derive.c
 encrypt.so encrypt.po $(OUTPRE)encrypt.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -258,9 +197,7 @@
 encrypt_iov.so encrypt_iov.po $(OUTPRE)encrypt_iov.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -271,9 +208,7 @@
 encrypt_length.so encrypt_length.po $(OUTPRE)encrypt_length.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -284,9 +219,7 @@
 enctype_util.so enctype_util.po $(OUTPRE)enctype_util.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -297,9 +230,7 @@
 enc_dk_cmac.so enc_dk_cmac.po $(OUTPRE)enc_dk_cmac.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -310,9 +241,7 @@
 enc_dk_hmac.so enc_dk_hmac.po $(OUTPRE)enc_dk_hmac.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -322,9 +251,7 @@
   crypto_int.h enc_dk_hmac.c
 enc_etm.so enc_etm.po $(OUTPRE)enc_etm.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -334,9 +261,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h enc_etm.c
 enc_raw.so enc_raw.po $(OUTPRE)enc_raw.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -346,9 +271,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h enc_raw.c
 enc_rc4.so enc_rc4.po $(OUTPRE)enc_rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -358,9 +281,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h enc_rc4.c
 etypes.so etypes.po $(OUTPRE)etypes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -370,9 +291,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h etypes.c
 key.so key.po $(OUTPRE)key.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -383,9 +302,7 @@
 keyblocks.so keyblocks.po $(OUTPRE)keyblocks.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -396,9 +313,7 @@
 keyed_cksum.so keyed_cksum.po $(OUTPRE)keyed_cksum.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -409,9 +324,7 @@
 keyed_checksum_types.so keyed_checksum_types.po $(OUTPRE)keyed_checksum_types.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -422,9 +335,7 @@
 keylengths.so keylengths.po $(OUTPRE)keylengths.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -435,9 +346,7 @@
 make_checksum.so make_checksum.po $(OUTPRE)make_checksum.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -448,9 +357,7 @@
 make_checksum_iov.so make_checksum_iov.po $(OUTPRE)make_checksum_iov.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -461,9 +368,7 @@
 make_random_key.so make_random_key.po $(OUTPRE)make_random_key.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -474,9 +379,7 @@
 mandatory_sumtype.so mandatory_sumtype.po $(OUTPRE)mandatory_sumtype.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -486,9 +389,7 @@
   crypto_int.h mandatory_sumtype.c
 nfold.so nfold.po $(OUTPRE)nfold.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -499,9 +400,7 @@
 old_api_glue.so old_api_glue.po $(OUTPRE)old_api_glue.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -511,9 +410,7 @@
   crypto_int.h old_api_glue.c
 prf.so prf.po $(OUTPRE)prf.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -524,9 +421,7 @@
 prf_aes2.so prf_aes2.po $(OUTPRE)prf_aes2.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -537,9 +432,7 @@
 prf_cmac.so prf_cmac.po $(OUTPRE)prf_cmac.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -549,9 +442,7 @@
   crypto_int.h prf_cmac.c
 prf_des.so prf_des.po $(OUTPRE)prf_des.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -561,9 +452,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h prf_des.c
 prf_dk.so prf_dk.po $(OUTPRE)prf_dk.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -573,9 +462,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h prf_dk.c
 prf_rc4.so prf_rc4.po $(OUTPRE)prf_rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -585,9 +472,7 @@
   $(top_srcdir)/include/socket-utils.h crypto_int.h prf_rc4.c
 prng.so prng.po $(OUTPRE)prng.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -595,25 +480,10 @@
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
   $(top_srcdir)/include/socket-utils.h crypto_int.h prng.c
-prng_fortuna.so prng_fortuna.po $(OUTPRE)prng_fortuna.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_int.h prng_fortuna.c
 random_to_key.so random_to_key.po $(OUTPRE)random_to_key.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -624,9 +494,7 @@
 s2k_pbkdf2.so s2k_pbkdf2.po $(OUTPRE)s2k_pbkdf2.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -636,9 +504,7 @@
   crypto_int.h s2k_pbkdf2.c
 s2k_rc4.so s2k_rc4.po $(OUTPRE)s2k_rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -649,9 +515,7 @@
   crypto_int.h s2k_rc4.c
 state.so state.po $(OUTPRE)state.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-  $(srcdir)/../builtin/aes/brg_types.h $(srcdir)/../builtin/crypto_mod.h \
-  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -662,9 +526,7 @@
 string_to_cksumtype.so string_to_cksumtype.po $(OUTPRE)string_to_cksumtype.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -675,9 +537,7 @@
 string_to_key.so string_to_key.po $(OUTPRE)string_to_key.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -685,25 +545,10 @@
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
   crypto_int.h string_to_key.c
-t_fortuna.so t_fortuna.po $(OUTPRE)t_fortuna.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_int.h prng_fortuna.c t_fortuna.c
 valid_cksumtype.so valid_cksumtype.po $(OUTPRE)valid_cksumtype.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -714,9 +559,7 @@
 verify_checksum.so verify_checksum.po $(OUTPRE)verify_checksum.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
@@ -727,9 +570,7 @@
 verify_checksum_iov.so verify_checksum_iov.po $(OUTPRE)verify_checksum_iov.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/aes/brg_types.h \
-  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
   $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/derive.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/derive.c Changed

@@ -77,185 +77,6 @@
     return ENOMEM;
 }
 
-static krb5_error_code
-derive_random_rfc3961(const struct krb5_enc_provider *enc,
-                      krb5_key inkey, krb5_data *outrnd,
-                      const krb5_data *in_constant)
-{
-    size_t blocksize, keybytes, n;
-    krb5_error_code ret;
-    krb5_data block = empty_data();
-
-    blocksize = enc->block_size;
-    keybytes = enc->keybytes;
-
-    if (blocksize == 1)
-        return KRB5_BAD_ENCTYPE;
-    if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes)
-        return KRB5_CRYPTO_INTERNAL;
-
-    /* Allocate encryption data buffer. */
-    ret = alloc_data(&block, blocksize);
-    if (ret)
-        return ret;
-
-    /* Initialize the input block. */
-    if (in_constant->length == blocksize) {
-        memcpy(block.data, in_constant->data, blocksize);
-    } else {
-        krb5int_nfold(in_constant->length * 8,
-                      (unsigned char *) in_constant->data,
-                      blocksize * 8, (unsigned char *) block.data);
-    }
-
-    /* Loop encrypting the blocks until enough key bytes are generated. */
-    n = 0;
-    while (n < keybytes) {
-        ret = encrypt_block(enc, inkey, &block);
-        if (ret)
-            goto cleanup;
-
-        if ((keybytes - n) <= blocksize) {
-            memcpy(outrnd->data + n, block.data, (keybytes - n));
-            break;
-        }
-
-        memcpy(outrnd->data + n, block.data, blocksize);
-        n += blocksize;
-    }
-
-cleanup:
-    zapfree(block.data, blocksize);
-    return ret;
-}
-
-/*
- * NIST SP800-108 KDF in feedback mode (section 5.2).
- * Parameters:
- *   - CMAC (with enc as the enc provider) is the PRF.
- *   - A block counter of four bytes is used.
- *   - Label is the key derivation constant.
- *   - Context is empty.
- *   - Four bytes are used to encode the output length in the PRF input.
- */
-static krb5_error_code
-derive_random_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc,
-                                      krb5_key inkey, krb5_data *outrnd,
-                                      const krb5_data *in_constant)
-{
-    size_t blocksize, keybytes, n;
-    krb5_crypto_iov iov6;
-    krb5_error_code ret;
-    krb5_data prf;
-    unsigned int i;
-    unsigned char ibuf4, Lbuf4;
-
-    blocksize = enc->block_size;
-    keybytes = enc->keybytes;
-
-    if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes)
-        return KRB5_CRYPTO_INTERNAL;
-
-    /* Allocate encryption data buffer. */
-    ret = alloc_data(&prf, blocksize);
-    if (ret)
-        return ret;
-
-    /* K(i-1): the previous block of PRF output, initially all-zeros. */
-    iov0.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov0.data = prf;
-    /* i2: four-byte big-endian binary string giving the block counter */
-    iov1.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov1.data = make_data(ibuf, sizeof(ibuf));
-    /* Label: the fixed derived-key input */
-    iov2.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov2.data = *in_constant;
-    /* 0x00: separator byte */
-    iov3.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov3.data = make_data("", 1);
-    /* Context: (unused) */
-    iov4.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov4.data = empty_data();
-    /* L2: four-byte big-endian binary string giving the output length */
-    iov5.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov5.data = make_data(Lbuf, sizeof(Lbuf));
-    store_32_be(outrnd->length * 8, Lbuf);
-
-    for (i = 1, n = 0; n < keybytes; i++) {
-        /* Update the block counter. */
-        store_32_be(i, ibuf);
-
-        /* Compute a CMAC checksum, storing the result into K(i-1). */
-        ret = krb5int_cmac_checksum(enc, inkey, iov, 6, &prf);
-        if (ret)
-            goto cleanup;
-
-        /* Copy the result into the appropriate part of the output buffer. */
-        if (keybytes - n <= blocksize) {
-            memcpy(outrnd->data + n, prf.data, keybytes - n);
-            break;
-        }
-        memcpy(outrnd->data + n, prf.data, blocksize);
-        n += blocksize;
-    }
-
-cleanup:
-    zapfree(prf.data, blocksize);
-    return ret;
-}
-
-/*
- * NIST SP800-108 KDF in counter mode (section 5.1).
- * Parameters:
- *   - HMAC (with hash as the hash provider) is the PRF.
- *   - A block counter of four bytes is used.
- *   - Four bytes are used to encode the output length in the PRF input.
- *
- * There are no uses requiring more than a single PRF invocation.
- */
-krb5_error_code
-k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash,
-                          krb5_key inkey, krb5_data *outrnd,
-                          const krb5_data *label, const krb5_data *context)
-{
-    krb5_crypto_iov iov5;
-    krb5_error_code ret;
-    krb5_data prf;
-    unsigned char ibuf4, lbuf4;
-
-    if (hash == NULL || outrnd->length > hash->hashsize)
-        return KRB5_CRYPTO_INTERNAL;
-
-    /* Allocate encryption data buffer. */
-    ret = alloc_data(&prf, hash->hashsize);
-    if (ret)
-        return ret;
-
-    /* i2: four-byte big-endian binary string giving the block counter (1) */
-    iov0.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov0.data = make_data(ibuf, sizeof(ibuf));
-    store_32_be(1, ibuf);
-    /* Label */
-    iov1.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov1.data = *label;
-    /* 0x00: separator byte */
-    iov2.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov2.data = make_data("", 1);
-    /* Context */
-    iov3.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov3.data = *context;
-    /* L2: four-byte big-endian binary string giving the output length */
-    iov4.flags = KRB5_CRYPTO_TYPE_DATA;
-    iov4.data = make_data(lbuf, sizeof(lbuf));
-    store_32_be(outrnd->length * 8, lbuf);
-
-    ret = krb5int_hmac(hash, inkey, iov, 5, &prf);
-    if (!ret)
-        memcpy(outrnd->data, prf.data, outrnd->length);
-    zapfree(prf.data, prf.length);
-    return ret;
-}
-
 krb5_error_code
 krb5int_derive_random(const struct krb5_enc_provider *enc,
                       const struct krb5_hash_provider *hash,
@@ -266,13 +87,12 @@
 
     switch (alg) {
     case DERIVE_RFC3961:
-        return derive_random_rfc3961(enc, inkey, outrnd, in_constant);
+        return k5_derive_random_rfc3961(enc, inkey, in_constant, outrnd);
     case DERIVE_SP800_108_CMAC:
-        return derive_random_sp800_108_feedback_cmac(enc, inkey, outrnd,
-                                                     in_constant);
+        return k5_sp800_108_feedback_cmac(enc, inkey, in_constant, outrnd);
     case DERIVE_SP800_108_HMAC:
-        return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant,
-                                         &empty);
+        return k5_sp800_108_counter_hmac(hash, inkey, in_constant, &empty,
+                                         outrnd);
     default:
         return EINVAL;
     }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/prf_aes2.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/prf_aes2.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/prng.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/prng.c Changed

@@ -35,14 +35,12 @@
 /* Routines to get entropy from the OS. */
 #if defined(_WIN32)
 
-krb5_boolean
-k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
+static krb5_boolean
+get_os_entropy(unsigned char *buf, size_t len)
 {
     krb5_boolean result;
     HCRYPTPROV provider;
 
-    /* CryptGenRandom is always considered strong. */
-
     if (!CryptAcquireContext(&provider, NULL, NULL, PROV_RSA_FULL,
                              CRYPT_VERIFYCONTEXT))
         return FALSE;
@@ -95,10 +93,9 @@
     return result;
 }
 
-krb5_boolean
-k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
+static krb5_boolean
+get_os_entropy(unsigned char *buf, size_t len)
 {
-    const char *device;
 #if defined(__linux__) && defined(SYS_getrandom)
     int r;
 
@@ -127,8 +124,30 @@
         return TRUE;
 #endif /* defined(__linux__) && defined(SYS_getrandom) */
 
-    device = strong ? "/dev/random" : "/dev/urandom";
-    return read_entropy_from_device(device, buf, len);
+    return read_entropy_from_device("/dev/urandom", buf, len);
 }
 
 #endif /* not Windows */
+
+krb5_error_code KRB5_CALLCONV
+krb5_c_random_make_octets(krb5_context context, krb5_data *outdata)
+{
+    krb5_boolean res;
+
+    res = get_os_entropy((uint8_t *)outdata->data, outdata->length);
+    return res ? 0 : KRB5_CRYPTO_INTERNAL;
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5_c_random_add_entropy(krb5_context context, unsigned int randsource,
+                          const krb5_data *indata)
+{
+    return 0;
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5_c_random_os_entropy(krb5_context context, int strong, int *success)
+{
+    *success = 0;
+    return 0;
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/krb/random_to_key.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/krb/random_to_key.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/libk5crypto.exports -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/libk5crypto.exports Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/Makefile.in Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/cmac.c Added

@@ -0,0 +1,93 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* lib/crypto/openssl/cmac.c - OpenSSL CMAC implementation */
+/*
+ * Copyright (C) 2021 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "crypto_int.h"
+
+#ifdef K5_OPENSSL_CMAC
+
+#include <openssl/evp.h>
+#include <openssl/params.h>
+#include <openssl/core_names.h>
+
+krb5_error_code
+krb5int_cmac_checksum(const struct krb5_enc_provider *enc, krb5_key key,
+                      const krb5_crypto_iov *data, size_t num_data,
+                      krb5_data *output)
+{
+    int ok;
+    EVP_MAC *mac = NULL;
+    EVP_MAC_CTX *ctx = NULL;
+    OSSL_PARAM params2, *p = params;
+    size_t i = 0, md_len;
+    char *cipher;
+
+    if (enc == &krb5int_enc_camellia128)
+        cipher = "CAMELLIA-128-CBC";
+    else if (enc == &krb5int_enc_camellia256)
+        cipher = "CAMELLIA-256-CBC";
+    else
+        return KRB5_CRYPTO_INTERNAL;
+
+    mac = EVP_MAC_fetch(NULL, "CMAC", NULL);
+    if (mac == NULL)
+        return KRB5_CRYPTO_INTERNAL;
+
+    ctx = EVP_MAC_CTX_new(mac);
+    if (ctx == NULL) {
+        ok = 0;
+        goto cleanup;
+    }
+
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_CIPHER, cipher, 0);
+    *p = OSSL_PARAM_construct_end();
+
+    ok = EVP_MAC_init(ctx, key->keyblock.contents, key->keyblock.length,
+                      params);
+    for (i = 0; ok && i < num_data; i++) {
+        const krb5_crypto_iov *iov = &datai;
+        if (!SIGN_IOV(iov))
+            continue;
+        ok = EVP_MAC_update(ctx, (uint8_t *)iov->data.data, iov->data.length);
+    }
+    ok = ok && EVP_MAC_final(ctx, (unsigned char *)output->data, &md_len,
+                             output->length);
+    if (!ok)
+        goto cleanup;
+    output->length = md_len;
+
+cleanup:
+    EVP_MAC_free(mac);
+    EVP_MAC_CTX_free(ctx);
+    return ok ? 0 : KRB5_CRYPTO_INTERNAL;
+}
+
+#endif /* K5_OPENSSL_CMAC */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/deps Changed

@@ -1,6 +1,17 @@
 #
 # Generated makefile dependencies follow.
 #
+cmac.so cmac.po $(OUTPRE)cmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  cmac.c
 hmac.so hmac.po $(OUTPRE)hmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
@@ -11,8 +22,8 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_mod.h hmac.c
-init.so init.po $(OUTPRE)init.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  hmac.c
+kdf.so kdf.po $(OUTPRE)kdf.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
@@ -22,7 +33,7 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_mod.h init.c
+  kdf.c
 pbkdf2.so pbkdf2.po $(OUTPRE)pbkdf2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
@@ -33,14 +44,15 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  crypto_mod.h pbkdf2.c
-stubs.so stubs.po $(OUTPRE)stubs.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  pbkdf2.c
+sha256.so sha256.po $(OUTPRE)sha256.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h stubs.c
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  sha256.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/des/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/des/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/des/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/des/deps Changed

@@ -4,12 +4,11 @@
 des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  des_keys.c
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h des_keys.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/des/des_keys.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/des/des_keys.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/enc_provider/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/enc_provider/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/enc_provider/aes.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/enc_provider/aes.c Changed

@@ -25,9 +25,16 @@
  */
 
 #include "crypto_int.h"
+
+#ifdef K5_OPENSSL_AES
+
 #include <openssl/evp.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#else
 #include <openssl/aes.h>
 #include <openssl/modes.h>
+#endif
 
 /* proto's */
 static krb5_error_code
@@ -126,6 +133,90 @@
     return (ret == 1) ? 0 : KRB5_CRYPTO_INTERNAL;
 }
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+static krb5_error_code
+do_cts(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
+       size_t num_data, size_t dlen, int encrypt)
+{
+    krb5_error_code ret;
+    int outlen, len;
+    unsigned char *oblock = NULL, *dbuf = NULL;
+    unsigned char iv_ctsIV_CTS_BUF_SIZE;
+    struct iov_cursor cursor;
+    OSSL_PARAM params2, *p = params;
+    EVP_CIPHER_CTX *ctx = NULL;
+    EVP_CIPHER *cipher = NULL;
+
+    memset(iv_cts, 0, sizeof(iv_cts));
+    if (ivec != NULL && ivec->data != NULL){
+        if (ivec->length != sizeof(iv_cts))
+            return KRB5_CRYPTO_INTERNAL;
+        memcpy(iv_cts, ivec->data, ivec->length);
+    }
+
+    if (key->keyblock.length == 16)
+        cipher = EVP_CIPHER_fetch(NULL, "AES-128-CBC-CTS", NULL);
+    else if (key->keyblock.length == 32)
+        cipher = EVP_CIPHER_fetch(NULL, "AES-256-CBC-CTS", NULL);
+    if (cipher == NULL)
+        return KRB5_CRYPTO_INTERNAL;
+
+    oblock = OPENSSL_malloc(dlen);
+    dbuf = OPENSSL_malloc(dlen);
+    ctx = EVP_CIPHER_CTX_new();
+    if (oblock == NULL || dbuf == NULL || ctx == NULL) {
+        ret = ENOMEM;
+        goto cleanup;
+    }
+
+    k5_iov_cursor_init(&cursor, data, num_data, dlen, FALSE);
+    k5_iov_cursor_get(&cursor, dbuf);
+
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_CIPHER_PARAM_CTS_MODE,
+                                            "CS3", 0);
+    *p = OSSL_PARAM_construct_end();
+    if (!EVP_CipherInit_ex2(ctx, cipher, key->keyblock.contents, iv_cts,
+                            encrypt, params) ||
+        !EVP_CipherUpdate(ctx, oblock, &outlen, dbuf, dlen) ||
+        !EVP_CipherFinal_ex(ctx, oblock + outlen, &len)) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto cleanup;
+    }
+
+    if (ivec != NULL && ivec->data != NULL &&
+        !EVP_CIPHER_CTX_get_updated_iv(ctx, ivec->data, sizeof(iv_cts))) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto cleanup;
+    }
+
+    k5_iov_cursor_put(&cursor, oblock);
+
+    ret = 0;
+cleanup:
+    OPENSSL_clear_free(oblock, dlen);
+    OPENSSL_clear_free(dbuf, dlen);
+    EVP_CIPHER_CTX_free(ctx);
+    EVP_CIPHER_free(cipher);
+    return ret;
+}
+
+static inline krb5_error_code
+cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
+         size_t num_data, size_t dlen)
+{
+    return do_cts(key, ivec, data, num_data, dlen, 1);
+}
+
+static inline krb5_error_code
+cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
+         size_t num_data, size_t dlen)
+{
+    return do_cts(key, ivec, data, num_data, dlen, 0);
+}
+
+#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
 static krb5_error_code
 cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
          size_t num_data, size_t dlen)
@@ -231,6 +322,8 @@
     return ret;
 }
 
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
 krb5_error_code
 krb5int_aes_encrypt(krb5_key key, const krb5_data *ivec,
                     krb5_crypto_iov *data, size_t num_data)
@@ -301,3 +394,5 @@
     krb5int_aes_init_state,
     krb5int_default_free_state
 };
+
+#endif /* K5_OPENSSL_AES */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/enc_provider/camellia.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/enc_provider/camellia.c Changed

@@ -25,9 +25,16 @@
  */
 
 #include "crypto_int.h"
+
+#ifdef K5_OPENSSL_CAMELLIA
+
 #include <openssl/evp.h>
 #include <openssl/camellia.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#else
 #include <openssl/modes.h>
+#endif
 
 static krb5_error_code
 cbc_enc(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
@@ -46,31 +53,6 @@
 #define NUM_BITS 8
 #define IV_CTS_BUF_SIZE 16 /* 16 - hardcoded in CRYPTO_cts128_en/decrypt */
 
-static void
-xorblock(unsigned char *out, const unsigned char *in)
-{
-    int z;
-    for (z = 0; z < CAMELLIA_BLOCK_SIZE / 4; z++) {
-        unsigned char *outptr = &outz * 4;
-        unsigned char *inptr = (unsigned char *)&inz * 4;
-        /*
-         * Use unaligned accesses.  On x86, this will probably still be faster
-         * than multiple byte accesses for unaligned data, and for aligned data
-         * should be far better.  (One test indicated about 2.4% faster
-         * encryption for 1024-byte messages.)
-         *
-         * If some other CPU has really slow unaligned-word or byte accesses,
-         * perhaps this function (or the load/store helpers?) should test for
-         * alignment first.
-         *
-         * If byte accesses are faster than unaligned words, we may need to
-         * conditionalize on CPU type, as that may be hard to determine
-         * automatically.
-         */
-        store_32_n(load_32_n(outptr) ^ load_32_n(inptr), outptr);
-    }
-}
-
 static const EVP_CIPHER *
 map_mode(unsigned int len)
 {
@@ -150,6 +132,90 @@
     return (ret == 1) ? 0 : KRB5_CRYPTO_INTERNAL;
 }
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+static krb5_error_code
+do_cts(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
+       size_t num_data, size_t dlen, int encrypt)
+{
+    krb5_error_code ret;
+    int outlen, len;
+    unsigned char *oblock = NULL, *dbuf = NULL;
+    unsigned char iv_ctsIV_CTS_BUF_SIZE;
+    struct iov_cursor cursor;
+    OSSL_PARAM params2, *p = params;
+    EVP_CIPHER_CTX *ctx = NULL;
+    EVP_CIPHER *cipher = NULL;
+
+    memset(iv_cts, 0, sizeof(iv_cts));
+    if (ivec != NULL && ivec->data != NULL){
+        if (ivec->length != sizeof(iv_cts))
+            return KRB5_CRYPTO_INTERNAL;
+        memcpy(iv_cts, ivec->data, ivec->length);
+    }
+
+    if (key->keyblock.length == 16)
+        cipher = EVP_CIPHER_fetch(NULL, "CAMELLIA-128-CBC-CTS", NULL);
+    else if (key->keyblock.length == 32)
+        cipher = EVP_CIPHER_fetch(NULL, "CAMELLIA-256-CBC-CTS", NULL);
+    if (cipher == NULL)
+        return KRB5_CRYPTO_INTERNAL;
+
+    oblock = OPENSSL_malloc(dlen);
+    dbuf = OPENSSL_malloc(dlen);
+    ctx = EVP_CIPHER_CTX_new();
+    if (oblock == NULL || dbuf == NULL || ctx == NULL) {
+        ret = ENOMEM;
+        goto cleanup;
+    }
+
+    k5_iov_cursor_init(&cursor, data, num_data, dlen, FALSE);
+    k5_iov_cursor_get(&cursor, dbuf);
+
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_CIPHER_PARAM_CTS_MODE,
+                                            "CS3", 0);
+    *p = OSSL_PARAM_construct_end();
+    if (!EVP_CipherInit_ex2(ctx, cipher, key->keyblock.contents, iv_cts,
+                            encrypt, params) ||
+        !EVP_CipherUpdate(ctx, oblock, &outlen, dbuf, dlen) ||
+        !EVP_CipherFinal_ex(ctx, oblock + outlen, &len)) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto cleanup;
+    }
+
+    if (ivec != NULL && ivec->data != NULL &&
+        !EVP_CIPHER_CTX_get_updated_iv(ctx, ivec->data, sizeof(iv_cts))) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto cleanup;
+    }
+
+    k5_iov_cursor_put(&cursor, oblock);
+
+    ret = 0;
+cleanup:
+    OPENSSL_clear_free(oblock, dlen);
+    OPENSSL_clear_free(dbuf, dlen);
+    EVP_CIPHER_CTX_free(ctx);
+    EVP_CIPHER_free(cipher);
+    return ret;
+}
+
+static inline krb5_error_code
+cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
+         size_t num_data, size_t dlen)
+{
+    return do_cts(key, ivec, data, num_data, dlen, 1);
+}
+
+static inline krb5_error_code
+cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
+         size_t num_data, size_t dlen)
+{
+    return do_cts(key, ivec, data, num_data, dlen, 0);
+}
+
+#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
 static krb5_error_code
 cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
          size_t num_data, size_t dlen)
@@ -255,7 +321,9 @@
     return ret;
 }
 
-static krb5_error_code
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+krb5_error_code
 krb5int_camellia_encrypt(krb5_key key, const krb5_data *ivec,
                          krb5_crypto_iov *data, size_t num_data)
 {
@@ -295,7 +363,22 @@
     return ret;
 }
 
-krb5_error_code
+#ifdef K5_BUILTIN_CMAC
+
+static void
+xorblock(uint8_t *out, const uint8_t *in)
+{
+    int z;
+
+    for (z = 0; z < CAMELLIA_BLOCK_SIZE / 4; z++) {
+        uint8_t *outptr = &outz * 4;
+        const uint8_t *inptr = &inz * 4;
+
+        store_32_n(load_32_n(outptr) ^ load_32_n(inptr), outptr);
+    }
+}
+
+static krb5_error_code
 krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
                          size_t num_data, const krb5_data *iv,
                          krb5_data *output)
@@ -327,6 +410,10 @@
     return 0;
 }
 
+#else
+#define krb5int_camellia_cbc_mac NULL
+#endif
+
 static krb5_error_code
 krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage,
                              krb5_data *state)
@@ -343,7 +430,7 @@
     16, 16,
     krb5int_camellia_encrypt,
     krb5int_camellia_decrypt,
-    krb5int_camellia_cbc_mac,
+    krb5int_camellia_cbc_mac,   /* NULL if K5_BUILTIN_CMAC not defined */
     krb5int_camellia_init_state,
     krb5int_default_free_state
 };
@@ -353,7 +440,9 @@
     32, 32,
     krb5int_camellia_encrypt,
     krb5int_camellia_decrypt,
-    krb5int_camellia_cbc_mac,
+    krb5int_camellia_cbc_mac,   /* NULL if K5_BUILTIN_CMAC not defined */
     krb5int_camellia_init_state,
     krb5int_default_free_state
 };
+
+#endif /* K5_OPENSSL_CAMELLIA */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/enc_provider/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/enc_provider/deps Changed

@@ -4,29 +4,17 @@
 des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-  $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h des3.c
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  des3.c
 aes.so aes.po $(OUTPRE)aes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-  $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h aes.c
-camellia.so camellia.po $(OUTPRE)camellia.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \
   $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
   $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -34,15 +22,26 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  camellia.c
-rc4.so rc4.po $(OUTPRE)rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-  $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \
+  aes.c
+camellia.so camellia.po $(OUTPRE)camellia.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
   $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
   $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
   $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h rc4.c
+  $(top_srcdir)/include/socket-utils.h camellia.c
+rc4.so rc4.po $(OUTPRE)rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+  rc4.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/enc_provider/des3.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/enc_provider/des3.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/enc_provider/rc4.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/enc_provider/rc4.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/hash_provider/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/hash_provider/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/hash_provider/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/hash_provider/deps Changed

@@ -4,12 +4,11 @@
 hash_evp.so hash_evp.po $(OUTPRE)hash_evp.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \
-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  hash_evp.c
+  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+  $(top_srcdir)/include/socket-utils.h hash_evp.c

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/hash_provider/hash_evp.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/hash_provider/hash_evp.c Changed

@@ -31,8 +31,19 @@
  */
 
 #include "crypto_int.h"
+
+#if defined(K5_OPENSSL_MD4) || defined(K5_OPENSSL_MD5) ||       \
+    defined(K5_OPENSSL_SHA1) || defined(K5_OPENSSL_SHA2)
+
 #include <openssl/evp.h>
 
+/* 1.1 standardizes constructor and destructor names, renaming
+ * EVP_MD_CTX_create and EVP_MD_CTX_destroy. */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define EVP_MD_CTX_new EVP_MD_CTX_create
+#define EVP_MD_CTX_free EVP_MD_CTX_destroy
+#endif
+
 static krb5_error_code
 hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
          krb5_data *output)
@@ -61,24 +72,45 @@
     return ok ? 0 : KRB5_CRYPTO_INTERNAL;
 }
 
+#endif
+
+#ifdef K5_OPENSSL_MD4
 static krb5_error_code
 hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
 {
     return hash_evp(EVP_md4(), data, num_data, output);
 }
 
+const struct krb5_hash_provider krb5int_hash_md4 = {
+    "MD4", 16, 64, hash_md4
+};
+#endif
+
+#ifdef K5_OPENSSL_MD5
 static krb5_error_code
 hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
 {
     return hash_evp(EVP_md5(), data, num_data, output);
 }
 
+const struct krb5_hash_provider krb5int_hash_md5 = {
+    "MD5", 16, 64, hash_md5
+};
+#endif
+
+#ifdef K5_OPENSSL_SHA1
 static krb5_error_code
 hash_sha1(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
 {
     return hash_evp(EVP_sha1(), data, num_data, output);
 }
 
+const struct krb5_hash_provider krb5int_hash_sha1 = {
+    "SHA1", 20, 64, hash_sha1
+};
+#endif
+
+#ifdef K5_OPENSSL_SHA2
 static krb5_error_code
 hash_sha256(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
 {
@@ -91,18 +123,6 @@
     return hash_evp(EVP_sha384(), data, num_data, output);
 }
 
-const struct krb5_hash_provider krb5int_hash_md4 = {
-    "MD4", 16, 64, hash_md4
-};
-
-const struct krb5_hash_provider krb5int_hash_md5 = {
-    "MD5", 16, 64, hash_md5
-};
-
-const struct krb5_hash_provider krb5int_hash_sha1 = {
-    "SHA1", 20, 64, hash_sha1
-};
-
 const struct krb5_hash_provider krb5int_hash_sha256 = {
     "SHA-256", 32, 64, hash_sha256
 };
@@ -110,3 +130,4 @@
 const struct krb5_hash_provider krb5int_hash_sha384 = {
     "SHA-384", 48, 128, hash_sha384
 };
+#endif

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/hmac.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/hmac.c Changed

@@ -52,8 +52,16 @@
 
 
 #include "crypto_int.h"
-#include <openssl/hmac.h>
+
+#ifdef K5_OPENSSL_HMAC
+
 #include <openssl/evp.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/params.h>
+#include <openssl/core_names.h>
+#else
+#include <openssl/hmac.h>
+#endif
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 
@@ -97,20 +105,75 @@
 static const EVP_MD *
 map_digest(const struct krb5_hash_provider *hash)
 {
-    if (!strncmp(hash->hash_name, "SHA1",4))
+    if (hash == &krb5int_hash_sha1)
         return EVP_sha1();
-    else if (!strncmp(hash->hash_name, "SHA-256",7))
+    else if (hash == &krb5int_hash_sha256)
         return EVP_sha256();
-    else if (!strncmp(hash->hash_name, "SHA-384",7))
+    else if (hash == &krb5int_hash_sha384)
         return EVP_sha384();
-    else if (!strncmp(hash->hash_name, "MD5", 3))
+    else if (hash == &krb5int_hash_md5)
         return EVP_md5();
-    else if (!strncmp(hash->hash_name, "MD4", 3))
+    else if (hash == &krb5int_hash_md4)
         return EVP_md4();
     else
         return NULL;
 }
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+krb5_error_code
+krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
+                      const krb5_keyblock *keyblock,
+                      const krb5_crypto_iov *data, size_t num_data,
+                      krb5_data *output)
+{
+    int ok;
+    const EVP_MD *md = map_digest(hash);
+    EVP_MAC *mac = NULL;
+    EVP_MAC_CTX *ctx = NULL;
+    OSSL_PARAM params2, *p = params;
+    size_t i = 0, md_len;
+
+    if (md == NULL || keyblock->length > hash->blocksize)
+        return KRB5_CRYPTO_INTERNAL;
+    if (output->length < hash->hashsize)
+        return KRB5_BAD_MSIZE;
+
+    mac = EVP_MAC_fetch(NULL, "HMAC", NULL);
+    if (mac == NULL)
+        return KRB5_CRYPTO_INTERNAL;
+
+    ctx = EVP_MAC_CTX_new(mac);
+    if (ctx == NULL) {
+        ok = 0;
+        goto cleanup;
+    }
+
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
+                                            (char *)EVP_MD_get0_name(md), 0);
+    *p = OSSL_PARAM_construct_end();
+
+    ok = EVP_MAC_init(ctx, keyblock->contents, keyblock->length, params);
+    for (i = 0; ok && i < num_data; i++) {
+        const krb5_crypto_iov *iov = &datai;
+        if (!SIGN_IOV(iov))
+            continue;
+        ok = EVP_MAC_update(ctx, (uint8_t *)iov->data.data, iov->data.length);
+    }
+    ok = ok && EVP_MAC_final(ctx, (uint8_t *)output->data, &md_len,
+                             output->length);
+    if (!ok)
+        goto cleanup;
+    output->length = md_len;
+
+cleanup:
+    EVP_MAC_free(mac);
+    EVP_MAC_CTX_free(ctx);
+    return ok ? 0 : KRB5_CRYPTO_INTERNAL;
+}
+
+#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
 krb5_error_code
 krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
                       const krb5_keyblock *keyblock,
@@ -155,6 +218,8 @@
     return ok ? 0 : KRB5_CRYPTO_INTERNAL;
 }
 
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
 krb5_error_code
 krb5int_hmac(const struct krb5_hash_provider *hash, krb5_key key,
              const krb5_crypto_iov *data, size_t num_data,
@@ -162,3 +227,5 @@
 {
     return krb5int_hmac_keyblock(hash, &key->keyblock, data, num_data, output);
 }
+
+#endif /* K5_OPENSSL_HMAC */

_service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/kdf.c Added

@@ -0,0 +1,237 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ * Copyright (C) 2021 by Red Hat, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "crypto_int.h"
+
+#ifdef K5_OPENSSL_KDF
+
+#include <openssl/core_names.h>
+#include <openssl/evp.h>
+#include <openssl/kdf.h>
+
+static char *
+hash_name(const struct krb5_hash_provider *hash)
+{
+    if (hash == &krb5int_hash_sha1)
+        return "SHA1";
+    if (hash == &krb5int_hash_sha256)
+        return "SHA256";
+    if (hash == &krb5int_hash_sha384)
+        return "SHA384";
+    return NULL;
+}
+
+static char *
+enc_name(const struct krb5_enc_provider *enc)
+{
+    if (enc == &krb5int_enc_camellia128)
+        return "CAMELLIA-128-CBC";
+    if (enc == &krb5int_enc_camellia256)
+        return "CAMELLIA-256-CBC";
+    if (enc == &krb5int_enc_aes128)
+        return "AES-128-CBC";
+    if (enc == &krb5int_enc_aes256)
+        return "AES-256-CBC";
+    if (enc == &krb5int_enc_des3)
+        return "DES-EDE3-CBC";
+    return NULL;
+}
+
+krb5_error_code
+k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash,
+                          krb5_key key, const krb5_data *label,
+                          const krb5_data *context, krb5_data *rnd_out)
+{
+    krb5_error_code ret;
+    EVP_KDF *kdf = NULL;
+    EVP_KDF_CTX *kctx = NULL;
+    OSSL_PARAM params6, *p = params;
+    char *digest;
+
+    digest = hash_name(hash);
+    if (digest == NULL) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
+    if (!kdf) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    kctx = EVP_KDF_CTX_new(kdf);
+    if (!kctx) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, digest, 0);
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
+                                            OSSL_MAC_NAME_HMAC, 0);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
+                                             key->keyblock.contents,
+                                             key->keyblock.length);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
+                                             context->data, context->length);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
+                                             label->data, label->length);
+    *p = OSSL_PARAM_construct_end();
+    if (EVP_KDF_derive(kctx, (uint8_t *)rnd_out->data, rnd_out->length,
+                       params) <= 0) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    ret = 0;
+done:
+    if (ret)
+        zap(rnd_out->data, rnd_out->length);
+    EVP_KDF_free(kdf);
+    EVP_KDF_CTX_free(kctx);
+    return ret;
+}
+
+krb5_error_code
+k5_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, krb5_key key,
+                           const krb5_data *label, krb5_data *rnd_out)
+{
+    krb5_error_code ret;
+    EVP_KDF *kdf = NULL;
+    EVP_KDF_CTX *kctx = NULL;
+    OSSL_PARAM params7, *p = params;
+    char *cipher;
+    static uint8_t zeroes16;
+
+    memset(zeroes, 0, sizeof(zeroes));
+
+    cipher = enc_name(enc);
+    if (cipher == NULL) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
+    if (!kdf) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    kctx = EVP_KDF_CTX_new(kdf);
+    if (!kctx) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
+                                            "FEEDBACK", 0);
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
+                                            OSSL_MAC_NAME_CMAC, 0);
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, cipher, 0);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
+                                             key->keyblock.contents,
+                                             key->keyblock.length);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
+                                             label->data, label->length);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
+                                             zeroes, sizeof(zeroes));
+    *p = OSSL_PARAM_construct_end();
+    if (EVP_KDF_derive(kctx, (uint8_t *)rnd_out->data, rnd_out->length,
+                       params) <= 0) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    ret = 0;
+done:
+    if (ret)
+        zap(rnd_out->data, rnd_out->length);
+    EVP_KDF_free(kdf);
+    EVP_KDF_CTX_free(kctx);
+    return ret;
+}
+
+krb5_error_code
+k5_derive_random_rfc3961(const struct krb5_enc_provider *enc, krb5_key key,
+                         const krb5_data *constant, krb5_data *rnd_out)
+{
+    krb5_error_code ret;
+    EVP_KDF *kdf = NULL;
+    EVP_KDF_CTX *kctx = NULL;
+    OSSL_PARAM params4, *p = params;
+    char *cipher;
+
+    if (key->keyblock.length != enc->keylength ||
+        rnd_out->length != enc->keybytes) {
+        return KRB5_CRYPTO_INTERNAL;
+    }
+
+    cipher = enc_name(enc);
+    if (cipher == NULL) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    kdf = EVP_KDF_fetch(NULL, "KRB5KDF", NULL);
+    if (kdf == NULL) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    kctx = EVP_KDF_CTX_new(kdf);
+    if (kctx == NULL) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, cipher, 0);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
+                                             key->keyblock.contents,
+                                             key->keyblock.length);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT,
+                                             constant->data, constant->length);
+    *p = OSSL_PARAM_construct_end();
+    if (EVP_KDF_derive(kctx, (uint8_t *)rnd_out->data, rnd_out->length,
+                       params) <= 0) {
+        ret = KRB5_CRYPTO_INTERNAL;
+        goto done;
+    }
+
+    ret = 0;
+done:
+    if (ret)
+        zap(rnd_out->data, rnd_out->length);
+    EVP_KDF_free(kdf);
+    EVP_KDF_CTX_free(kctx);
+    return ret;
+}
+
+#endif /* K5_OPENSSL_KDF */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/pbkdf2.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/pbkdf2.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/crypto/openssl/sha256.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/crypto/openssl/sha256.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/accept_sec_context.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/accept_sec_context.c Changed

@@ -683,7 +683,6 @@
     krb5_flags ap_req_options = 0;
     krb5_enctype negotiated_etype;
     krb5_authdata_context ad_context = NULL;
-    krb5_principal accprinc = NULL;
     krb5_ap_req *request = NULL;
 
     code = krb5int_accessor (&kaccess, KRB5INT_ACCESS_VERSION);
@@ -849,17 +848,9 @@
         }
     }
 
-    if (!cred->default_identity) {
-        if ((code = kg_acceptor_princ(context, cred->name, &accprinc))) {
-            major_status = GSS_S_FAILURE;
-            goto fail;
-        }
-    }
-
-    code = krb5_rd_req_decoded(context, &auth_context, request, accprinc,
-                               cred->keytab, &ap_req_options, NULL);
-
-    krb5_free_principal(context, accprinc);
+    code = krb5_rd_req_decoded(context, &auth_context, request,
+                               cred->acceptor_mprinc, cred->keytab,
+                               &ap_req_options, NULL);
     if (code) {
         major_status = GSS_S_FAILURE;
         goto fail;
@@ -991,7 +982,7 @@
     {
         krb5_int32 seq_temp;
         krb5_auth_con_getremoteseqnumber(context, auth_context, &seq_temp);
-        ctx->seq_recv = seq_temp;
+        ctx->seq_recv = (uint32_t)seq_temp;
     }
 
     if ((code = krb5_timeofday(context, &now))) {
@@ -1074,7 +1065,7 @@
         }
 
         krb5_auth_con_getlocalseqnumber(context, auth_context, &seq_temp);
-        ctx->seq_send = seq_temp & 0xffffffffL;
+        ctx->seq_send = (uint32_t)seq_temp;
 
         if (cfx_generate_subkey) {
             /* Get the new acceptor subkey.  With the code above, there

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/acquire_cred.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/acquire_cred.c Changed

@@ -123,11 +123,11 @@
 /* Try to verify that keytab contains at least one entry for name.  Return 0 if
  * it does, KRB5_KT_NOTFOUND if it doesn't, or another error as appropriate. */
 static krb5_error_code
-check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name)
+check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name,
+             krb5_principal mprinc)
 {
     krb5_error_code code;
     krb5_keytab_entry ent;
-    krb5_principal accprinc = NULL;
     char *princname;
 
     if (name->service == NULL) {
@@ -141,21 +141,15 @@
     if (kt->ops->start_seq_get == NULL)
         return 0;
 
-    /* Get the partial principal for the acceptor name. */
-    code = kg_acceptor_princ(context, name, &accprinc);
-    if (code)
-        return code;
-
-    /* Scan the keytab for host-based entries matching accprinc. */
-    code = k5_kt_have_match(context, kt, accprinc);
+    /* Scan the keytab for host-based entries matching mprinc. */
+    code = k5_kt_have_match(context, kt, mprinc);
     if (code == KRB5_KT_NOTFOUND) {
-        if (krb5_unparse_name(context, accprinc, &princname) == 0) {
+        if (krb5_unparse_name(context, mprinc, &princname) == 0) {
             k5_setmsg(context, code, _("No key table entry found matching %s"),
                       princname);
             free(princname);
         }
     }
-    krb5_free_principal(context, accprinc);
     return code;
 }
 
@@ -202,8 +196,14 @@
     }
 
     if (cred->name != NULL) {
+        code = kg_acceptor_princ(context, cred->name, &cred->acceptor_mprinc);
+        if (code) {
+            major = GSS_S_FAILURE;
+            goto cleanup;
+        }
+
         /* Make sure we have keys matching the desired name in the keytab. */
-        code = check_keytab(context, kt, cred->name);
+        code = check_keytab(context, kt, cred->name, cred->acceptor_mprinc);
         if (code) {
             if (code == KRB5_KT_NOTFOUND) {
                 k5_change_error_message_code(context, code, KG_KEYTAB_NOMATCH);
@@ -324,7 +324,6 @@
 can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred)
 {
     krb5_error_code code;
-    krb5_keytab_entry entry;
 
     if (cred->password != NULL)
         return TRUE;
@@ -336,20 +335,21 @@
     if (cred->name == NULL)
         return !krb5_kt_have_content(context, cred->client_keytab);
 
-    /* Check if we have a keytab key for the client principal. */
-    code = krb5_kt_get_entry(context, cred->client_keytab, cred->name->princ,
-                             0, 0, &entry);
-    if (code) {
-        krb5_clear_error_message(context);
-        return FALSE;
-    }
-    krb5_free_keytab_entry_contents(context, &entry);
-    return TRUE;
+    /*
+     * Check if we have a keytab key for the client principal.  This is a bit
+     * more permissive than we really want because krb5_kt_have_match()
+     * supports wildcarding and obeys ignore_acceptor_hostname, but that should
+     * generally be harmless.
+     */
+    code = k5_kt_have_match(context, cred->client_keytab, cred->name->princ);
+    return code == 0;
 }
 
-/* Scan cred->ccache for name, expiry time, impersonator, refresh time. */
+/* Scan cred->ccache for name, expiry time, impersonator, refresh time.  If
+ * check_name is true, verify the cache name against the credential name. */
 static krb5_error_code
-scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred)
+scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred,
+            krb5_boolean check_name)
 {
     krb5_error_code code;
     krb5_ccache ccache = cred->ccache;
@@ -365,23 +365,31 @@
     if (code)
         return code;
 
-    /* Credentials cache principal must match the initiator name. */
     code = krb5_cc_get_principal(context, ccache, &ccache_princ);
     if (code != 0)
         goto cleanup;
-    if (cred->name != NULL &&
-        !krb5_principal_compare(context, ccache_princ, cred->name->princ)) {
-        code = KG_CCACHE_NOMATCH;
-        goto cleanup;
-    }
 
-    /* Save the ccache principal as the credential name if not already set. */
-    if (!cred->name) {
+    if (cred->name == NULL) {
+        /* Save the ccache principal as the credential name. */
         code = kg_init_name(context, ccache_princ, NULL, NULL, NULL,
                             KG_INIT_NAME_NO_COPY, &cred->name);
         if (code)
             goto cleanup;
         ccache_princ = NULL;
+    } else {
+        /* Check against the desired name if needed. */
+        if (check_name) {
+            if (!k5_sname_compare(context, cred->name->princ, ccache_princ)) {
+                code = KG_CCACHE_NOMATCH;
+                goto cleanup;
+            }
+        }
+
+        /* Replace the credential name principal with the canonical client
+         * principal, retaining acceptor_mprinc if set. */
+        krb5_free_principal(context, cred->name->princ);
+        cred->name->princ = ccache_princ;
+        ccache_princ = NULL;
     }
 
     assert(cred->name->princ != NULL);
@@ -447,7 +455,7 @@
     assert(cred->name != NULL && cred->ccache == NULL);
 #ifdef USE_LEASH
     code = get_ccache_leash(context, cred->name->princ, &cred->ccache);
-    return code ? code : scan_ccache(context, cred);
+    return code ? code : scan_ccache(context, cred, TRUE);
 #else
     /* Check first whether we can acquire tickets, to avoid overwriting the
      * extended error message from krb5_cc_cache_match. */
@@ -456,7 +464,7 @@
     /* Look for an existing cache for the client principal. */
     code = krb5_cc_cache_match(context, cred->name->princ, &cred->ccache);
     if (code == 0)
-        return scan_ccache(context, cred);
+        return scan_ccache(context, cred, FALSE);
     if (code != KRB5_CC_NOTFOUND || !can_get)
         return code;
     krb5_clear_error_message(context);
@@ -633,6 +641,13 @@
     kg_cred_set_initial_refresh(context, cred, &creds.times);
     cred->have_tgt = TRUE;
     cred->expire = creds.times.endtime;
+
+    /* Steal the canonical client principal name from creds and save it in the
+     * credential name, retaining acceptor_mprinc if set. */
+    krb5_free_principal(context, cred->name->princ);
+    cred->name->princ = creds.client;
+    creds.client = NULL;
+
     krb5_free_cred_contents(context, &creds);
 cleanup:
     krb5_get_init_creds_opt_free(context, opt);
@@ -721,7 +736,7 @@
 
     if (cred->ccache != NULL) {
         /* The caller specified a ccache; check what's in it. */
-        code = scan_ccache(context, cred);
+        code = scan_ccache(context, cred, TRUE);
         if (code == KRB5_FCC_NOFILE) {
             /* See if we can get initial creds.  If the caller didn't specify
              * a name, pick one from the client keytab. */
@@ -984,7 +999,7 @@
             }
         }
         if (cred->ccache != NULL) {
-            code = scan_ccache(context, cred);
+            code = scan_ccache(context, cred, FALSE);
             if (code)
                 goto kerr;
         }
@@ -996,7 +1011,7 @@
         code = krb5int_cc_default(context, &cred->ccache);
         if (code)
             goto kerr;
-        code = scan_ccache(context, cred);
+        code = scan_ccache(context, cred, FALSE);
         if (code == KRB5_FCC_NOFILE) {
             /* Default ccache doesn't exist; fall through to client keytab. */
             krb5_cc_close(context, cred->ccache);

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/gssapiP_krb5.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/gssapiP_krb5.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/gssapi_krb5.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/gssapi_krb5.c Changed

@@ -253,46 +253,31 @@
 }
 
 OM_uint32
-kg_get_ccache_name (OM_uint32 *minor_status, const char **out_name)
+kg_get_ccache_name(OM_uint32 *minor_status, char **out_name)
 {
-    const char *name = NULL;
-    OM_uint32 err = 0;
     char *kg_ccache_name;
+    const char *def_name;
+    OM_uint32 err;
+    krb5_context context;
 
-    kg_ccache_name = k5_getspecific(K5_KEY_GSS_KRB5_CCACHE_NAME);
+    *out_name = NULL;
 
+    kg_ccache_name = k5_getspecific(K5_KEY_GSS_KRB5_CCACHE_NAME);
     if (kg_ccache_name != NULL) {
-        name = strdup(kg_ccache_name);
-        if (name == NULL)
-            err = ENOMEM;
+        *out_name = strdup(kg_ccache_name);
+        err = (*out_name == NULL) ? ENOMEM : 0;
     } else {
-        krb5_context context = NULL;
-
-        /* Reset the context default ccache (see text above), and then
-           retrieve it.  */
+        /* Use the default ccache name. */
         err = krb5_gss_init_context(&context);
-        if (!err)
-            err = krb5_cc_set_default_name (context, NULL);
-        if (!err) {
-            name = krb5_cc_default_name(context);
-            if (name) {
-                name = strdup(name);
-                if (name == NULL)
-                    err = ENOMEM;
-            }
-        }
-        if (err && context)
-            save_error_info(err, context);
-        if (context)
-            krb5_free_context(context);
-    }
-
-    if (!err) {
-        if (out_name) {
-            *out_name = name;
-        }
+        if (err)
+            goto cleanup;
+        def_name = krb5_cc_default_name(context);
+        *out_name = (def_name != NULL) ? strdup(def_name) : NULL;
+        err = (*out_name == NULL) ? ENOMEM : 0;
+        krb5_free_context(context);
     }
 
+cleanup:
     *minor_status = err;
     return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/init_sec_context.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/init_sec_context.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/inq_cred.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/inq_cred.c Changed

@@ -127,7 +127,7 @@
     if ((code = krb5_timeofday(context, &now))) {
         *minor_status = code;
         ret = GSS_S_FAILURE;
-        goto fail;
+        goto cleanup;
     }
 
     if (cred->expire != 0) {
@@ -158,7 +158,7 @@
             *minor_status = code;
             save_error_info(*minor_status, context);
             ret = GSS_S_FAILURE;
-            goto fail;
+            goto cleanup;
         }
     }
 
@@ -174,7 +174,7 @@
             if (ret_name)
                 kg_release_name(context, &ret_name);
             /* *minor_status set above */
-            goto fail;
+            goto cleanup;
         }
     }
 
@@ -190,18 +190,16 @@
 
     if (cred_usage)
         *cred_usage = cred->usage;
-    k5_mutex_unlock(&cred->lock);
 
     if (mechanisms) {
         *mechanisms = mechs;
         mechs = GSS_C_NO_OID_SET;
     }
 
-    krb5_gss_release_cred(minor_status, &defcred);
-    krb5_free_context(context);
     *minor_status = 0;
-    return((lifetime == 0)?GSS_S_CREDENTIALS_EXPIRED:GSS_S_COMPLETE);
-fail:
+    ret = (lifetime == 0) ? GSS_S_CREDENTIALS_EXPIRED : GSS_S_COMPLETE;
+
+cleanup:
     k5_mutex_unlock(&cred->lock);
     krb5_gss_release_cred(&tmpmin, &defcred);
     krb5_free_context(context);

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/rel_cred.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/rel_cred.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/set_ccache.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/set_ccache.c Changed

@@ -26,7 +26,7 @@
 
 /*
  * Set ccache name used by gssapi, and optionally obtain old ccache
- * name.  Caller should not free returned name.
+ * name.  Caller must not free returned name.
  */
 
 #include <string.h>
@@ -38,11 +38,9 @@
                         const gss_OID desired_object,
                         const gss_buffer_t value)
 {
-    char *old_name = NULL;
     OM_uint32 err = 0;
-    OM_uint32 minor = 0;
-    char *gss_out_name;
     struct krb5_gss_ccache_name_req *req;
+    char *old_name, *cur_name = NULL;
 
     err = gss_krb5int_initialize_library();
     if (err) {
@@ -57,45 +55,33 @@
 
     req = (struct krb5_gss_ccache_name_req *)value->value;
 
-    gss_out_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME);
+    /* Our job is simple if the caller doesn't want the current name. */
+    if (req->out_name == NULL)
+        return kg_set_ccache_name(minor_status, req->name);
 
-    if (req->out_name) {
-        const char *tmp_name = NULL;
+    /* Fetch the current name and change it. */
+    kg_get_ccache_name(&err, &cur_name);
+    if (err)
+        goto cleanup;
+    kg_set_ccache_name(&err, req->name);
+    if (err)
+        goto cleanup;
 
-        if (!err) {
-            kg_get_ccache_name (&err, &tmp_name);
-        }
-        if (!err) {
-            old_name = gss_out_name;
-            gss_out_name = (char *)tmp_name;
-        }
-    }
-    /* If out_name was NULL, we keep the same gss_out_name value, and
-       don't free up any storage (leave old_name NULL).  */
-
-    if (!err)
-        kg_set_ccache_name (&err, req->name);
-
-    minor = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, gss_out_name);
-    if (minor) {
-        /* Um.  Now what?  */
-        if (err == 0) {
-            err = minor;
-        }
-        free(gss_out_name);
-        gss_out_name = NULL;
-    }
+    /* Store the current name in a thread-specific variable.  Free that
+     * variable's previous contents. */
+    old_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME);
+    err = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, cur_name);
+    if (err)
+        goto cleanup;
+    free(old_name);
 
-    if (!err) {
-        if (req->out_name) {
-            *(req->out_name) = gss_out_name;
-        }
-    }
-
-    if (old_name != NULL) {
-        free (old_name);
-    }
+    /* Give the caller an alias to the stored value. */
+    *req->out_name = cur_name;
+    cur_name = NULL;
+    err = 0;
 
+cleanup:
+    free(cur_name);
     *minor_status = err;
     return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/krb5/store_cred.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/krb5/store_cred.c Changed

@@ -27,36 +27,6 @@
 #include "k5-int.h"
 #include "gssapiP_krb5.h"
 
-static int
-has_unexpired_creds(krb5_gss_cred_id_t kcred,
-                    const gss_OID desired_mech,
-                    int default_cred,
-                    gss_const_key_value_set_t cred_store)
-{
-    OM_uint32 major_status, minor;
-    gss_name_t cred_name;
-    gss_OID_set_desc desired_mechs;
-    gss_cred_id_t tmp_cred = GSS_C_NO_CREDENTIAL;
-    OM_uint32 time_rec;
-
-    desired_mechs.count = 1;
-    desired_mechs.elements = (gss_OID)desired_mech;
-
-    if (default_cred)
-        cred_name = GSS_C_NO_NAME;
-    else
-        cred_name = (gss_name_t)kcred->name;
-
-    major_status = krb5_gss_acquire_cred_from(&minor, cred_name, 0,
-                                              &desired_mechs, GSS_C_INITIATE,
-                                              cred_store, &tmp_cred, NULL,
-                                              &time_rec);
-
-    krb5_gss_release_cred(&minor, &tmp_cred);
-
-    return (GSS_ERROR(major_status) || time_rec);
-}
-
 static OM_uint32
 copy_initiator_creds(OM_uint32 *minor_status,
                      gss_cred_id_t input_cred_handle,
@@ -66,26 +36,19 @@
                      gss_const_key_value_set_t cred_store)
 {
     OM_uint32 major_status;
-    krb5_error_code code;
+    krb5_error_code ret;
     krb5_gss_cred_id_t kcred = NULL;
     krb5_context context = NULL;
-    krb5_ccache ccache = NULL;
-    const char *ccache_name;
+    krb5_ccache cache = NULL, defcache = NULL, mcc = NULL;
+    krb5_principal princ = NULL;
+    krb5_boolean switch_to_cache = FALSE;
+    const char *ccache_name, *deftype;
 
     *minor_status = 0;
 
-    if (!default_cred && cred_store == GSS_C_NO_CRED_STORE) {
-        *minor_status = G_STORE_NON_DEFAULT_CRED_NOSUPP;
-        major_status = GSS_S_FAILURE;
-        goto cleanup;
-    }
-
-    code = krb5_gss_init_context(&context);
-    if (code != 0) {
-        *minor_status = code;
-        major_status = GSS_S_FAILURE;
-        goto cleanup;
-    }
+    ret = krb5_gss_init_context(&context);
+    if (ret)
+        goto kerr_cleanup;
 
     major_status = krb5_gss_validate_cred_1(minor_status,
                                             input_cred_handle,
@@ -101,52 +64,69 @@
         goto cleanup;
     }
 
-    if (!overwrite_cred &&
-        has_unexpired_creds(kcred, desired_mech, default_cred, cred_store)) {
-        major_status = GSS_S_DUPLICATE_ELEMENT;
-        goto cleanup;
-    }
-
     major_status = kg_value_from_cred_store(cred_store,
                                             KRB5_CS_CCACHE_URN, &ccache_name);
     if (GSS_ERROR(major_status))
         goto cleanup;
 
     if (ccache_name != NULL) {
-        code = krb5_cc_resolve(context, ccache_name, &ccache);
-        if (code != 0) {
-            *minor_status = code;
-            major_status = GSS_S_FAILURE;
+        ret = krb5_cc_set_default_name(context, ccache_name);
+        if (ret)
+            goto kerr_cleanup;
+    } else {
+        major_status = kg_sync_ccache_name(context, minor_status);
+        if (major_status != GSS_S_COMPLETE)
             goto cleanup;
-        }
-        code = krb5_cc_initialize(context, ccache,
-                                  kcred->name->princ);
-        if (code != 0) {
-            *minor_status = code;
-            major_status = GSS_S_FAILURE;
-            goto cleanup;
-        }
     }
 
-    if (ccache == NULL) {
-        if (!default_cred) {
-            *minor_status = G_STORE_NON_DEFAULT_CRED_NOSUPP;
-            major_status = GSS_S_FAILURE;
+    /* Resolve the default ccache and get its type. */
+    ret = krb5_cc_default(context, &defcache);
+    if (ret)
+        goto kerr_cleanup;
+    deftype = krb5_cc_get_type(context, defcache);
+
+    if (krb5_cc_support_switch(context, deftype)) {
+        /* Use an existing or new cache within the collection. */
+        ret = krb5_cc_cache_match(context, kcred->name->princ, &cache);
+        if (!ret && !overwrite_cred) {
+            major_status = GSS_S_DUPLICATE_ELEMENT;
             goto cleanup;
         }
-        code = krb5int_cc_default(context, &ccache);
-        if (code != 0) {
-            *minor_status = code;
-            major_status = GSS_S_FAILURE;
+        if (ret == KRB5_CC_NOTFOUND)
+            ret = krb5_cc_new_unique(context, deftype, NULL, &cache);
+        if (ret)
+            goto kerr_cleanup;
+        switch_to_cache = default_cred;
+    } else {
+        /* Use the default cache. */
+        cache = defcache;
+        defcache = NULL;
+        ret = krb5_cc_get_principal(context, cache, &princ);
+        krb5_free_principal(context, princ);
+        if (!ret && !overwrite_cred) {
+            major_status = GSS_S_DUPLICATE_ELEMENT;
             goto cleanup;
         }
     }
 
-    code = krb5_cc_copy_creds(context, kcred->ccache, ccache);
-    if (code != 0) {
-        *minor_status = code;
-        major_status = GSS_S_FAILURE;
-        goto cleanup;
+    ret = krb5_cc_new_unique(context, "MEMORY", NULL, &mcc);
+    if (ret)
+        goto kerr_cleanup;
+    ret = krb5_cc_initialize(context, mcc, kcred->name->princ);
+    if (ret)
+        goto kerr_cleanup;
+    ret = krb5_cc_copy_creds(context, kcred->ccache, mcc);
+    if (ret)
+        goto kerr_cleanup;
+    ret = krb5_cc_move(context, mcc, cache);
+    if (ret)
+        goto kerr_cleanup;
+    mcc = NULL;
+
+    if (switch_to_cache) {
+        ret = krb5_cc_switch(context, cache);
+        if (ret)
+            goto kerr_cleanup;
     }
 
     *minor_status = 0;
@@ -155,11 +135,20 @@
 cleanup:
     if (kcred != NULL)
         k5_mutex_unlock(&kcred->lock);
-    if (ccache != NULL)
-        krb5_cc_close(context, ccache);
+    if (defcache != NULL)
+        krb5_cc_close(context, defcache);
+    if (cache != NULL)
+        krb5_cc_close(context, cache);
+    if (mcc != NULL)
+        krb5_cc_destroy(context, mcc);
     krb5_free_context(context);
 
     return major_status;
+
+kerr_cleanup:
+    *minor_status = ret;
+    major_status = GSS_S_FAILURE;
+    goto cleanup;
 }
 
 OM_uint32 KRB5_CALLCONV

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/mechglue/g_initialize.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/mechglue/g_initialize.c Changed

@@ -93,7 +93,7 @@
 static gss_mech_info g_mechList = NULL;
 static gss_mech_info g_mechListTail = NULL;
 static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER;
-static time_t g_confFileModTime = (time_t)0;
+static time_t g_confFileModTime = (time_t)-1;
 static time_t g_confLastCall = (time_t)0;
 
 static gss_OID_set_desc g_mechSet = { 0, NULL };
@@ -469,9 +469,9 @@
 	mtime = check_link_mtime(pathname, &mtime);
 	if (mtime == (time_t)-1)
 		return;
-	if (mtime > *highest)
+	if (mtime > *highest || *highest == (time_t)-1)
 		*highest = mtime;
-	if (mtime > last)
+	if (mtime > last || last == (time_t)-1)
 		loadConfigFile(pathname);
 }
 
@@ -482,7 +482,7 @@
 loadConfigFiles()
 {
 	glob_t globbuf;
-	time_t highest = 0, now;
+	time_t highest = (time_t)-1, now;
 	char **path;
 	const char *val;
 
@@ -522,7 +522,8 @@
 
 #if defined(_WIN32)
 	time_t lastConfModTime = getRegConfigModTime(MECH_KEY);
-	if (g_confFileModTime >= lastConfModTime)
+	if (g_confFileModTime >= lastConfModTime &&
+	    g_confFileModTime != (time_t)-1)
 		return;
 	g_confFileModTime = lastConfModTime;
 	loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY);
@@ -782,6 +783,10 @@
 	GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gssspi_query_meta_data);
 	GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gssspi_exchange_meta_data);
 	GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gssspi_query_mechanism_info);
+	/* gss_get_mic_iov extensions (added 1.12, implementable 1.20) */
+	GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gss_get_mic_iov);
+	GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gss_verify_mic_iov);
+	GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gss_get_mic_iov_length);
 
 	assert(mech_type != GSS_C_NO_OID);
 
@@ -886,6 +891,10 @@
 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_sec_context_by_mech);
 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_name_by_mech);
 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_cred_by_mech);
+	/* gss_get_mic_iov extensions (added 1.12, implementable 1.20) */
+	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _get_mic_iov);
+	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _verify_mic_iov);
+	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _get_mic_iov_length);
 
 	mech->mech_type = *mech_type;
 	return mech;

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/mechglue/g_saslname.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/mechglue/g_saslname.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/mechglue/mglueP.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/mechglue/mglueP.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/gssapi/spnego/spnego_mech.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/gssapi/spnego/spnego_mech.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/admin_internal.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/admin_internal.h Changed

@@ -11,29 +11,32 @@
 
 #define KADM5_SERVER_HANDLE_MAGIC       0x12345800
 
-#define GENERIC_CHECK_HANDLE(handle, old_api_version, new_api_version)  \
+#define CHECK_VERSIONS(struct_version, api_version, old_api_err, new_api_err) \
     {                                                                   \
-        kadm5_server_handle_t srvr =                                    \
-            (kadm5_server_handle_t) handle;                             \
-                                                                        \
-        if (! srvr)                                                     \
-            return KADM5_BAD_SERVER_HANDLE;                             \
-        if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC)            \
-            return KADM5_BAD_SERVER_HANDLE;                             \
-        if ((srvr->struct_version & KADM5_MASK_BITS) !=                 \
-            KADM5_STRUCT_VERSION_MASK)                                  \
+        if ((struct_version & KADM5_MASK_BITS) != KADM5_STRUCT_VERSION_MASK) \
             return KADM5_BAD_STRUCT_VERSION;                            \
-        if (srvr->struct_version < KADM5_STRUCT_VERSION_1)              \
+        if (struct_version < KADM5_STRUCT_VERSION_1)                    \
             return KADM5_OLD_STRUCT_VERSION;                            \
-        if (srvr->struct_version > KADM5_STRUCT_VERSION_1)              \
+        if (struct_version > KADM5_STRUCT_VERSION_1)                    \
             return KADM5_NEW_STRUCT_VERSION;                            \
-        if ((srvr->api_version & KADM5_MASK_BITS) !=                    \
-            KADM5_API_VERSION_MASK)                                     \
+        if ((api_version & KADM5_MASK_BITS) != KADM5_API_VERSION_MASK)  \
             return KADM5_BAD_API_VERSION;                               \
-        if (srvr->api_version < KADM5_API_VERSION_2)                    \
-            return old_api_version;                                     \
-        if (srvr->api_version > KADM5_API_VERSION_4)                    \
-            return new_api_version;                                     \
+        if (api_version < KADM5_API_VERSION_2)                          \
+            return old_api_err;                                         \
+        if (api_version > KADM5_API_VERSION_4)                          \
+            return new_api_err;                                         \
+    }
+
+#define GENERIC_CHECK_HANDLE(handle, old_api_err, new_api_err)  \
+    {                                                           \
+        kadm5_server_handle_t srvr = handle;                    \
+                                                                \
+        if (srvr == NULL)                                       \
+            return KADM5_BAD_SERVER_HANDLE;                     \
+        if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC)    \
+            return KADM5_BAD_SERVER_HANDLE;                     \
+        CHECK_VERSIONS(srvr->struct_version, srvr->api_version, \
+                       old_api_err, new_api_err);               \
     }
 
 /*

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/clnt/client_init.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/clnt/client_init.c Changed

@@ -139,42 +139,70 @@
 }
 
 static kadm5_ret_t
+free_handle(kadm5_server_handle_t handle)
+{
+    kadm5_ret_t ret = 0;
+    OM_uint32 minor_stat;
+    krb5_ccache ccache;
+
+    if (handle == NULL)
+        return 0;
+
+    if (handle->destroy_cache && handle->cache_name != NULL) {
+        ret = krb5_cc_resolve(handle->context, handle->cache_name, &ccache);
+        if (!ret)
+            ret = krb5_cc_destroy(handle->context, ccache);
+    }
+    free(handle->cache_name);
+    (void)gss_release_cred(&minor_stat, &handle->cred);
+    if (handle->clnt != NULL && handle->clnt->cl_auth != NULL)
+        AUTH_DESTROY(handle->clnt->cl_auth);
+    if (handle->clnt != NULL)
+        clnt_destroy(handle->clnt);
+    if (handle->client_socket != -1)
+        close(handle->client_socket);
+    free(handle->lhandle);
+    kadm5_free_config_params(handle->context, &handle->params);
+    free(handle);
+
+    return ret;
+}
+
+static kadm5_ret_t
 init_any(krb5_context context, char *client_name, enum init_type init_type,
          char *pass, krb5_ccache ccache_in, char *service_name,
          kadm5_config_params *params_in, krb5_ui_4 struct_version,
          krb5_ui_4 api_version, char **db_args, void **server_handle)
 {
     int fd = -1;
-    OM_uint32 minor_stat;
     krb5_boolean iprop_enable;
     int port;
     rpcprog_t rpc_prog;
     rpcvers_t rpc_vers;
-    krb5_ccache ccache;
     krb5_principal client = NULL, server = NULL;
     struct timeval timeout;
 
-    kadm5_server_handle_t handle;
+    kadm5_server_handle_t handle = NULL;
     kadm5_config_params params_local;
 
-    int code = 0;
+    krb5_error_code code;
     generic_ret r = { 0, 0 };
 
     initialize_ovk_error_table();
     initialize_ovku_error_table();
 
-    if (! server_handle) {
+    if (server_handle == NULL || client_name == NULL)
         return EINVAL;
-    }
 
-    if (! (handle = malloc(sizeof(*handle)))) {
-        return ENOMEM;
-    }
-    memset(handle, 0, sizeof(*handle));
-    if (! (handle->lhandle = malloc(sizeof(*handle)))) {
-        free(handle);
-        return ENOMEM;
-    }
+    CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_LIB_API_VERSION,
+                   KADM5_NEW_LIB_API_VERSION);
+
+    handle = k5alloc(sizeof(*handle), &code);
+    if (handle == NULL)
+        goto cleanup;
+    handle->lhandle = k5alloc(sizeof(*handle), &code);
+    if (handle->lhandle == NULL)
+        goto cleanup;
 
     handle->magic_number = KADM5_SERVER_HANDLE_MAGIC;
     handle->struct_version = struct_version;
@@ -192,38 +220,36 @@
 
     handle->context = context;
 
-    if(client_name == NULL) {
-        free(handle);
-        return EINVAL;
-    }
-
-    /*
-     * Verify the version numbers before proceeding; we can't use
-     * CHECK_HANDLE because not all fields are set yet.
-     */
-    GENERIC_CHECK_HANDLE(handle, KADM5_OLD_LIB_API_VERSION,
-                         KADM5_NEW_LIB_API_VERSION);
-
     memset(&params_local, 0, sizeof(params_local));
 
-    if ((code = kadm5_get_config_params(handle->context, 0,
-                                        params_in, &handle->params))) {
-        free(handle);
-        return(code);
-    }
+    code = kadm5_get_config_params(handle->context, 0, params_in,
+                                   &handle->params);
+    if (code)
+        goto cleanup;
 
 #define REQUIRED_PARAMS (KADM5_CONFIG_REALM |           \
                          KADM5_CONFIG_ADMIN_SERVER |    \
                          KADM5_CONFIG_KADMIND_PORT)
 
     if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) {
-        free(handle);
-        return KADM5_MISSING_KRB5_CONF_PARAMS;
+        code = KADM5_MISSING_KRB5_CONF_PARAMS;
+        goto cleanup;
     }
 
+    /*
+     * Parse the client name.  If it has an empty realm, it is almost certainly
+     * a host-based principal using DNS fallback processing or the referral
+     * realm, so give it the appropriate name type for canonicalization.  Also
+     * check for iprop client principals as kpropd sets the realm on the
+     * sn2princ result.
+     */
     code = krb5_parse_name(handle->context, client_name, &client);
     if (code)
-        goto error;
+        goto cleanup;
+    if ((init_type == INIT_SKEY && client->realm.length == 0) ||
+        (client->length == 2 &&
+         data_eq_string(client->data0, KIPROP_SVC_NAME)))
+        client->type = KRB5_NT_SRV_HST;
 
     /*
      * Get credentials.  Also does some fallbacks in case kadmin/fqdn
@@ -232,7 +258,7 @@
     code = get_init_creds(handle, client, init_type, pass, ccache_in,
                           service_name, handle->params.realm, &server);
     if (code)
-        goto error;
+        goto cleanup;
 
     /* If the service_name and client_name are iprop-centric, use the iprop
      * port and RPC identifiers. */
@@ -251,7 +277,7 @@
 
     code = connect_to_server(handle->params.admin_server, port, &fd);
     if (code)
-        goto error;
+        goto cleanup;
 
     handle->clnt = clnttcp_create(NULL, rpc_prog, rpc_vers, &fd, 0, 0);
     if (handle->clnt == NULL) {
@@ -259,7 +285,7 @@
 #ifdef DEBUG
         clnt_pcreateerror("clnttcp_create");
 #endif
-        goto error;
+        goto cleanup;
     }
 
     /* Set a one-hour timeout. */
@@ -271,10 +297,6 @@
     handle->lhandle->clnt = handle->clnt;
     handle->lhandle->client_socket = fd;
 
-    /* now that handle->clnt is set, we can check the handle */
-    if ((code = _kadm5_check_handle((void *) handle)))
-        goto error;
-
     /*
      * The RPC connection is open; establish the GSS-API
      * authentication context.
@@ -282,7 +304,7 @@
     code = setup_gss(handle, params_in,
                      (init_type == INIT_CREDS) ? client : NULL, server);
     if (code)
-        goto error;
+        goto cleanup;
 
     /*
      * Bypass the remainder of the code and return straight away
@@ -290,7 +312,8 @@
      */
     if (iprop_enable) {
         code = 0;
-        *server_handle = (void *) handle;
+        *server_handle = handle;
+        handle = NULL;
         goto cleanup;
     }
 
@@ -299,7 +322,7 @@
 #ifdef DEBUG
         clnt_perror(handle->clnt, "init_2 null resp");
 #endif
-        goto error;
+        goto cleanup;
     }
     /* Drop down to v3 wire protocol if server does not support v4 */
     if (r.code == KADM5_NEW_SERVER_API_VERSION &&
@@ -308,7 +331,7 @@
         memset(&r, 0, sizeof(generic_ret));
         if (init_2(&handle->api_version, &r, handle->clnt)) {
             code = KADM5_RPC_ERROR;
-            goto error;
+            goto cleanup;
         }
     }
     /* Drop down to v2 wire protocol if server does not support v3 */
@@ -318,47 +341,21 @@
         memset(&r, 0, sizeof(generic_ret));
         if (init_2(&handle->api_version, &r, handle->clnt)) {
             code = KADM5_RPC_ERROR;
-            goto error;
+            goto cleanup;
         }
     }
     if (r.code) {
         code = r.code;
-        goto error;
+        goto cleanup;
     }
 
-    *server_handle = (void *) handle;
-
-    goto cleanup;
-
-error:
-    /*
-     * Note that it is illegal for this code to execute if "handle"
-     * has not been allocated and initialized.  I.e., don't use "goto
-     * error" before the block of code at the top of the function
-     * that allocates and initializes "handle".
-     */
-    if (handle->destroy_cache && handle->cache_name) {
-        if (krb5_cc_resolve(handle->context,
-                            handle->cache_name, &ccache) == 0)
-            (void) krb5_cc_destroy (handle->context, ccache);
-    }
-    if (handle->cache_name)
-        free(handle->cache_name);
-    (void)gss_release_cred(&minor_stat, &handle->cred);
-    if(handle->clnt && handle->clnt->cl_auth)
-        AUTH_DESTROY(handle->clnt->cl_auth);
-    if(handle->clnt)
-        clnt_destroy(handle->clnt);
-    if (fd != -1)
-        close(fd);
-    free(handle->lhandle);
-    kadm5_free_config_params(handle->context, &handle->params);
+    *server_handle = handle;
+    handle = NULL;
 
 cleanup:
-    krb5_free_principal(handle->context, client);
-    krb5_free_principal(handle->context, server);
-    if (code)
-        free(handle);
+    krb5_free_principal(context, client);
+    krb5_free_principal(context, server);
+    (void)free_handle(handle);
 
     return code;
 }
@@ -688,38 +685,8 @@
 kadm5_ret_t
 kadm5_destroy(void *server_handle)
 {
-    OM_uint32 minor_stat;
-    krb5_ccache            ccache = NULL;
-    int                    code = KADM5_OK;
-    kadm5_server_handle_t      handle =
-        (kadm5_server_handle_t) server_handle;
-
     CHECK_HANDLE(server_handle);
-
-    if (handle->destroy_cache && handle->cache_name) {
-        if ((code = krb5_cc_resolve(handle->context,
-                                    handle->cache_name, &ccache)) == 0)
-            code = krb5_cc_destroy (handle->context, ccache);
-    }
-    if (handle->cache_name)
-        free(handle->cache_name);
-    if (handle->cred)
-        (void)gss_release_cred(&minor_stat, &handle->cred);
-    if (handle->clnt && handle->clnt->cl_auth)
-        AUTH_DESTROY(handle->clnt->cl_auth);
-    if (handle->clnt)
-        clnt_destroy(handle->clnt);
-    if (handle->client_socket != -1)
-        close(handle->client_socket);
-    if (handle->lhandle)
-        free (handle->lhandle);
-
-    kadm5_free_config_params(handle->context, &handle->params);
-
-    handle->magic_number = 0;
-    free(handle);
-
-    return code;
+    return free_handle(server_handle);
 }
 /* not supported on client */
 kadm5_ret_t kadm5_lock(void *server_handle)

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/server_internal.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/server_internal.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/srv/libkadm5srv_mit.exports -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/srv/libkadm5srv_mit.exports Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/srv/pwqual_dict.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/srv/pwqual_dict.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/srv/server_init.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/srv/server_init.c Changed

@@ -19,23 +19,6 @@
 #include "osconf.h"
 #include "iprop_hdr.h"
 
-/*
- * Function check_handle
- *
- * Purpose: Check a server handle and return a com_err code if it is
- * invalid or 0 if it is valid.
- *
- * Arguments:
- *
- *      handle          The server handle.
- */
-
-static int check_handle(void *handle)
-{
-    CHECK_HANDLE(handle);
-    return 0;
-}
-
 static int dup_db_args(kadm5_server_handle_t handle, char **db_args)
 {
     int count  = 0;
@@ -84,6 +67,23 @@
     }
 }
 
+static void
+free_handle(kadm5_server_handle_t handle)
+{
+    if (handle == NULL)
+        return;
+
+    destroy_pwqual(handle);
+    k5_kadm5_hook_free_handles(handle->context, handle->hook_handles);
+    ulog_fini(handle->context);
+    krb5_db_fini(handle->context);
+    krb5_free_principal(handle->context, handle->current_caller);
+    kadm5_free_config_params(handle->context, &handle->params);
+    free(handle->lhandle);
+    free_db_args(handle);
+    free(handle);
+}
+
 kadm5_ret_t kadm5_init_with_password(krb5_context context, char *client_name,
                                      char *pass, char *service_name,
                                      kadm5_config_params *params,
@@ -163,8 +163,8 @@
                        char **db_args,
                        void **server_handle)
 {
-    int ret;
-    kadm5_server_handle_t handle;
+    krb5_error_code ret;
+    kadm5_server_handle_t handle = NULL;
     kadm5_config_params params_local; /* for v1 compat */
 
     if (! server_handle)
@@ -173,18 +173,18 @@
     if (! client_name)
         return EINVAL;
 
-    if (! (handle = (kadm5_server_handle_t) malloc(sizeof *handle)))
-        return ENOMEM;
-    memset(handle, 0, sizeof(*handle));
-
-    ret = dup_db_args(handle, db_args);
-    if (ret) {
-        free(handle);
-        return ret;
-    }
+    CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_SERVER_API_VERSION,
+                   KADM5_NEW_SERVER_API_VERSION);
 
+    handle = k5alloc(sizeof(*handle), &ret);
+    if (handle == NULL)
+        goto cleanup;
     handle->context = context;
 
+    ret = dup_db_args(handle, db_args);
+    if (ret)
+        goto cleanup;
+
     initialize_ovk_error_table();
     initialize_ovku_error_table();
 
@@ -193,13 +193,6 @@
     handle->api_version = api_version;
 
     /*
-     * Verify the version numbers before proceeding; we can't use
-     * CHECK_HANDLE because not all fields are set yet.
-     */
-    GENERIC_CHECK_HANDLE(handle, KADM5_OLD_SERVER_API_VERSION,
-                         KADM5_NEW_SERVER_API_VERSION);
-
-    /*
      * Acquire relevant profile entries.  Merge values
      * in params_in with values from profile, based on
      * params_in->mask.
@@ -208,11 +201,8 @@
 
     ret = kadm5_get_config_params(handle->context, 1, params_in,
                                   &handle->params);
-    if (ret) {
-        free_db_args(handle);
-        free(handle);
-        return(ret);
-    }
+    if (ret)
+        goto cleanup;
 
 #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_DBNAME |     \
                          KADM5_CONFIG_ENCTYPE |                         \
@@ -226,132 +216,69 @@
      KADM5_CONFIG_IPROP_PORT)
 
     if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        free_db_args(handle);
-        free(handle);
-        return KADM5_MISSING_CONF_PARAMS;
+        ret = KADM5_MISSING_CONF_PARAMS;
+        goto cleanup;
     }
     if ((handle->params.mask & KADM5_CONFIG_IPROP_ENABLED) == KADM5_CONFIG_IPROP_ENABLED
         && handle->params.iprop_enabled) {
         if ((handle->params.mask & IPROP_REQUIRED_PARAMS) != IPROP_REQUIRED_PARAMS) {
-            kadm5_free_config_params(handle->context, &handle->params);
-            free_db_args(handle);
-            free(handle);
-            return KADM5_MISSING_CONF_PARAMS;
+            ret = KADM5_MISSING_CONF_PARAMS;
+            goto cleanup;
         }
     }
 
     ret = krb5_set_default_realm(handle->context, handle->params.realm);
-    if (ret) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        free_db_args(handle);
-        free(handle);
-        return ret;
-    }
+    if (ret)
+        goto cleanup;
 
     ret = krb5_db_open(handle->context, db_args,
                        KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_ADMIN);
-    if (ret) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        free_db_args(handle);
-        free(handle);
-        return(ret);
-    }
+    if (ret)
+        goto cleanup;
 
-    if ((ret = krb5_parse_name(handle->context, client_name,
-                               &handle->current_caller))) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        krb5_db_fini(handle->context);
-        free_db_args(handle);
-        free(handle);
-        return ret;
-    }
+    ret = krb5_parse_name(handle->context, client_name,
+                          &handle->current_caller);
+    if (ret)
+        goto cleanup;
 
-    if (! (handle->lhandle = malloc(sizeof(*handle)))) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        krb5_db_fini(handle->context);
-        free_db_args(handle);
-        free(handle);
-        return ENOMEM;
-    }
+    handle->lhandle = k5alloc(sizeof(*handle), &ret);
+    if (handle->lhandle == NULL)
+        goto cleanup;
     *handle->lhandle = *handle;
     handle->lhandle->api_version = KADM5_API_VERSION_4;
     handle->lhandle->struct_version = KADM5_STRUCT_VERSION;
     handle->lhandle->lhandle = handle->lhandle;
 
-    /* can't check the handle until current_caller is set */
-    ret = check_handle((void *) handle);
-    if (ret) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        free_db_args(handle);
-        free(handle);
-        return ret;
-    }
-
     ret = kdb_init_master(handle, handle->params.realm,
                           (handle->params.mask & KADM5_CONFIG_MKEY_FROM_KBD)
                           && handle->params.mkey_from_kbd);
-    if (ret) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        krb5_db_fini(handle->context);
-        free_db_args(handle);
-        free(handle);
-        return ret;
-    }
+    if (ret)
+        goto cleanup;
 
     ret = kdb_init_hist(handle, handle->params.realm);
-    if (ret) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        krb5_db_fini(handle->context);
-        free_db_args(handle);
-        free(handle);
-        return ret;
-    }
+    if (ret)
+        goto cleanup;
 
     ret = k5_kadm5_hook_load(context,&handle->hook_handles);
-    if (ret) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        krb5_db_fini(handle->context);
-        krb5_free_principal(handle->context, handle->current_caller);
-        free_db_args(handle);
-        free(handle);
-        return ret;
-    }
+    if (ret)
+        goto cleanup;
 
     ret = init_pwqual(handle);
-    if (ret) {
-        kadm5_free_config_params(handle->context, &handle->params);
-        k5_kadm5_hook_free_handles(context, handle->hook_handles);
-        krb5_db_fini(handle->context);
-        krb5_free_principal(handle->context, handle->current_caller);
-        free_db_args(handle);
-        free(handle);
-        return ret;
-    }
+    if (ret)
+        goto cleanup;
 
-    *server_handle = (void *) handle;
+    *server_handle = handle;
+    handle = NULL;
 
-    return KADM5_OK;
+cleanup:
+    free_handle(handle);
+    return ret;
 }
 
 kadm5_ret_t kadm5_destroy(void *server_handle)
 {
-    kadm5_server_handle_t handle = server_handle;
-
     CHECK_HANDLE(server_handle);
-
-    destroy_pwqual(handle);
-
-    k5_kadm5_hook_free_handles(handle->context, handle->hook_handles);
-    ulog_fini(handle->context);
-    krb5_db_fini(handle->context);
-    krb5_free_principal(handle->context, handle->current_caller);
-    kadm5_free_config_params(handle->context, &handle->params);
-    handle->magic_number = 0;
-    free(handle->lhandle);
-    free_db_args(handle);
-    free(handle);
-
+    free_handle(server_handle);
     return KADM5_OK;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/srv/svr_policy.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/srv/svr_policy.c Changed

@@ -59,7 +59,7 @@
 kadm5_create_policy(void *server_handle, kadm5_policy_ent_t entry, long mask)
 {
     kadm5_server_handle_t handle = server_handle;
-    osa_policy_ent_rec  pent;
+    osa_policy_ent_rec  pent, *check_pol;
     int                 ret;
     char                *p;
 
@@ -71,7 +71,7 @@
         return EINVAL;
     if(strlen(entry->policy) == 0)
         return KADM5_BAD_POLICY;
-    if (!(mask & KADM5_POLICY))
+    if (!(mask & KADM5_POLICY) || (mask & ~ALL_POLICY_MASK))
         return KADM5_BAD_MASK;
     if ((mask & KADM5_POLICY_ALLOWED_KEYSALTS) &&
         entry->allowed_keysalts != NULL) {
@@ -80,6 +80,14 @@
             return ret;
     }
 
+    ret = krb5_db_get_policy(handle->context, entry->policy, &check_pol);
+    if (!ret) {
+        krb5_db_free_policy(handle->context, check_pol);
+        return KADM5_DUP;
+    } else if (ret != KRB5_KDB_NOENTRY) {
+        return ret;
+    }
+
     memset(&pent, 0, sizeof(pent));
     pent.name = entry->policy;
     p = entry->policy;
@@ -258,7 +266,7 @@
         return EINVAL;
     if(strlen(entry->policy) == 0)
         return KADM5_BAD_POLICY;
-    if((mask & KADM5_POLICY))
+    if ((mask & KADM5_POLICY) || (mask & ~ALL_POLICY_MASK))
         return KADM5_BAD_MASK;
     if ((mask & KADM5_POLICY_ALLOWED_KEYSALTS) &&
         entry->allowed_keysalts != NULL) {

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kadm5/srv/svr_principal.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/srv/svr_principal.c Changed

@@ -9,10 +9,6 @@
 #include        <kadm5/admin.h>
 #include        <kdb.h>
 #include        "server_internal.h"
-#ifdef USE_PASSWORD_SERVER
-#include        <sys/wait.h>
-#include        <signal.h>
-#endif
 
 #include <krb5/kadm5_hook_plugin.h>
 
@@ -1221,109 +1217,6 @@
     return(0);
 }
 
-/* FIXME: don't use global variable for this */
-krb5_boolean use_password_server = 0;
-
-#ifdef USE_PASSWORD_SERVER
-static krb5_boolean
-kadm5_use_password_server (void)
-{
-    return use_password_server;
-}
-#endif
-
-void kadm5_set_use_password_server (void);
-
-void
-kadm5_set_use_password_server (void)
-{
-    use_password_server = 1;
-}
-
-#ifdef USE_PASSWORD_SERVER
-
-/*
- * kadm5_launch_task () runs a program (task_path) to synchronize the
- * Apple password server with the Kerberos database.  Password server
- * programs can receive arguments on the command line (task_argv)
- * and a block of data via stdin (data_buffer).
- *
- * Because a failure to communicate with the tool results in the
- * password server falling out of sync with the database,
- * kadm5_launch_task() always fails if it can't talk to the tool.
- */
-
-static kadm5_ret_t
-kadm5_launch_task (krb5_context context,
-                   const char *task_path, char * const task_argv,
-                   const char *buffer)
-{
-    kadm5_ret_t ret;
-    int data_pipe2;
-
-    ret = pipe (data_pipe);
-    if (ret)
-        ret = errno;
-
-    if (!ret) {
-        pid_t pid = fork ();
-        if (pid == -1) {
-            ret = errno;
-            close (data_pipe0);
-            close (data_pipe1);
-        } else if (pid == 0) {
-            /* The child: */
-
-            if (dup2 (data_pipe0, STDIN_FILENO) == -1)
-                _exit (1);
-
-            close (data_pipe0);
-            close (data_pipe1);
-
-            execv (task_path, task_argv);
-
-            _exit (1); /* Fail if execv fails */
-        } else {
-            /* The parent: */
-            int status;
-
-            ret = 0;
-
-            close (data_pipe0);
-
-            /* Write out the buffer to the child, add \n */
-            if (buffer) {
-                if (krb5_net_write (context, data_pipe1, buffer, strlen (buffer)) < 0
-                    || krb5_net_write (context, data_pipe1, "\n", 1) < 0)
-                {
-                    /* kill the child to make sure waitpid() won't hang later */
-                    ret = errno;
-                    kill (pid, SIGKILL);
-                }
-            }
-            close (data_pipe1);
-
-            waitpid (pid, &status, 0);
-
-            if (!ret) {
-                if (WIFEXITED (status)) {
-                    /* child read password and exited.  Check the return value. */
-                    if ((WEXITSTATUS (status) != 0) && (WEXITSTATUS (status) != 252)) {
-                        ret = KRB5KDC_ERR_POLICY; /* password change rejected */
-                    }
-                } else {
-                    /* child read password but crashed or was killed */
-                    ret = KRB5KRB_ERR_GENERIC; /* FIXME: better error */
-                }
-            }
-        }
-    }
-
-    return ret;
-}
-
-#endif
-
 kadm5_ret_t
 kadm5_chpass_principal(void *server_handle,
                        krb5_principal principal, char *password)
@@ -1453,35 +1346,6 @@
             kdb->pw_expiration = ts_incr(now, pol.pw_max_life);
     }
 
-#ifdef USE_PASSWORD_SERVER
-    if (kadm5_use_password_server () &&
-        (krb5_princ_size (handle->context, principal) == 1)) {
-        krb5_data *princ = krb5_princ_component (handle->context, principal, 0);
-        const char *path = "/usr/sbin/mkpassdb";
-        char *argv = { "mkpassdb", "-setpassword", NULL, NULL };
-        char *pstring = NULL;
-
-        if (!ret) {
-            pstring = malloc ((princ->length + 1) * sizeof (char));
-            if (pstring == NULL) { ret = ENOMEM; }
-        }
-
-        if (!ret) {
-            memcpy (pstring, princ->data, princ->length);
-            pstring princ->length = '\0';
-            argv2 = pstring;
-
-            ret = kadm5_launch_task (handle->context, path, argv, password);
-        }
-
-        if (pstring != NULL)
-            free (pstring);
-
-        if (ret)
-            goto done;
-    }
-#endif
-
     ret = krb5_dbe_update_last_pwd_change(handle->context, kdb, now);
     if (ret)
         goto done;

_service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/t_kadm5.c Added

@@ -0,0 +1,1326 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* lib/kadm5/t_kadm5.c - API tests for libkadm5 */
+/*
+ * Copyright (C) 2021 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "k5-int.h"
+#include <kadm5/admin.h>
+
+static uint32_t api;
+static krb5_boolean rpc;
+
+static krb5_context context;
+
+/* These must match the creation commands in t_kadm5.py. */
+#define ADMIN_PASSWORD "admin"
+#define USER_PASSWORD "us3r"
+
+/* This list must match the supported_enctypes setting in t_kadm5.py. */
+static krb5_enctype
+default_supported_enctypes = {
+    ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+    ENCTYPE_NULL
+};
+
+static void
+check(krb5_error_code code)
+{
+    assert(code == 0);
+}
+
+static void
+check_fail(krb5_error_code code, krb5_error_code expected)
+{
+    assert(code == expected);
+}
+
+/*
+ * Initialize a handle using the global context.  The caller must destroy this
+ * handle before initializing another one.  If the client name begins with '$',
+ * authenticate to kadmin/changepw; otherwise authenticate to kadmin/admin.  If
+ * client is null, return a null handle.
+ */
+static void *
+get_handle(char *client)
+{
+    void *handle;
+    char *service, *pass;
+
+    if (client == NULL)
+        return NULL;
+
+    if (*client == '$') {
+        service = KADM5_CHANGEPW_SERVICE;
+        client++;
+    } else {
+        service = KADM5_ADMIN_SERVICE;
+    }
+    pass = (strcmp(client, "user") == 0) ? USER_PASSWORD : ADMIN_PASSWORD;
+
+    check(kadm5_init(context, client, pass, service, NULL,
+                     KADM5_STRUCT_VERSION, api, NULL, &handle));
+    return handle;
+}
+
+static void
+free_handle(void *handle)
+{
+    if (handle != NULL)
+        check(kadm5_destroy(handle));
+}
+
+static krb5_principal
+parse_princ(const char *str)
+{
+    krb5_principal princ;
+
+    check(krb5_parse_name(context, str, &princ));
+    return princ;
+}
+
+static void
+create_simple_policy(char *name)
+{
+    void *handle = get_handle("admin");
+    kadm5_policy_ent_rec ent;
+
+    memset(&ent, 0, sizeof(ent));
+    ent.policy = name;
+    check(kadm5_create_policy(handle, &ent, KADM5_POLICY));
+    free_handle(handle);
+}
+
+static void
+delete_policy(char *name)
+{
+    void *handle = get_handle("admin");
+
+    check(kadm5_delete_policy(handle, name));
+    free_handle(handle);
+}
+
+static void
+compare_policy(kadm5_policy_ent_t x, uint32_t mask)
+{
+    kadm5_policy_ent_rec g;
+    void *handle = get_handle("admin");
+
+    check(kadm5_get_policy(handle, x->policy, &g));
+
+    assert(strcmp(g.policy, x->policy) == 0);
+    if (mask & KADM5_PW_MAX_LIFE)
+        assert(g.pw_max_life == x->pw_max_life);
+    if (mask & KADM5_PW_MIN_LIFE)
+        assert(g.pw_min_life == x->pw_min_life);
+    if (mask & KADM5_PW_MIN_LENGTH)
+        assert(g.pw_min_length == x->pw_min_length);
+    if (mask & KADM5_PW_MIN_CLASSES)
+        assert(g.pw_min_classes == x->pw_min_classes);
+    if (mask & KADM5_PW_HISTORY_NUM)
+        assert(g.pw_history_num == x->pw_history_num);
+    if (mask & KADM5_PW_MAX_FAILURE)
+        assert(g.pw_max_fail == x->pw_max_fail);
+    if (mask & KADM5_PW_FAILURE_COUNT_INTERVAL)
+        assert(g.pw_failcnt_interval == x->pw_failcnt_interval);
+    if (mask & KADM5_PW_LOCKOUT_DURATION)
+        assert(g.pw_lockout_duration == x->pw_lockout_duration);
+
+    check(kadm5_free_policy_ent(handle, &g));
+    free_handle(handle);
+}
+
+static void
+create_simple_princ(krb5_principal princ, char *policy)
+{
+    void *handle = get_handle("admin");
+    kadm5_principal_ent_rec ent;
+    uint32_t mask = KADM5_PRINCIPAL;
+
+    memset(&ent, 0, sizeof(ent));
+    ent.principal = princ;
+    ent.policy = policy;
+    if (policy != NULL)
+        mask |= KADM5_POLICY;
+    check(kadm5_create_principal(handle, &ent, mask, "pw"));
+    free_handle(handle);
+}
+
+static void
+delete_princ(krb5_principal princ)
+{
+    void *handle = get_handle("admin");
+
+    check(kadm5_delete_principal(handle, princ));
+    free_handle(handle);
+}
+
+static void
+compare_key_data(kadm5_principal_ent_t ent, const krb5_enctype *etypes)
+{
+    int i;
+
+    for (i = 0; etypesi != ENCTYPE_NULL; i++) {
+        assert(i < ent->n_key_data);
+        assert(ent->key_datai.key_data_ver >= 1);
+        assert(ent->key_datai.key_data_type0 == etypesi);
+    }
+}
+
+static void
+compare_princ(kadm5_principal_ent_t x, uint32_t mask)
+{
+    void *handle = get_handle("admin");
+    kadm5_principal_ent_rec g;
+    kadm5_policy_ent_rec pol;
+
+    check(kadm5_get_principal(handle, x->principal, &g,
+                              KADM5_PRINCIPAL_NORMAL_MASK));
+
+    assert(krb5_principal_compare(context, g.principal, x->principal));
+    if (mask & KADM5_POLICY)
+        assert(strcmp(g.policy, x->policy) == 0);
+    if (mask & KADM5_PRINC_EXPIRE_TIME)
+        assert(g.princ_expire_time == x->princ_expire_time);
+    if (mask & KADM5_MAX_LIFE)
+        assert(g.max_life == x->max_life);
+    if (mask & KADM5_MAX_RLIFE)
+        assert(g.max_renewable_life == x->max_renewable_life);
+    if (mask & KADM5_FAIL_AUTH_COUNT)
+        assert(g.fail_auth_count == x->fail_auth_count);
+    if (mask & KADM5_ATTRIBUTES)
+        assert(g.attributes == x->attributes);
+    if (mask & KADM5_KVNO)
+        assert(g.kvno == x->kvno);
+
+    if (mask & KADM5_PW_EXPIRATION) {
+        assert(g.pw_expiration == x->pw_expiration);
+    } else if ((mask & KADM5_POLICY) &&
+               kadm5_get_policy(handle, g.policy, &pol) == 0) {
+        /* Check the policy pw_max_life computation. */
+        if (pol.pw_max_life != 0) {
+            assert(ts_incr(g.last_pwd_change, pol.pw_max_life) ==
+                   g.pw_expiration);
+        } else {
+            assert(g.pw_expiration == 0);
+        }
+        check(kadm5_free_policy_ent(handle, &pol));
+    }
+
+    if (mask & KADM5_POLICY_CLR) {
+        assert(g.policy == NULL);
+        if (!(mask & KADM5_PW_EXPIRATION))
+            assert(g.pw_expiration == 0);
+    }
+
+    check(kadm5_free_principal_ent(handle, &g));
+    free_handle(handle);
+}
+
+static void
+kinit(krb5_ccache cc, const char *user, const char *pass, const char *service)
+{
+    krb5_get_init_creds_opt *opt;
+    krb5_principal client = parse_princ(user);
+    krb5_creds creds;
+
+    check(krb5_get_init_creds_opt_alloc(context, &opt));
+    check(krb5_get_init_creds_opt_set_out_ccache(context, opt, cc));
+    check(krb5_get_init_creds_password(context, &creds, client, pass, NULL,
+                                       NULL, 0, service, opt));
+    krb5_get_init_creds_opt_free(context, opt);
+    krb5_free_cred_contents(context, &creds);
+    krb5_free_principal(context, client);
+}
+
+static void
+cpw_test_fail(char *user, krb5_principal princ, char *pass,
+              krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_chpass_principal(handle, princ, pass), code);
+    free_handle(handle);
+}
+
+static void
+cpw_test_succeed(char *user, krb5_principal princ, char *pass)
+{
+    cpw_test_fail(user, princ, pass, 0);
+}
+
+static void
+test_chpass()
+{
+    krb5_principal princ = parse_princ("chpass-test");
+    krb5_principal hist_princ = parse_princ("kadmin/history");
+    kadm5_principal_ent_rec ent;
+    void *handle;
+
+    /* Specify a policy so that kadmin/history is created. */
+    create_simple_princ(princ, "minlife-pol");
+
+    /* Check kvno and enctypes after a password change. */
+    handle = get_handle("admin");
+    check(kadm5_chpass_principal(handle, princ, "newpassword"));
+    check(kadm5_get_principal(handle, princ, &ent, KADM5_KEY_DATA));
+    compare_key_data(&ent, default_supported_enctypes);
+    assert(ent.key_data0.key_data_kvno == 2);
+    check(kadm5_free_principal_ent(handle, &ent));
+    free_handle(handle);
+
+    /* Fails for protected principal. */
+    cpw_test_fail("admin", hist_princ, "pw", KADM5_PROTECT_PRINCIPAL);
+
+    /* Fails over RPC if "change" ACL is not granted, or if we authenticated to
+     * kadmin/changepw and are changing another principal's password. */
+    if (rpc) {
+        cpw_test_succeed("admin/modify", princ, "pw2");
+        cpw_test_fail("admin/none", princ, "pw3", KADM5_AUTH_CHANGEPW);
+        cpw_test_fail("$admin", princ, "pw3", KADM5_AUTH_CHANGEPW);
+    }
+
+    /* Fails with null handle or principal name. */
+    cpw_test_fail(NULL, princ, "pw", KADM5_BAD_SERVER_HANDLE);
+    cpw_test_fail("admin", NULL, "pw", EINVAL);
+
+    delete_princ(princ);
+    krb5_free_principal(context, princ);
+    krb5_free_principal(context, hist_princ);
+}
+
+static void
+cpol_test_fail(char *user, kadm5_policy_ent_t ent, uint32_t mask,
+               krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_create_policy(handle, ent, mask | KADM5_POLICY), code);
+    free_handle(handle);
+}
+
+static void
+cpol_test_compare(char *user, kadm5_policy_ent_t ent, uint32_t mask)
+{
+    cpol_test_fail(user, ent, mask, 0);
+    compare_policy(ent, mask);
+    delete_policy(ent->policy);
+}
+
+static void
+test_create_policy()
+{
+    void *handle;
+    kadm5_policy_ent_rec ent;
+
+    memset(&ent, 0, sizeof(ent));
+
+    /* Fails with undefined mask bit. */
+    ent.policy = "create-policy-test";
+    cpol_test_fail("admin", &ent, 0x10000000, KADM5_BAD_MASK);
+
+    /* Fails without KADM5_POLICY mask bit. */
+    handle = get_handle("admin");
+    check_fail(kadm5_create_policy(handle, &ent, 0), KADM5_BAD_MASK);
+    free_handle(handle);
+
+    /* pw_min_life = 0 and pw_min_life != 0 */
+    cpol_test_compare("admin", &ent, KADM5_PW_MIN_LIFE);
+    ent.pw_min_life = 32;
+    cpol_test_compare("admin", &ent, KADM5_PW_MIN_LIFE);
+
+    /* pw_max_life = 0 and pw_max_life != 0 */
+    cpol_test_compare("admin", &ent, KADM5_PW_MAX_LIFE);
+    ent.pw_max_life = 32;
+    cpol_test_compare("admin", &ent, KADM5_PW_MAX_LIFE);
+
+    /* pw_min_length = 0 (rejected) and pw_min_length != 0 */
+    cpol_test_fail("admin", &ent, KADM5_PW_MIN_LENGTH, KADM5_BAD_LENGTH);
+    ent.pw_min_length = 32;
+    cpol_test_compare("admin", &ent, KADM5_PW_MIN_LENGTH);
+
+    /* pw_min_classes = 0 (rejected), 1, 5, 6 (rejected) */
+    cpol_test_fail("admin", &ent, KADM5_PW_MIN_CLASSES, KADM5_BAD_CLASS);
+    ent.pw_min_classes = 1;
+    cpol_test_compare("admin", &ent, KADM5_PW_MIN_CLASSES);
+    ent.pw_min_classes = 5;
+    cpol_test_compare("admin", &ent, KADM5_PW_MIN_CLASSES);
+    ent.pw_min_classes = 6;
+    cpol_test_fail("admin", &ent, KADM5_PW_MIN_CLASSES, KADM5_BAD_CLASS);
+
+    /* pw_history_num = 0 (rejected), 1, 10 */
+    cpol_test_fail("admin", &ent, KADM5_PW_HISTORY_NUM, KADM5_BAD_HISTORY);
+    ent.pw_history_num = 1;
+    cpol_test_compare("admin", &ent, KADM5_PW_HISTORY_NUM);
+    ent.pw_history_num = 10;
+    cpol_test_compare("admin", &ent, KADM5_PW_HISTORY_NUM);
+
+    if (api >= KADM5_API_VERSION_3) {
+        ent.pw_max_fail = 2;
+        cpol_test_compare("admin", &ent, KADM5_PW_MAX_FAILURE);
+        ent.pw_failcnt_interval = 90;
+        cpol_test_compare("admin", &ent,
+                          KADM5_PW_FAILURE_COUNT_INTERVAL);
+        ent.pw_lockout_duration = 180;
+        cpol_test_compare("admin", &ent, KADM5_PW_LOCKOUT_DURATION);
+    }
+
+    /* Fails over RPC if "add" ACL is not granted, or if we authenticated to
+     * kadmin/changepw. */
+    if (rpc) {
+        cpol_test_fail("$admin", &ent, 0, KADM5_AUTH_ADD);
+        cpol_test_fail("admin/none", &ent, 0, KADM5_AUTH_ADD);
+        cpol_test_fail("admin/get", &ent, 0, KADM5_AUTH_ADD);
+        cpol_test_fail("admin/modify", &ent, 0, KADM5_AUTH_ADD);
+        cpol_test_fail("admin/delete", &ent, 0, KADM5_AUTH_ADD);
+        cpol_test_compare("admin/add", &ent, 0);
+    }
+
+    /* Fails with existing policy name. */
+    ent.policy = "test-pol";
+    cpol_test_fail("admin", &ent, 0, KADM5_DUP);
+
+    /* Fails with null or empty policy name, or invalid character in name. */
+    ent.policy = NULL;
+    cpol_test_fail("admin", &ent, 0, EINVAL);
+    ent.policy = "";
+    cpol_test_fail("admin", &ent, 0, KADM5_BAD_POLICY);
+    ent.policy = "pol\7";
+    cpol_test_fail("admin", &ent, 0, KADM5_BAD_POLICY);
+
+    /* Fails with null handle or policy ent. */
+    cpol_test_fail(NULL, &ent, 0, KADM5_BAD_SERVER_HANDLE);
+    cpol_test_fail("admin", NULL, 0, EINVAL);
+}
+
+static void
+cprinc_test_fail(char *user, kadm5_principal_ent_t ent, uint32_t mask,
+                 char *pass, krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_create_principal(handle, ent, mask | KADM5_PRINCIPAL,
+                                      pass), code);
+    free_handle(handle);
+}
+
+static void
+cprinc_test_compare(char *user, kadm5_principal_ent_t ent, uint32_t mask,
+                    char *pass)
+{
+    cprinc_test_fail(user, ent, mask, pass, 0);
+    compare_princ(ent, mask);
+    delete_princ(ent->principal);
+}
+
+static void
+test_create_principal()
+{
+    void *handle;
+    kadm5_principal_ent_rec ent;
+    krb5_principal princ = parse_princ("create-principal-test");
+    krb5_principal user_princ = parse_princ("user");
+
+    memset(&ent, 0, sizeof(ent));
+    ent.principal = princ;
+
+    /* Fails with undefined or prohibited mask bit. */
+    cprinc_test_fail("admin", &ent, 0x100000, "", KADM5_BAD_MASK);
+    cprinc_test_fail("admin", &ent, KADM5_LAST_PWD_CHANGE, "pw",
+                     KADM5_BAD_MASK);
+    cprinc_test_fail("admin", &ent, KADM5_MOD_TIME, "pw", KADM5_BAD_MASK);
+    cprinc_test_fail("admin", &ent, KADM5_MOD_NAME, "pw", KADM5_BAD_MASK);
+    cprinc_test_fail("admin", &ent, KADM5_MKVNO, "pw", KADM5_BAD_MASK);
+    cprinc_test_fail("admin", &ent, KADM5_AUX_ATTRIBUTES, "pw",
+                     KADM5_BAD_MASK);
+
+    /* Fails without KADM5_PRINCIPAL mask bit. */
+    handle = get_handle("admin");
+    check_fail(kadm5_create_principal(handle, &ent, 0, "pw"), KADM5_BAD_MASK);
+    free_handle(handle);
+
+    /* Fails with empty password or password prohibited by policy. */
+    cprinc_test_fail("admin", &ent, 0, "", KADM5_PASS_Q_TOOSHORT);
+    ent.policy = "test-pol";
+    cprinc_test_fail("admin", &ent, KADM5_POLICY, "tP", KADM5_PASS_Q_TOOSHORT);
+    cprinc_test_fail("admin", &ent, KADM5_POLICY, "testpassword",
+                     KADM5_PASS_Q_CLASS);
+    cprinc_test_fail("admin", &ent, KADM5_POLICY, "Abyssinia",
+                     KADM5_PASS_Q_DICT);
+
+    cprinc_test_compare("admin", &ent, 0, "pw");
+    ent.policy = "nonexistent-pol";
+    cprinc_test_compare("admin", &ent, KADM5_POLICY, "pw");
+    cprinc_test_compare("admin/rename", &ent, KADM5_POLICY, "pw");
+
+    /* Test pw_expiration explicit specifications vs. policy pw_max_life. */
+    ent.policy = "test-pol";
+    cprinc_test_compare("admin", &ent, KADM5_POLICY, "NotinTheDictionary");
+    cprinc_test_compare("admin", &ent, KADM5_PRINC_EXPIRE_TIME, "pw");
+    cprinc_test_compare("admin", &ent, KADM5_PW_EXPIRATION, "pw");
+    cprinc_test_compare("admin", &ent, KADM5_POLICY | KADM5_PW_EXPIRATION,
+                        "NotinTheDictionary");
+    ent.pw_expiration = 1234;
+    cprinc_test_compare("admin", &ent, KADM5_PW_EXPIRATION, "pw");
+    cprinc_test_compare("admin", &ent, KADM5_POLICY | KADM5_PW_EXPIRATION,
+                        "NotinTheDictionary");
+    ent.pw_expiration = 999999999;
+    cprinc_test_compare("admin", &ent, KADM5_POLICY | KADM5_PW_EXPIRATION,
+                        "NotinTheDictionary");
+    ent.policy = "dict-only-pol";
+    cprinc_test_compare("admin", &ent, KADM5_POLICY | KADM5_PW_EXPIRATION,
+                        "pw");
+
+    /* Fails over RPC if "add" ACL is not granted, or if we authenticated to
+     * kadmin/changepw. */
+    if (rpc) {
+        cprinc_test_fail("$admin", &ent, 0, "pw", KADM5_AUTH_ADD);
+        cprinc_test_fail("admin/none", &ent, 0, "pw", KADM5_AUTH_ADD);
+        cprinc_test_fail("admin/get", &ent, 0, "pw", KADM5_AUTH_ADD);
+        cprinc_test_fail("admin/modify", &ent, 0, "pw", KADM5_AUTH_ADD);
+        cprinc_test_fail("admin/delete", &ent, 0, "pw", KADM5_AUTH_ADD);
+    }
+
+    /* Fails with existing policy name. */
+    ent.principal = user_princ;
+    cprinc_test_fail("admin", &ent, 0, "pw", KADM5_DUP);
+
+    /* Fails with null handle or principal ent. */
+    cprinc_test_fail(NULL, &ent, 0, "pw", KADM5_BAD_SERVER_HANDLE);
+    cprinc_test_fail("admin", NULL, 0, "pw", EINVAL);
+
+    krb5_free_principal(context, princ);
+    krb5_free_principal(context, user_princ);
+}
+
+static void
+dpol_test_fail(char *user, char *name, krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_delete_policy(handle, name), code);
+    free_handle(handle);
+}
+
+static void
+dpol_test_succeed(char *user, char *name)
+{
+    dpol_test_fail(user, name, 0);
+}
+
+static void
+test_delete_policy()
+{
+    krb5_principal princ = parse_princ("delete-policy-test-princ");
+
+    /* Fails with unknown policy. */
+    dpol_test_fail("admin", "delete-policy-test", KADM5_UNK_POLICY);
+
+    /* Fails with empty policy name. */
+    dpol_test_fail("admin", "", KADM5_BAD_POLICY);
+
+    /* Succeeds with "delete" ACL (or local authentication). */
+    create_simple_policy("delete-policy-test");
+    dpol_test_succeed("admin/delete", "delete-policy-test");
+
+    /* Succeeds even if a principal references the policy, since we now allow
+     * principals to reference nonexistent policies. */
+    create_simple_policy("delete-policy-test");
+    create_simple_princ(princ, "delete-policy-test");
+    dpol_test_succeed("admin", "delete-policy-test");
+    delete_princ(princ);
+
+    /* Fails over RPC if "delete" ACL is not granted, or if we authenticated to
+     * kadmin/changepw. */
+    if (rpc) {
+        dpol_test_fail("$admin", "test-pol", KADM5_AUTH_DELETE);
+        dpol_test_fail("admin/none", "test-pol", KADM5_AUTH_DELETE);
+        dpol_test_fail("admin/add", "test-pol", KADM5_AUTH_DELETE);
+    }
+
+    /* Fails with null handle or principal ent. */
+    dpol_test_fail(NULL, "test-pol", KADM5_BAD_SERVER_HANDLE);
+    dpol_test_fail("admin", NULL, EINVAL);
+
+    krb5_free_principal(context, princ);
+}
+
+static void
+dprinc_test_fail(char *user, krb5_principal princ, krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_delete_principal(handle, princ), code);
+    free_handle(handle);
+}
+
+static void
+dprinc_test_succeed(char *user, krb5_principal princ)
+{
+    dprinc_test_fail(user, princ, 0);
+}
+
+static void
+test_delete_principal()
+{
+    krb5_principal princ = parse_princ("delete-principal-test");
+
+    /* Fails with unknown principal. */
+    dprinc_test_fail("admin", princ, KADM5_UNK_PRINC);
+
+    /* Succeeds with "delete" ACL (or local authentication). */
+    create_simple_princ(princ, NULL);
+    dprinc_test_succeed("admin/delete", princ);
+
+    /* Fails over RPC if "delete" ACL is not granted, or if we authenticated to
+     * kadmin/changepw. */
+    if (rpc) {
+        dprinc_test_fail("$admin", princ, KADM5_AUTH_DELETE);
+        dprinc_test_fail("admin/add", princ, KADM5_AUTH_DELETE);
+        dprinc_test_fail("admin/modify", princ, KADM5_AUTH_DELETE);
+        dprinc_test_fail("admin/get", princ, KADM5_AUTH_DELETE);
+        dprinc_test_fail("admin/none", princ, KADM5_AUTH_DELETE);
+    }
+
+    /* Fails with null handle or principal ent. */
+    dprinc_test_fail(NULL, princ, KADM5_BAD_SERVER_HANDLE);
+    dprinc_test_fail("admin", NULL, EINVAL);
+
+    krb5_free_principal(context, princ);
+}
+
+static void
+gpol_test_succeed(char *user, char *name)
+{
+    void *handle = get_handle(user);
+    kadm5_policy_ent_rec ent;
+
+    check(kadm5_get_policy(handle, name, &ent));
+    assert(strcmp(ent.policy, name) == 0);
+    check(kadm5_free_policy_ent(handle, &ent));
+    free_handle(handle);
+}
+
+static void
+gpol_test_fail(char *user, char *name, krb5_error_code code)
+{
+    void *handle = get_handle(user);
+    kadm5_policy_ent_rec ent;
+
+    check_fail(kadm5_get_policy(handle, name, &ent), code);
+    free_handle(handle);
+}
+
+static void
+test_get_policy()
+{
+    /* Fails with unknown policy. */
+    dpol_test_fail("admin", "unknown-policy", KADM5_UNK_POLICY);
+
+    /* Fails with empty or null policy name or a null handle. */
+    gpol_test_fail("admin", "", KADM5_BAD_POLICY);
+    gpol_test_fail("admin", NULL, EINVAL);
+    gpol_test_fail(NULL, "", KADM5_BAD_SERVER_HANDLE);
+
+    /* Fails over RPC unless "get" ACL is granted or the principal's own policy
+     * is retrieved. */
+    if (rpc) {
+        gpol_test_fail("admin/none", "test-pol", KADM5_AUTH_GET);
+        gpol_test_fail("admin/add", "test-pol", KADM5_AUTH_GET);
+        gpol_test_succeed("admin/get", "test-pol");
+        gpol_test_succeed("user", "minlife-pol");
+        gpol_test_succeed("$user", "minlife-pol");
+    }
+}
+
+static void
+gprinc_test_succeed(char *user, krb5_principal princ)
+{
+    void *handle = get_handle(user);
+    kadm5_principal_ent_rec ent;
+
+    check(kadm5_get_principal(handle, princ, &ent,
+                              KADM5_PRINCIPAL_NORMAL_MASK));
+    assert(krb5_principal_compare(context, ent.principal, princ));
+    check(kadm5_free_principal_ent(handle, &ent));
+    free_handle(handle);
+}
+
+static void
+gprinc_test_fail(char *user, krb5_principal princ, krb5_error_code code)
+{
+    void *handle = get_handle(user);
+    kadm5_principal_ent_rec ent;
+
+    check_fail(kadm5_get_principal(handle, princ, &ent,
+                                   KADM5_PRINCIPAL_NORMAL_MASK), code);
+    free_handle(handle);
+}
+
+static void
+test_get_principal()
+{
+    void *handle;
+    kadm5_principal_ent_rec ent;
+    krb5_principal princ = parse_princ("get-principal-test");
+    krb5_principal admin_princ = parse_princ("admin");
+    krb5_principal admin_none_princ = parse_princ("admin/none");
+    int i;
+
+    /* Fails with unknown principal. */
+    gprinc_test_fail("admin", princ, KADM5_UNK_PRINC);
+
+    create_simple_princ(princ, NULL);
+
+    /* Succeeds with "get" ACL (or local authentication), or operating on
+     * self. */
+    gprinc_test_succeed("admin/none", admin_none_princ);
+    gprinc_test_succeed("$admin", admin_princ);
+    gprinc_test_succeed("admin/get", princ);
+
+    /* Fails over RPC if "get" ACL is not granted, or if we authenticated to
+     * kadmin/changepw and getting another principal entry. */
+    if (rpc) {
+        gprinc_test_fail("$admin", princ, KADM5_AUTH_GET);
+        gprinc_test_fail("admin/none", princ, KADM5_AUTH_GET);
+        gprinc_test_fail("admin/add", princ, KADM5_AUTH_GET);
+        gprinc_test_fail("admin/modify", princ, KADM5_AUTH_GET);
+        gprinc_test_fail("admin/delete", princ, KADM5_AUTH_GET);
+    }
+
+    /* Entry contains no key data or tl-data unless asked for. */
+    handle = get_handle("admin");
+    check(kadm5_get_principal(handle, princ, &ent,
+                              KADM5_PRINCIPAL_NORMAL_MASK));
+    assert(ent.n_tl_data == 0);
+    assert(ent.n_key_data == 0);
+    assert(ent.tl_data == NULL);
+    check(kadm5_free_principal_ent(handle, &ent));
+
+    /* Key data (without the actual keys over RPC) is provided if asked for. */
+    check(kadm5_get_principal(handle, princ, &ent,
+                              KADM5_PRINCIPAL_NORMAL_MASK | KADM5_KEY_DATA));
+    assert(ent.n_key_data == 2);
+    for (i = 0; i < ent.n_key_data; i++)
+        assert(rpc == (ent.key_datai.key_data_length0 == 0));
+    check(kadm5_free_principal_ent(handle, &ent));
+    free_handle(handle);
+
+    /* Fails with null handle or principal. */
+    gprinc_test_fail(NULL, princ, KADM5_BAD_SERVER_HANDLE);
+    gprinc_test_fail("admin", NULL, EINVAL);
+
+    delete_princ(princ);
+    krb5_free_principal(context, princ);
+    krb5_free_principal(context, admin_princ);
+    krb5_free_principal(context, admin_none_princ);
+}
+
+static void
+test_init_destroy()
+{
+    krb5_context ctx;
+    kadm5_ret_t ret;
+    kadm5_config_params params;
+    kadm5_principal_ent_rec ent, gent;
+    krb5_principal princ = parse_princ("init-test");
+    krb5_ccache cc;
+    void *handle;
+    char hostnameMAXHOSTNAMELEN;
+    int r;
+
+    memset(&params, 0, sizeof(params));
+    memset(&ent, 0, sizeof(ent));
+    ent.principal = princ;
+
+    r = gethostname(hostname, sizeof(hostname));
+    assert(r == 0);
+
+    /* Destroy fails with no server handle. */
+    check_fail(kadm5_destroy(NULL), KADM5_BAD_SERVER_HANDLE);
+
+    /* Fails with bad structure version mask. */
+    check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                          0x65432101, api, NULL, &handle),
+               KADM5_BAD_STRUCT_VERSION);
+    check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                          1, api, NULL, &handle), KADM5_BAD_STRUCT_VERSION);
+
+    /* Fails with too-old or too-new structure version. */
+    check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                          KADM5_STRUCT_VERSION_MASK, api, NULL, &handle),
+               KADM5_OLD_STRUCT_VERSION);
+    check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                          KADM5_STRUCT_VERSION_MASK | 0xca, api, NULL,
+                          &handle), KADM5_NEW_STRUCT_VERSION);
+
+    /* Fails with bad API version mask. */
+    check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                          KADM5_STRUCT_VERSION, 0x65432100, NULL, &handle),
+               KADM5_BAD_API_VERSION);
+    check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                          KADM5_STRUCT_VERSION, 4, NULL, &handle),
+               KADM5_BAD_API_VERSION);
+
+    /* Fails with too-old or too-new API version.*/
+    ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                     KADM5_STRUCT_VERSION, KADM5_API_VERSION_MASK, NULL,
+                     &handle);
+    assert(ret == (rpc ? KADM5_OLD_LIB_API_VERSION :
+                   KADM5_OLD_SERVER_API_VERSION));
+    ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                     KADM5_STRUCT_VERSION, KADM5_API_VERSION_MASK | 0xca, NULL,
+                     &handle);
+    assert(ret == (rpc ? KADM5_NEW_LIB_API_VERSION :
+                   KADM5_NEW_SERVER_API_VERSION));
+
+    /* Fails with structure and API version reversed. */
+    check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL,
+                          api, KADM5_STRUCT_VERSION, NULL, &handle),
+               KADM5_BAD_STRUCT_VERSION);
+
+    /* Hardcoded default max lifetime is used when no handle or krb5.conf
+     * setting is given. */
+    handle = get_handle("admin");
+    check(kadm5_create_principal(handle, &ent, KADM5_PRINCIPAL, "pw"));
+    check(kadm5_get_principal(handle, princ, &gent,
+                              KADM5_PRINCIPAL_NORMAL_MASK));
+    assert(gent.max_life == KRB5_KDB_MAX_LIFE);
+    check(kadm5_delete_principal(handle, princ));
+    check(kadm5_free_principal_ent(handle, &gent));
+    free_handle(handle);
+
+    /* Fails with configured unknown realm.  Do these tests in separate krb5
+     * contexts since the realm setting sticks to the context. */
+    check(kadm5_init_krb5_context(&ctx));
+    params.realm = "";
+    params.mask = KADM5_CONFIG_REALM;
+    ret = kadm5_init(ctx, "admin", "admin", KADM5_ADMIN_SERVICE, &params,
+                     KADM5_STRUCT_VERSION, api, NULL, &handle);
+    assert(ret == (rpc ? KADM5_MISSING_KRB5_CONF_PARAMS : ENOENT));
+    krb5_free_context(ctx);
+
+    check(kadm5_init_krb5_context(&ctx));
+    params.realm = "@";
+    ret = kadm5_init(ctx, "admin", "admin", KADM5_ADMIN_SERVICE, &params,
+                     KADM5_STRUCT_VERSION, api, NULL, &handle);
+    assert(ret == (rpc ? KADM5_MISSING_KRB5_CONF_PARAMS : ENOENT));
+    krb5_free_context(ctx);
+
+    check(kadm5_init_krb5_context(&ctx));
+    params.realm = "BAD.REALM";
+    ret = kadm5_init(ctx, "admin", "admin", KADM5_ADMIN_SERVICE, &params,
+                     KADM5_STRUCT_VERSION, api, NULL, &handle);
+    assert(ret == (rpc ? KADM5_MISSING_KRB5_CONF_PARAMS : ENOENT));
+    krb5_free_context(ctx);
+
+    /* Succeeds with explicit client realm and configured realm. */
+    check(kadm5_init_krb5_context(&ctx));
+    params.realm = "KRBTEST.COM";
+    check(kadm5_init(ctx, "admin@KRBTEST.COM", "admin", KADM5_ADMIN_SERVICE,
+                     &params, KADM5_STRUCT_VERSION, api, NULL, &handle));
+    check(kadm5_destroy(handle));
+    krb5_free_context(ctx);
+
+    /* Succeeds with explicit client realm. */
+    check(kadm5_init(context, "admin@KRBTEST.COM", "admin",
+                     KADM5_ADMIN_SERVICE, NULL, KADM5_STRUCT_VERSION, api,
+                     NULL, &handle));
+    check(kadm5_destroy(handle));
+
+
+    if (rpc) {
+        check(krb5_cc_default(context, &cc));
+
+        /* Succeeds with configured host and port. */
+        params.admin_server = hostname;
+        params.kadmind_port = 61001;
+        params.mask = KADM5_CONFIG_ADMIN_SERVER | KADM5_CONFIG_KADMIND_PORT;
+        check(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE,
+                         &params, KADM5_STRUCT_VERSION, api, NULL, &handle));
+        check(kadm5_destroy(handle));
+
+        /* Fails with wrong configured port. */
+        params.kadmind_port = 4;
+        check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE,
+                              &params, KADM5_STRUCT_VERSION, api, NULL,
+                              &handle), KADM5_RPC_ERROR);
+
+        /* Fails with non-resolving hostname. */
+        params.admin_server = "does.not.exist";
+        params.mask = KADM5_CONFIG_ADMIN_SERVER;
+        check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE,
+                              &params, KADM5_STRUCT_VERSION, api, NULL,
+                              &handle), KADM5_CANT_RESOLVE);
+
+        /* Fails with uninitialized cache. */
+        check_fail(kadm5_init_with_creds(context, "admin", cc,
+                                         KADM5_ADMIN_SERVICE, NULL,
+                                         KADM5_STRUCT_VERSION, api, NULL,
+                                         &handle), KRB5_FCC_NOFILE);
+
+        /* Succeeds with cache containing kadmin/admin cred. */
+        kinit(cc, "admin", "admin", KADM5_ADMIN_SERVICE);
+        check(kadm5_init_with_creds(context, "admin", cc, KADM5_ADMIN_SERVICE,
+                                    NULL, KADM5_STRUCT_VERSION, api, NULL,
+                                    &handle));
+        check(kadm5_destroy(handle));
+
+        /* Succeeds with cache containing kadmin/changepw cred. */
+        kinit(cc, "admin", "admin", KADM5_CHANGEPW_SERVICE);
+        check(kadm5_init_with_creds(context, "admin", cc,
+                                    KADM5_CHANGEPW_SERVICE, NULL,
+                                    KADM5_STRUCT_VERSION, api, NULL, &handle));
+        check(kadm5_destroy(handle));
+
+        /* Fails with cache containing only a TGT. */
+        kinit(cc, "admin", "admin", NULL);
+        check_fail(kadm5_init_with_creds(context, "admin", cc,
+                                         KADM5_ADMIN_SERVICE, NULL,
+                                         KADM5_STRUCT_VERSION, api, NULL,
+                                         &handle), KRB5_CC_NOTFOUND);
+
+        /* Fails authenticating to non-kadmin princ. */
+        check_fail(kadm5_init(context, "admin", "admin", "user", NULL,
+                              KADM5_STRUCT_VERSION, api, NULL, &handle),
+                   KADM5_RPC_ERROR);
+
+        /* Fails authenticating to nonexistent princ. */
+        check_fail(kadm5_init(context, "admin", "admin", "noexist", NULL,
+                              KADM5_STRUCT_VERSION, api, NULL, &handle),
+                   KADM5_SECURE_PRINC_MISSING);
+
+        /* Fails authenticating to client princ (which is non-kadmin). */
+        check_fail(kadm5_init(context, "admin", "admin", "admin", NULL,
+                              KADM5_STRUCT_VERSION, api, NULL, &handle),
+                   KADM5_RPC_ERROR);
+
+        /* Fails with wrong password. */
+        check_fail(kadm5_init(context, "admin", "wrong", KADM5_ADMIN_SERVICE,
+                              NULL, KADM5_STRUCT_VERSION, api, NULL, &handle),
+                   KADM5_BAD_PASSWORD);
+
+        /* Fails with null client name. */
+        check_fail(kadm5_init(context, NULL, "admin", KADM5_ADMIN_SERVICE,
+                              NULL, KADM5_STRUCT_VERSION, api, NULL, &handle),
+                   EINVAL);
+
+        /* Fails with nonexistent client name. */
+        check_fail(kadm5_init(context, "noexist", "admin", KADM5_ADMIN_SERVICE,
+                              NULL, KADM5_STRUCT_VERSION, api, NULL, &handle),
+                   KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN);
+
+        /* Fails with nonexistent client name with explicit realm. */
+        check_fail(kadm5_init(context, "noexist@KRBTEST.COM", "admin",
+                              KADM5_ADMIN_SERVICE, NULL, KADM5_STRUCT_VERSION,
+                              api, NULL, &handle),
+                   KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN);
+
+        /* Fails with nonexistent client name with unknown realm. */
+        check_fail(kadm5_init(context, "noexist@BAD.REALM", "admin",
+                              KADM5_ADMIN_SERVICE, NULL, KADM5_STRUCT_VERSION,
+                              api, NULL, &handle), KRB5_REALM_UNKNOWN);
+
+        /* Fails with known name but unknown realm. */
+        check_fail(kadm5_init(context, "admin@BAD.REALM", "admin",
+                              KADM5_ADMIN_SERVICE, NULL, KADM5_STRUCT_VERSION,
+                              api, NULL, &handle), KRB5_REALM_UNKNOWN);
+
+        check(krb5_cc_destroy(context, cc));
+    } else {
+        /* Fails with nonexistent stash file. */
+        params.stash_file = "does/not/exist";
+        params.mask = KADM5_CONFIG_STASH_FILE;
+        check_fail(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE,
+                              &params, KADM5_STRUCT_VERSION, api, NULL,
+                              &handle), KRB5_KDB_CANTREAD_STORED);
+
+        /* Uses configured defaults for principal creation. */
+        params.max_life = 10;
+        params.max_rlife = 20;
+        params.expiration = 30;
+        params.num_keysalts = 0;
+        params.mask = KADM5_CONFIG_MAX_LIFE | KADM5_CONFIG_MAX_RLIFE |
+            KADM5_CONFIG_EXPIRATION | KADM5_CONFIG_ENCTYPES;
+        check(kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE,
+                         &params, KADM5_STRUCT_VERSION, api, NULL, &handle));
+        check(kadm5_create_principal(handle, &ent, KADM5_PRINCIPAL, "pw"));
+        check(kadm5_get_principal(handle, princ, &gent,
+                                  KADM5_PRINCIPAL_NORMAL_MASK |
+                                  KADM5_KEY_DATA));
+        assert(gent.max_life == 10);
+        assert(gent.max_renewable_life == 20);
+        assert(gent.princ_expire_time == 30);
+        assert(gent.n_key_data == 0);
+        check(kadm5_delete_principal(handle, princ));
+        check(kadm5_free_principal_ent(handle, &gent));
+        check(kadm5_destroy(handle));
+
+        /* Succeeds with incorrect password using local auth. */
+        check(kadm5_init(context, "admin", "wrong", KADM5_ADMIN_SERVICE, NULL,
+                         KADM5_STRUCT_VERSION, api, NULL, &handle));
+        check(kadm5_destroy(handle));
+
+        /* Succeeds with null service using local auth. */
+        check(kadm5_init(context, "admin", "admin", NULL, NULL,
+                         KADM5_STRUCT_VERSION, api, NULL, &handle));
+        check(kadm5_destroy(handle));
+
+        /* Succeeds with nonexistent, non-kadmin service using local auth. */
+        check(kadm5_init(context, "admin", "admin", "foobar", NULL,
+                         KADM5_STRUCT_VERSION, api, NULL, &handle));
+        check(kadm5_destroy(handle));
+    }
+
+    krb5_free_principal(context, princ);
+}
+
+static void
+mpol_test_fail(char *user, kadm5_policy_ent_t ent, uint32_t mask,
+               krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_modify_policy(handle, ent, mask), code);
+    free_handle(handle);
+}
+
+static void
+mpol_test_compare(void *handle, kadm5_policy_ent_t ent, uint32_t mask)
+{
+    mpol_test_fail(handle, ent, mask, 0);
+    compare_policy(ent, mask);
+}
+
+static void
+test_modify_policy()
+{
+    kadm5_policy_ent_rec ent;
+
+    memset(&ent, 0, sizeof(ent));
+    ent.policy = "modify-policy-test";
+    create_simple_policy(ent.policy);
+
+    /* pw_min_life = 0 and pw_min_life != 0 */
+    mpol_test_compare("admin", &ent, KADM5_PW_MIN_LIFE);
+    ent.pw_min_life = 32;
+    mpol_test_compare("admin", &ent, KADM5_PW_MIN_LIFE);
+
+    /* pw_max_life = 0 and pw_max_life != 0 */
+    mpol_test_compare("admin", &ent, KADM5_PW_MAX_LIFE);
+    ent.pw_max_life = 32;
+    mpol_test_compare("admin", &ent, KADM5_PW_MAX_LIFE);
+
+    /* pw_min_length = 0 (rejected) and pw_min_length != 0 */
+    mpol_test_fail("admin", &ent, KADM5_PW_MIN_LENGTH, KADM5_BAD_LENGTH);
+    ent.pw_min_length = 8;
+    mpol_test_compare("admin", &ent, KADM5_PW_MIN_LENGTH);
+
+    /* pw_min_classes = 0 (rejected), 1, 5, 6 (rejected) */
+    mpol_test_fail("admin", &ent, KADM5_PW_MIN_CLASSES, KADM5_BAD_CLASS);
+    ent.pw_min_classes = 1;
+    mpol_test_compare("admin", &ent, KADM5_PW_MIN_CLASSES);
+    ent.pw_min_classes = 5;
+    mpol_test_compare("admin", &ent, KADM5_PW_MIN_CLASSES);
+    ent.pw_min_classes = 6;
+    mpol_test_fail("admin", &ent, KADM5_PW_MIN_CLASSES, KADM5_BAD_CLASS);
+
+    /* pw_history_num = 0 (rejected), 1, 10 */
+    mpol_test_fail("admin", &ent, KADM5_PW_HISTORY_NUM, KADM5_BAD_HISTORY);
+    ent.pw_history_num = 1;
+    mpol_test_compare("admin", &ent, KADM5_PW_HISTORY_NUM);
+    ent.pw_history_num = 10;
+    mpol_test_compare("admin", &ent, KADM5_PW_HISTORY_NUM);
+
+    if (api >= KADM5_API_VERSION_3) {
+        ent.pw_max_fail = 2;
+        mpol_test_compare("admin", &ent, KADM5_PW_MAX_FAILURE);
+        ent.pw_failcnt_interval = 90;
+        mpol_test_compare("admin", &ent, KADM5_PW_FAILURE_COUNT_INTERVAL);
+        ent.pw_lockout_duration = 180;
+        mpol_test_compare("admin", &ent, KADM5_PW_LOCKOUT_DURATION);
+    }
+
+    /* Fails over RPC if "modify" ACL is not granted, or if we authenticated to
+     * kadmin/changepw. */
+    if (rpc) {
+        mpol_test_fail("$admin", &ent, KADM5_PW_MAX_LIFE, KADM5_AUTH_MODIFY);
+        mpol_test_fail("admin/none", &ent, KADM5_PW_MAX_LIFE,
+                       KADM5_AUTH_MODIFY);
+        mpol_test_fail("admin/get", &ent, KADM5_PW_MAX_LIFE,
+                       KADM5_AUTH_MODIFY);
+        mpol_test_compare("admin/modify", &ent, KADM5_PW_MAX_LIFE);
+    }
+
+    delete_policy(ent.policy);
+
+    /* Fails with empty or null policy name. */
+    ent.policy = NULL;
+    mpol_test_fail("admin", &ent, KADM5_PW_MAX_LIFE, EINVAL);
+    ent.policy = "";
+    mpol_test_fail("admin", &ent, KADM5_PW_MAX_LIFE, KADM5_BAD_POLICY);
+
+    /* Fails with null handle or policy ent. */
+    mpol_test_fail(NULL, &ent, KADM5_PW_MAX_LIFE, KADM5_BAD_SERVER_HANDLE);
+    mpol_test_fail("admin", NULL, KADM5_PW_MAX_LIFE, EINVAL);
+}
+
+static void
+mprinc_test_fail(char *user, kadm5_principal_ent_t ent, uint32_t mask,
+                 krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_modify_principal(handle, ent, mask), code);
+    free_handle(handle);
+}
+
+static void
+mprinc_test_compare(char *user, kadm5_principal_ent_t ent, uint32_t mask)
+{
+    mprinc_test_fail(user, ent, mask, 0);
+    compare_princ(ent, mask);
+}
+
+static void
+test_modify_principal()
+{
+    void *handle;
+    krb5_principal princ = parse_princ("modify-principal-test");
+    kadm5_principal_ent_rec ent;
+    krb5_tl_data tl = { NULL, 1, 1, (uint8_t *)"x" };
+    krb5_tl_data tl2 = { NULL, 999, 6, (uint8_t *)"foobar" };
+
+    memset(&ent, 0, sizeof(ent));
+    ent.principal = princ;
+
+    /* Fails with unknown principal. */
+    mprinc_test_fail("admin", &ent, KADM5_KVNO, KADM5_UNK_PRINC);
+
+    create_simple_princ(princ, NULL);
+
+    /* Fails with prohibited mask bit or tl-data type. */
+    mprinc_test_fail("admin", &ent, KADM5_AUX_ATTRIBUTES, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_KEY_DATA, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_LAST_FAILED, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_LAST_SUCCESS, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_LAST_PWD_CHANGE, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_MKVNO, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_MOD_NAME, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_MOD_TIME, KADM5_BAD_MASK);
+    mprinc_test_fail("admin", &ent, KADM5_PRINCIPAL, KADM5_BAD_MASK);
+
+    /* Fails with tl-data type below 256. */
+    ent.n_tl_data = 1;
+    ent.tl_data = &tl;
+    mprinc_test_fail("admin", &ent, KADM5_TL_DATA, KADM5_BAD_TL_TYPE);
+
+    /* Fails with fail_auth_count other than zero. */
+    ent.fail_auth_count = 1234;
+    mprinc_test_fail("admin", &ent, KADM5_FAIL_AUTH_COUNT,
+                     KADM5_BAD_SERVER_PARAMS);
+    ent.fail_auth_count = 0;
+
+    /* Succeeds with zero values of various fields. */
+    mprinc_test_compare("admin", &ent, KADM5_PW_EXPIRATION);
+    mprinc_test_compare("admin", &ent, KADM5_MAX_LIFE);
+    mprinc_test_compare("admin", &ent, KADM5_MAX_RLIFE);
+    mprinc_test_compare("admin", &ent, KADM5_FAIL_AUTH_COUNT);
+    mprinc_test_compare("admin/modify", &ent, KADM5_PRINC_EXPIRE_TIME);
+    mprinc_test_compare("admin", &ent, KADM5_POLICY_CLR);
+
+    /* Setting a policy causes a pw_expiration computation.  Explicit
+     * PW_EXPIRATION overrides the policy. */
+    ent.pw_expiration = 1234;
+    mprinc_test_compare("admin", &ent, KADM5_PW_EXPIRATION);
+    ent.policy = "dict-only-pol";
+    mprinc_test_compare("admin", &ent, KADM5_POLICY);
+    ent.policy = "test-pol";
+    mprinc_test_compare("admin", &ent, KADM5_POLICY);
+    ent.pw_expiration = 999999999;
+    mprinc_test_compare("admin", &ent, KADM5_PW_EXPIRATION);
+    mprinc_test_compare("admin", &ent, KADM5_POLICY_CLR);
+
+    /* Succeeds with non-zero values of various fields. */
+    ent.princ_expire_time = 1234;
+    mprinc_test_compare("admin", &ent, KADM5_PRINC_EXPIRE_TIME);
+    ent.attributes = KRB5_KDB_DISALLOW_ALL_TIX;
+    mprinc_test_compare("admin", &ent, KADM5_ATTRIBUTES);
+    ent.attributes = KRB5_KDB_REQUIRES_PWCHANGE;
+    mprinc_test_compare("admin", &ent, KADM5_ATTRIBUTES);
+    ent.attributes = KRB5_KDB_DISALLOW_TGT_BASED;
+    mprinc_test_compare("admin", &ent, KADM5_ATTRIBUTES);
+    ent.max_life = 3456;
+    mprinc_test_compare("admin", &ent, KADM5_MAX_LIFE);
+    ent.kvno = 7;
+    mprinc_test_compare("admin", &ent, KADM5_KVNO);
+
+    /* Fails over RPC if "modify" ACL is not granted, or if we authenticated to
+     * kadmin/changepw. */
+    if (rpc) {
+        mprinc_test_fail("$admin", &ent, KADM5_KVNO, KADM5_AUTH_MODIFY);
+        mprinc_test_fail("admin/none", &ent, KADM5_KVNO, KADM5_AUTH_MODIFY);
+        mprinc_test_fail("admin/get", &ent, KADM5_KVNO, KADM5_AUTH_MODIFY);
+        mprinc_test_fail("admin/add", &ent, KADM5_KVNO, KADM5_AUTH_MODIFY);
+        mprinc_test_fail("admin/delete", &ent, KADM5_KVNO, KADM5_AUTH_MODIFY);
+    }
+
+    /* tl-data of type > 255 is accepted. */
+    handle = get_handle("admin");
+    ent.max_renewable_life = 88;
+    ent.tl_data = &tl2;
+    check(kadm5_modify_principal(handle, &ent,
+                                 KADM5_MAX_RLIFE | KADM5_TL_DATA));
+    memset(&ent, 0, sizeof(ent));
+    check(kadm5_get_principal(handle, princ, &ent,
+                              KADM5_PRINCIPAL_NORMAL_MASK | KADM5_TL_DATA));
+    assert(ent.max_renewable_life == 88);
+    assert(ent.n_tl_data == 1);
+    assert(ent.tl_data->tl_data_type == tl2.tl_data_type);
+    assert(ent.tl_data->tl_data_length == tl2.tl_data_length);
+    assert(memcmp(ent.tl_data->tl_data_contents, tl2.tl_data_contents,
+                  tl2.tl_data_length) == 0);
+    check(kadm5_free_principal_ent(handle, &ent));
+    free_handle(handle);
+
+    /* Fails with null handle or principal ent. */
+    mprinc_test_fail(NULL, &ent, KADM5_KVNO, KADM5_BAD_SERVER_HANDLE);
+    mprinc_test_fail("admin", NULL, KADM5_KVNO, EINVAL);
+
+    delete_princ(princ);
+    krb5_free_principal(context, princ);
+}
+
+static void
+rnd_test_fail(char *user, krb5_principal princ, krb5_error_code code)
+{
+    void *handle = get_handle(user);
+
+    check_fail(kadm5_randkey_principal(handle, princ, NULL, NULL), code);
+    free_handle(handle);
+}
+
+static void
+rnd_test_succeed(char *user, krb5_principal princ)
+{
+    rnd_test_fail(user, princ, 0);
+}
+
+static void
+test_randkey()
+{
+    void *handle;
+    krb5_principal princ = parse_princ("randkey-principal-test");
+    krb5_principal user_princ = parse_princ("user");
+    krb5_principal admin_princ = parse_princ("admin");
+    kadm5_principal_ent_rec ent;
+    krb5_keyblock *keys;
+    int n_keys, i;
+
+    create_simple_princ(princ, NULL);
+
+    /* Check kvno and enctypes after randkey. */
+    handle = get_handle("admin");
+    check(kadm5_randkey_principal(handle, princ, &keys, &n_keys));
+    check(kadm5_get_principal(handle, princ, &ent, KADM5_KEY_DATA));
+    compare_key_data(&ent, default_supported_enctypes);
+    assert(ent.key_data0.key_data_kvno == 2);
+    assert(n_keys == ent.n_key_data);
+    for (i = 0; i < n_keys; i++)
+        krb5_free_keyblock_contents(context, &keysi);
+    free(keys);
+    check(kadm5_free_principal_ent(handle, &ent));
+    free_handle(handle);
+
+    /*
+     * Fails over RPC if "change" ACL is not granted, or if we authenticated to
+     * kadmin/changepw and are changing another principal's password, or for
+     * self-service if the policy minimum life has not elapsed since the last
+     * key change.
+     */
+    if (rpc) {
+        rnd_test_fail("$admin", user_princ, KADM5_AUTH_CHANGEPW);
+        rnd_test_fail("admin/none", user_princ, KADM5_AUTH_CHANGEPW);
+        rnd_test_fail("admin/delete", user_princ, KADM5_AUTH_CHANGEPW);
+        rnd_test_succeed("admin/modify", user_princ);
+        cpw_test_succeed("admin", user_princ, USER_PASSWORD);
+        rnd_test_fail("user", user_princ, KADM5_PASS_TOOSOON);
+        rnd_test_fail("$user", user_princ, KADM5_PASS_TOOSOON);
+    }
+
+    /* Succeeds with change privilege in spite of policy minimum life. */
+    rnd_test_succeed("admin/modify", user_princ);
+    cpw_test_succeed("admin", user_princ, USER_PASSWORD);
+
+    /* Succeeds for self-service when authenticating to kadmin/changepw. */
+    handle = get_handle("$admin");
+    check(kadm5_randkey_principal(handle, admin_princ, NULL, NULL));
+    check(kadm5_chpass_principal(handle, admin_princ, ADMIN_PASSWORD));
+    free_handle(handle);
+
+    /* Fails with null handle or principal name. */
+    rnd_test_fail(NULL, princ, KADM5_BAD_SERVER_HANDLE);
+    rnd_test_fail("admin", NULL, EINVAL);
+
+    delete_princ(princ);
+    krb5_free_principal(context, princ);
+    krb5_free_principal(context, user_princ);
+    krb5_free_principal(context, admin_princ);
+}
+
+int
+main(int argc, char **argv)
+{
+    assert(argc == 2);
+    rpc = (strcmp(argv1, "clnt") == 0);
+
+    check(kadm5_init_krb5_context(&context));
+
+    api = KADM5_API_VERSION_2;
+    test_create_policy();
+    test_get_policy();
+    test_modify_policy();
+
+    api = KADM5_API_VERSION_4;
+    test_chpass();
+    test_create_policy();
+    test_create_principal();
+    test_delete_policy();
+    test_delete_principal();
+    test_get_policy();
+    test_get_principal();
+    test_init_destroy();
+    test_modify_policy();
+    test_modify_principal();
+    test_randkey();
+
+    krb5_free_context(context);
+
+    return 0;
+}

_service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kadm5/t_kadm5.py Added

@@ -0,0 +1,45 @@
+from k5test import *
+
+# Specify a supported_enctypes so the chpass tests know what to expect.
+supported_enctypes = 'aes256-cts:normal aes128-cts:normal'
+conf = {'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
+realm = K5Realm(create_user=False, create_host=False, kdc_conf=conf)
+
+with open(os.path.join(realm.testdir, 'acl'), 'w') as f:
+    f.write('''
+admin                   admcilse
+admin/get               il
+admin/modify            mc
+admin/delete            d
+admin/add               a
+admin/rename            adil
+''')
+
+with open(os.path.join(realm.testdir, 'dictfile'), 'w') as f:
+    f.write('''
+Abyssinia
+Discordianism
+foo
+''')
+
+realm.start_kadmind()
+
+realm.run(kadminl, 'addpol', '-maxlife', '10000s', '-minlength', '8',
+           '-minclasses', '2', '-maxfailure', '2',
+           '-failurecountinterval', '90s', '-lockoutduration', '180s',
+           'test-pol')
+realm.run(kadminl, 'addpol', '-minlife', '10s', 'minlife-pol')
+realm.run(kadminl, 'addpol', 'dict-only-pol')
+realm.run(kadminl, 'addprinc', '-pw', 'admin', 'admin')
+realm.run(kadminl, 'addprinc', '-pw', 'admin', 'admin/get')
+realm.run(kadminl, 'addprinc', '-pw', 'admin', 'admin/modify')
+realm.run(kadminl, 'addprinc', '-pw', 'admin', 'admin/delete')
+realm.run(kadminl, 'addprinc', '-pw', 'admin', 'admin/add')
+realm.run(kadminl, 'addprinc', '-pw', 'admin', 'admin/rename')
+realm.run(kadminl, 'addprinc', '-pw', 'admin', 'admin/none')
+realm.run(kadminl, 'addprinc', '-pw', 'us3r', '-policy', 'minlife-pol',
+           'user')
+
+realm.run('./t_kadm5srv', 'srv')
+realm.run('./t_kadm5clnt', 'clnt')
+success('kadm5 API tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kdb/kdb5.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kdb/kdb5.c Changed

@@ -315,7 +315,6 @@
     out->promote_db = in->promote_db;
     out->decrypt_key_data = in->decrypt_key_data;
     out->encrypt_key_data = in->encrypt_key_data;
-    out->sign_authdata = in->sign_authdata;
     out->check_transited_realms = in->check_transited_realms;
     out->check_policy_as = in->check_policy_as;
     out->check_policy_tgs = in->check_policy_tgs;
@@ -325,8 +324,7 @@
     out->free_principal_e_data = in->free_principal_e_data;
     out->get_s4u_x509_principal = in->get_s4u_x509_principal;
     out->allowed_to_delegate_from = in->allowed_to_delegate_from;
-    out->get_authdata_info = in->get_authdata_info;
-    out->free_authdata_info = in->free_authdata_info;
+    out->issue_pac = in->issue_pac;
 
     /* Set defaults for optional fields. */
     if (out->fetch_master_key == NULL)
@@ -675,6 +673,8 @@
         return status;
     status = v->init_module(kcontext, section, db_args, mode);
     free(section);
+    if (status)
+        (void)krb5_db_fini(kcontext);
     return status;
 }
 
@@ -702,6 +702,8 @@
         return status;
     status = v->create(kcontext, section, db_args);
     free(section);
+    if (status)
+        (void)krb5_db_fini(kcontext);
     return status;
 }
 
@@ -1445,8 +1447,11 @@
     if (asprintf(&fname, "%s%s%s", keyname, REALM_SEP_STRING, realm) < 0)
         return ENOMEM;
 
-    if ((retval = krb5_parse_name(context, fname, principal)))
+    retval = krb5_parse_name(context, fname, principal);
+    if (retval) {
+        free(fname);
         return retval;
+    }
     if (fullname)
         *fullname = fname;
     else
@@ -2590,34 +2595,6 @@
 }
 
 krb5_error_code
-krb5_db_sign_authdata(krb5_context kcontext, unsigned int flags,
-                      krb5_const_principal client_princ,
-                      krb5_const_principal server_princ, krb5_db_entry *client,
-                      krb5_db_entry *server, krb5_db_entry *header_server,
-                      krb5_db_entry *local_tgt, krb5_keyblock *client_key,
-                      krb5_keyblock *server_key, krb5_keyblock *header_key,
-                      krb5_keyblock *local_tgt_key, krb5_keyblock *session_key,
-                      krb5_timestamp authtime, krb5_authdata **tgt_auth_data,
-                      void *ad_info, krb5_data ***auth_indicators,
-                      krb5_authdata ***signed_auth_data)
-{
-    krb5_error_code status = 0;
-    kdb_vftabl *v;
-
-    *signed_auth_data = NULL;
-    status = get_vftabl(kcontext, &v);
-    if (status)
-        return status;
-    if (v->sign_authdata == NULL)
-        return KRB5_PLUGIN_OP_NOTSUPP;
-    return v->sign_authdata(kcontext, flags, client_princ, server_princ,
-                            client, server, header_server, local_tgt,
-                            client_key, server_key, header_key, local_tgt_key,
-                            session_key, authtime, tgt_auth_data, ad_info,
-                            auth_indicators, signed_auth_data);
-}
-
-krb5_error_code
 krb5_db_check_transited_realms(krb5_context kcontext,
                                const krb5_data *tr_contents,
                                const krb5_data *client_realm,
@@ -2750,7 +2727,7 @@
 krb5_db_allowed_to_delegate_from(krb5_context kcontext,
                                  krb5_const_principal client,
                                  krb5_const_principal server,
-                                 void *server_ad_info,
+                                 krb5_pac server_pac,
                                  const krb5_db_entry *proxy)
 {
     krb5_error_code ret;
@@ -2761,50 +2738,8 @@
         return ret;
     if (v->allowed_to_delegate_from == NULL)
         return KRB5_PLUGIN_OP_NOTSUPP;
-    return v->allowed_to_delegate_from(kcontext, client, server,
-                                       server_ad_info, proxy);
-}
-
-krb5_error_code
-krb5_db_get_authdata_info(krb5_context kcontext, unsigned int flags,
-                          krb5_authdata **in_authdata,
-                          krb5_const_principal client_princ,
-                          krb5_const_principal server_princ,
-                          krb5_keyblock *server_key, krb5_keyblock *krbtgt_key,
-                          krb5_db_entry *krbtgt, krb5_timestamp authtime,
-                          void **ad_info_out, krb5_principal *client_out)
-{
-    krb5_error_code ret;
-    kdb_vftabl *v;
-
-    *ad_info_out = NULL;
-    if (client_out != NULL)
-        *client_out = NULL;
-
-    ret = get_vftabl(kcontext, &v);
-    if (ret)
-        return ret;
-    if (v->get_authdata_info == NULL)
-        return KRB5_PLUGIN_OP_NOTSUPP;
-    return v->get_authdata_info(kcontext, flags, in_authdata, client_princ,
-                                server_princ, server_key, krbtgt_key, krbtgt,
-                                authtime, ad_info_out, client_out);
-}
-
-void
-krb5_db_free_authdata_info(krb5_context kcontext, void *ad_info)
-{
-    krb5_error_code ret;
-    kdb_vftabl *v;
-
-    if (ad_info == NULL)
-        return;
-    ret = get_vftabl(kcontext, &v);
-    if (ret)
-        return;
-    if (v->free_authdata_info == NULL)
-        return;
-    v->free_authdata_info(kcontext, ad_info);
+    return v->allowed_to_delegate_from(kcontext, client, server, server_pac,
+                                       proxy);
 }
 
 void
@@ -2825,3 +2760,22 @@
         }
     }
 }
+
+krb5_error_code
+krb5_db_issue_pac(krb5_context context, unsigned int flags,
+                  krb5_db_entry *client, krb5_keyblock *replaced_reply_key,
+                  krb5_db_entry *server, krb5_db_entry *krbtgt,
+                  krb5_timestamp authtime, krb5_pac old_pac, krb5_pac new_pac,
+                  krb5_data ***auth_indicators)
+{
+    krb5_error_code ret;
+    kdb_vftabl *v;
+
+    ret = get_vftabl(context, &v);
+    if (ret)
+        return ret;
+    if (v->issue_pac == NULL)
+        return KRB5_PLUGIN_OP_NOTSUPP;
+    return v->issue_pac(context, flags, client, replaced_reply_key, server,
+                        krbtgt, authtime, old_pac, new_pac, auth_indicators);
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kdb/kdb_convert.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kdb/kdb_convert.c Changed

@@ -550,7 +550,7 @@
 ulog_conv_2dbentry(krb5_context context, krb5_db_entry **entry,
                    kdb_incr_update_t *update)
 {
-    krb5_db_entry *ent;
+    krb5_db_entry *ent = NULL;
     int replica;
     krb5_principal mod_princ = NULL;
     int i, j, cnt = 0, mod_time = 0, nattrs;
@@ -572,23 +572,20 @@
      */
     nattrs = update->kdb_update.kdbe_t_len;
 
-    dbprincstr = malloc((update->kdb_princ_name.utf8str_t_len + 1)
-                        * sizeof (char));
+    dbprincstr = k5memdup0(update->kdb_princ_name.utf8str_t_val,
+                           update->kdb_princ_name.utf8str_t_len, &ret);
     if (dbprincstr == NULL)
-        return (ENOMEM);
-    strncpy(dbprincstr, (char *)update->kdb_princ_name.utf8str_t_val,
-            update->kdb_princ_name.utf8str_t_len);
-    dbprincstrupdate->kdb_princ_name.utf8str_t_len = 0;
+        goto cleanup;
 
     ret = krb5_parse_name(context, dbprincstr, &dbprinc);
     free(dbprincstr);
     if (ret)
-        return (ret);
+        goto cleanup;
 
     ret = krb5_db_get_principal(context, dbprinc, 0, &ent);
     krb5_free_principal(context, dbprinc);
     if (ret && ret != KRB5_KDB_NOENTRY)
-        return (ret);
+        goto cleanup;
     is_add = (ret == KRB5_KDB_NOENTRY);
 
     /*
@@ -643,8 +640,10 @@
 
         case AT_PRINC:
             tmpprinc = conv_princ_2db(context, &u.av_princ);
-            if (tmpprinc == NULL)
-                return ENOMEM;
+            if (tmpprinc == NULL) {
+                ret = ENOMEM;
+                goto cleanup;
+            }
             krb5_free_principal(context, ent->princ);
             ent->princ = tmpprinc;
             break;
@@ -661,8 +660,10 @@
             /* Allocate one extra key data to avoid allocating zero bytes. */
             newptr = realloc(ent->key_data, (ent->n_key_data + 1) *
                              sizeof(krb5_key_data));
-            if (newptr == NULL)
-                return ENOMEM;
+            if (newptr == NULL) {
+                ret = ENOMEM;
+                goto cleanup;
+            }
             ent->key_data = newptr;
 
 /* BEGIN CSTYLED */
@@ -677,7 +678,8 @@
                 kp->key_data_ver = (krb5_int16)kv->k_ver;
                 kp->key_data_kvno = (krb5_ui_2)kv->k_kvno;
                 if (kp->key_data_ver > 2) {
-                    return EINVAL; /* XXX ? */
+                    ret = EINVAL; /* XXX ? */
+                    goto cleanup;
                 }
 
                 for (cnt = 0; cnt < kp->key_data_ver; cnt++) {
@@ -685,8 +687,10 @@
                     kp->key_data_lengthcnt = (krb5_int16)kv->k_contents.k_contents_valcnt.utf8str_t_len;
                     newptr = realloc(kp->key_data_contentscnt,
                                      kp->key_data_lengthcnt);
-                    if (newptr == NULL)
-                        return ENOMEM;
+                    if (newptr == NULL) {
+                        ret = ENOMEM;
+                        goto cleanup;
+                    }
                     kp->key_data_contentscnt = newptr;
 
                     (void) memset(kp->key_data_contentscnt, 0,
@@ -704,22 +708,26 @@
                 newtl.tl_data_length = (krb5_int16)u.av_tldata.av_tldata_valj.tl_data.tl_data_len;
                 newtl.tl_data_contents = (krb5_octet *)u.av_tldata.av_tldata_valj.tl_data.tl_data_val;
                 newtl.tl_data_next = NULL;
-                if ((ret = krb5_dbe_update_tl_data(context, ent, &newtl)))
-                    return (ret);
+                ret = krb5_dbe_update_tl_data(context, ent, &newtl);
+                if (ret)
+                    goto cleanup;
             }
             break;
 /* END CSTYLED */
         }
         case AT_PW_LAST_CHANGE:
-            if ((ret = krb5_dbe_update_last_pwd_change(context, ent,
-                                                       u.av_pw_last_change)))
-                return (ret);
+            ret = krb5_dbe_update_last_pwd_change(context, ent,
+                                                  u.av_pw_last_change);
+            if (ret)
+                goto cleanup;
             break;
 
         case AT_MOD_PRINC:
             tmpprinc = conv_princ_2db(context, &u.av_mod_princ);
-            if (tmpprinc == NULL)
-                return ENOMEM;
+            if (tmpprinc == NULL) {
+                ret = ENOMEM;
+                goto cleanup;
+            }
             mod_princ = tmpprinc;
             break;
 
@@ -743,14 +751,17 @@
     if (mod_time && mod_princ) {
         ret = krb5_dbe_update_mod_princ_data(context, ent,
                                              mod_time, mod_princ);
-        krb5_free_principal(context, mod_princ);
-        mod_princ = NULL;
         if (ret)
-            return (ret);
+            goto cleanup;
     }
 
     *entry = ent;
-    return (0);
+    ent = NULL;
+    ret = 0;
+cleanup:
+    krb5_db_free_principal(context, ent);
+    krb5_free_principal(context, mod_princ);
+    return ret;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/kdb/libkdb5.exports -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/kdb/libkdb5.exports Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krad/attrset.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krad/attrset.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krad/client.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krad/client.c Changed

@@ -64,7 +64,6 @@
 
 struct server_st {
     krad_remote *serv;
-    time_t last;
     K5_LIST_ENTRY(server_st) list;
 };
 
@@ -81,15 +80,10 @@
            krad_remote **out)
 {
     krb5_error_code retval;
-    time_t currtime;
     server *srv;
 
-    if (time(&currtime) == (time_t)-1)
-        return errno;
-
     K5_LIST_FOREACH(srv, &rc->servers, list) {
         if (kr_remote_equals(srv->serv, ai, secret)) {
-            srv->last = currtime;
             *out = srv->serv;
             return 0;
         }
@@ -98,7 +92,6 @@
     srv = calloc(1, sizeof(server));
     if (srv == NULL)
         return ENOMEM;
-    srv->last = currtime;
 
     retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv);
     if (retval != 0) {
@@ -173,28 +166,12 @@
     return 0;
 }
 
-/* Close remotes that haven't been used in a while. */
-static void
-age(struct server_head *head, time_t currtime)
-{
-    server *srv, *tmp;
-
-    K5_LIST_FOREACH_SAFE(srv, head, list, tmp) {
-        if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) {
-            K5_LIST_REMOVE(srv, list);
-            kr_remote_free(srv->serv);
-            free(srv);
-        }
-    }
-}
-
 /* Handle a response from a server (or related errors). */
 static void
 on_response(krb5_error_code retval, const krad_packet *reqp,
             const krad_packet *rspp, void *data)
 {
     request *req = data;
-    time_t currtime;
     size_t i;
 
     /* Do nothing if we are already completed. */
@@ -221,10 +198,6 @@
     for (i = 0; req->remotesi.remote != NULL; i++)
         kr_remote_cancel(req->remotesi.remote, req->remotesi.packet);
 
-    /* Age out servers that haven't been used in a while. */
-    if (time(&currtime) != (time_t)-1)
-        age(&req->rc->servers, currtime);
-
     request_free(req);
 }
 
@@ -247,10 +220,23 @@
 void
 krad_client_free(krad_client *rc)
 {
+    server *srv;
+
     if (rc == NULL)
         return;
 
-    age(&rc->servers, -1);
+    /* Cancel all requests before freeing any remotes, since each request's
+     * callback data may contain references to multiple remotes. */
+    K5_LIST_FOREACH(srv, &rc->servers, list)
+        kr_remote_cancel_all(srv->serv);
+
+    while (!K5_LIST_EMPTY(&rc->servers)) {
+        srv = K5_LIST_FIRST(&rc->servers);
+        K5_LIST_REMOVE(srv, list);
+        kr_remote_free(srv->serv);
+        free(srv);
+    }
+
     free(rc);
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krad/internal.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krad/internal.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krad/remote.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krad/remote.c Changed

@@ -422,14 +422,19 @@
 }
 
 void
+kr_remote_cancel_all(krad_remote *rr)
+{
+    while (!K5_TAILQ_EMPTY(&rr->list))
+        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
+}
+
+void
 kr_remote_free(krad_remote *rr)
 {
     if (rr == NULL)
         return;
 
-    while (!K5_TAILQ_EMPTY(&rr->list))
-        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
-
+    kr_remote_cancel_all(rr);
     free(rr->secret);
     if (rr->info != NULL)
         free(rr->info->ai_addr);
@@ -445,7 +450,7 @@
 {
     krad_packet *tmp = NULL;
     krb5_error_code retval;
-    request *r;
+    request *r, *new_request = NULL;
 
     if (rr->info->ai_socktype == SOCK_STREAM)
         retries = 0;
@@ -464,7 +469,7 @@
     }
 
     timeout = timeout / (retries + 1);
-    retval = request_new(rr, tmp, timeout, retries, cb, data, &r);
+    retval = request_new(rr, tmp, timeout, retries, cb, data, &new_request);
     if (retval != 0)
         goto error;
 
@@ -472,12 +477,13 @@
     if (retval != 0)
         goto error;
 
-    K5_TAILQ_INSERT_TAIL(&rr->list, r, list);
+    K5_TAILQ_INSERT_TAIL(&rr->list, new_request, list);
     if (pkt != NULL)
         *pkt = tmp;
     return 0;
 
 error:
+    free(new_request);
     krad_packet_free(tmp);
     return retval;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krad/t_daemon.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krad/t_daemon.py Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krad/t_packet.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krad/t_packet.c Changed

@@ -57,6 +57,14 @@
     krb5_error_code retval;
     const krb5_data *data;
     int i = 0;
+    krb5_data nas_id;
+
+    nas_id = string2data("12345678901234567890123456789012345678901234567890"
+                         "12345678901234567890123456789012345678901234567890"
+                         "12345678901234567890123456789012345678901234567890"
+                         "12345678901234567890123456789012345678901234567890"
+                         "12345678901234567890123456789012345678901234567890"
+                         "123");
 
     retval = krad_attrset_new(ctx, &set);
     if (retval != 0)
@@ -71,6 +79,11 @@
     if (retval != 0)
         goto out;
 
+    retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"),
+                              &nas_id);
+    if (retval != 0)
+        goto out;
+
     retval = krad_packet_new_request(ctx, "foo",
                                      krad_code_name2num("Access-Request"),
                                      set, iterator, &i, &tmp);

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/asn.1/asn1_k_encode.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/asn.1/asn1_k_encode.c Changed

@@ -1091,33 +1091,6 @@
 DEFOPTIONALEMPTYTYPE(opt_ptr_seqof_princ_plus_realm,
                      ptr_seqof_princ_plus_realm);
 
-DEFFIELD(spdata_0, krb5_ad_signedpath_data, client, 0, princ_plus_realm);
-DEFFIELD(spdata_1, krb5_ad_signedpath_data, authtime, 1, kerberos_time);
-DEFFIELD(spdata_2, krb5_ad_signedpath_data, delegated, 2,
-         opt_ptr_seqof_princ_plus_realm);
-DEFFIELD(spdata_3, krb5_ad_signedpath_data, method_data, 3,
-         opt_ptr_seqof_pa_data);
-DEFFIELD(spdata_4, krb5_ad_signedpath_data, authorization_data, 4,
-         opt_auth_data_ptr);
-static const struct atype_info *ad_signedpath_data_fields = {
-    &k5_atype_spdata_0, &k5_atype_spdata_1, &k5_atype_spdata_2,
-    &k5_atype_spdata_3, &k5_atype_spdata_4
-};
-DEFSEQTYPE(ad_signedpath_data, krb5_ad_signedpath_data,
-           ad_signedpath_data_fields);
-
-DEFFIELD(signedpath_0, krb5_ad_signedpath, enctype, 0, int32);
-DEFFIELD(signedpath_1, krb5_ad_signedpath, checksum, 1, checksum);
-DEFFIELD(signedpath_2, krb5_ad_signedpath, delegated, 2,
-         opt_ptr_seqof_princ_plus_realm);
-DEFFIELD(signedpath_3, krb5_ad_signedpath, method_data, 3,
-         opt_ptr_seqof_pa_data);
-static const struct atype_info *ad_signedpath_fields = {
-    &k5_atype_signedpath_0, &k5_atype_signedpath_1, &k5_atype_signedpath_2,
-    &k5_atype_signedpath_3
-};
-DEFSEQTYPE(ad_signedpath, krb5_ad_signedpath, ad_signedpath_fields);
-
 /* First context tag is 1, not 0. */
 DEFFIELD(iakerb_header_1, krb5_iakerb_header, target_realm, 1, ostring_data);
 DEFFIELD(iakerb_header_2, krb5_iakerb_header, cookie, 2, opt_ostring_data_ptr);
@@ -1323,9 +1296,6 @@
 
 MAKE_ENCODER(encode_krb5_ad_kdcissued, ad_kdc_issued);
 MAKE_DECODER(decode_krb5_ad_kdcissued, ad_kdc_issued);
-MAKE_ENCODER(encode_krb5_ad_signedpath_data, ad_signedpath_data);
-MAKE_ENCODER(encode_krb5_ad_signedpath, ad_signedpath);
-MAKE_DECODER(decode_krb5_ad_signedpath, ad_signedpath);
 MAKE_ENCODER(encode_krb5_iakerb_header, iakerb_header);
 MAKE_DECODER(decode_krb5_iakerb_header, iakerb_header);
 MAKE_ENCODER(encode_krb5_iakerb_finished, iakerb_finished);
@@ -1446,19 +1416,8 @@
                      ASN1_BITSTRING);
 DEFCOUNTEDTYPE(bitstring_data, krb5_data, data, length, s_bitstring);
 
-/* RFC 3280.  No context tags. */
-DEFOFFSETTYPE(spki_0, krb5_subject_pk_info, algorithm, algorithm_identifier);
-DEFOFFSETTYPE(spki_1, krb5_subject_pk_info, subjectPublicKey, bitstring_data);
-static const struct atype_info *subject_pk_info_fields = {
-    &k5_atype_spki_0, &k5_atype_spki_1
-};
-DEFSEQTYPE(subject_pk_info, krb5_subject_pk_info, subject_pk_info_fields);
-DEFPTRTYPE(subject_pk_info_ptr, subject_pk_info);
-DEFOPTIONALZEROTYPE(opt_subject_pk_info_ptr, subject_pk_info_ptr);
-
 DEFFIELD(auth_pack_0, krb5_auth_pack, pkAuthenticator, 0, pk_authenticator);
-DEFFIELD(auth_pack_1, krb5_auth_pack, clientPublicValue, 1,
-         opt_subject_pk_info_ptr);
+DEFFIELD(auth_pack_1, krb5_auth_pack, clientPublicValue, 1, opt_der_data);
 DEFFIELD(auth_pack_2, krb5_auth_pack, supportedCMSTypes, 2,
          opt_ptr_seqof_algorithm_identifier);
 DEFFIELD(auth_pack_3, krb5_auth_pack, clientDHNonce, 3, opt_ostring_data);

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/cc-int.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/cc-int.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/cc_dir.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/cc_dir.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/cc_file.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/cc_file.c Changed

@@ -439,16 +439,40 @@
     return 0;
 }
 
+static void
+marshal_header(krb5_context context, struct k5buf *buf, krb5_principal princ)
+{
+    krb5_os_context os_ctx = &context->os_context;
+    int version = context->fcc_default_format - FVNO_BASE;
+    uint16_t fields_len;
+
+    version = context->fcc_default_format - FVNO_BASE;
+    k5_buf_add_uint16_be(buf, FVNO_BASE + version);
+    if (version >= 4) {
+        /* Add tagged header fields. */
+        fields_len = 0;
+        if (os_ctx->os_flags & KRB5_OS_TOFFSET_VALID)
+            fields_len += 12;
+        k5_buf_add_uint16_be(buf, fields_len);
+        if (os_ctx->os_flags & KRB5_OS_TOFFSET_VALID) {
+            /* Add time offset tag. */
+            k5_buf_add_uint16_be(buf, FCC_TAG_DELTATIME);
+            k5_buf_add_uint16_be(buf, 8);
+            k5_buf_add_uint32_be(buf, os_ctx->time_offset);
+            k5_buf_add_uint32_be(buf, os_ctx->usec_offset);
+        }
+    }
+    k5_marshal_princ(buf, version, princ);
+}
+
 /* Create or overwrite the cache file with a header and default principal. */
 static krb5_error_code KRB5_CALLCONV
 fcc_initialize(krb5_context context, krb5_ccache id, krb5_principal princ)
 {
     krb5_error_code ret;
-    krb5_os_context os_ctx = &context->os_context;
     fcc_data *data = id->data;
-    uint16_t fields_len;
     ssize_t nwritten;
-    int st, flags, version, fd = -1;
+    int st, flags, fd = -1;
     struct k5buf buf = EMPTY_K5BUF;
     krb5_boolean file_locked = FALSE;
 
@@ -482,23 +506,7 @@
 
     /* Prepare the header and principal in buf. */
     k5_buf_init_dynamic(&buf);
-    version = context->fcc_default_format - FVNO_BASE;
-    k5_buf_add_uint16_be(&buf, FVNO_BASE + version);
-    if (version >= 4) {
-        /* Add tagged header fields. */
-        fields_len = 0;
-        if (os_ctx->os_flags & KRB5_OS_TOFFSET_VALID)
-            fields_len += 12;
-        k5_buf_add_uint16_be(&buf, fields_len);
-        if (os_ctx->os_flags & KRB5_OS_TOFFSET_VALID) {
-            /* Add time offset tag. */
-            k5_buf_add_uint16_be(&buf, FCC_TAG_DELTATIME);
-            k5_buf_add_uint16_be(&buf, 8);
-            k5_buf_add_uint32_be(&buf, os_ctx->time_offset);
-            k5_buf_add_uint32_be(&buf, os_ctx->usec_offset);
-        }
-    }
-    k5_marshal_princ(&buf, version, princ);
+    marshal_header(context, &buf, princ);
     ret = k5_buf_status(&buf);
     if (ret)
         goto cleanup;
@@ -1260,6 +1268,64 @@
     return 0;
 }
 
+static krb5_error_code KRB5_CALLCONV
+fcc_replace(krb5_context context, krb5_ccache id, krb5_principal princ,
+            krb5_creds **creds)
+{
+    krb5_error_code ret;
+    fcc_data *data = id->data;
+    char *tmpname = NULL;
+    int i, st, fd = -1, version = context->fcc_default_format - FVNO_BASE;
+    ssize_t nwritten;
+    struct k5buf buf = EMPTY_K5BUF;
+    krb5_boolean tmpfile_exists = FALSE;
+
+    if (asprintf(&tmpname, "%s.XXXXXX", data->filename) < 0)
+        return ENOMEM;
+    fd = mkstemp(tmpname);
+    if (fd < 0)
+        goto errno_cleanup;
+    tmpfile_exists = TRUE;
+
+    k5_buf_init_dynamic_zap(&buf);
+    marshal_header(context, &buf, princ);
+    for (i = 0; credsi != NULL; i++)
+        k5_marshal_cred(&buf, version, credsi);
+    ret = k5_buf_status(&buf);
+    if (ret)
+        goto cleanup;
+
+    nwritten = write(fd, buf.data, buf.len);
+    if (nwritten == -1)
+        goto errno_cleanup;
+    if ((size_t)nwritten != buf.len) {
+        ret = KRB5_CC_IO;
+        goto cleanup;
+    }
+    st = close(fd);
+    fd = -1;
+    if (st != 0)
+        goto errno_cleanup;
+
+    st = rename(tmpname, data->filename);
+    if (st != 0)
+        goto errno_cleanup;
+    tmpfile_exists = FALSE;
+
+cleanup:
+    k5_buf_free(&buf);
+    if (fd != -1)
+        close(fd);
+    if (tmpfile_exists)
+        unlink(tmpname);
+    free(tmpname);
+    return ret;
+
+errno_cleanup:
+    ret = interpret_errno(context, errno);
+    goto cleanup;
+}
+
 /* Translate a system errno value to a Kerberos com_err code. */
 static krb5_error_code
 interpret_errno(krb5_context context, int errnum)
@@ -1335,7 +1401,7 @@
     fcc_ptcursor_new,
     fcc_ptcursor_next,
     fcc_ptcursor_free,
-    NULL, /* move */
+    fcc_replace,
     NULL, /* wasdefault */
     fcc_lock,
     fcc_unlock,
@@ -1405,7 +1471,7 @@
     fcc_ptcursor_new,
     fcc_ptcursor_next,
     fcc_ptcursor_free,
-    NULL, /* move */
+    fcc_replace,
     NULL, /* wasdefault */
     fcc_lock,
     fcc_unlock,

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/cc_kcm.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/cc_kcm.c Changed

@@ -61,6 +61,17 @@
     size_t pos;
 };
 
+struct cred_list {
+    krb5_creds *creds;
+    size_t count;
+    size_t pos;
+};
+
+struct kcm_cursor {
+    struct uuid_list *uuids;
+    struct cred_list *creds;
+};
+
 struct kcmio {
     SOCKET fd;
 #ifdef __APPLE__
@@ -99,6 +110,54 @@
         KRB5_KCM_MALFORMED_REPLY : code;
 }
 
+/*
+ * Map an MIT krb5 KRB5_TC flag word to the equivalent Heimdal flag word.  Note
+ * that there is no MIT krb5 equivalent for Heimdal's KRB5_TC_DONT_MATCH_REALM
+ * (which is like KRB5_TC_MATCH_SRV_NAMEONLY but also applies to the client
+ * principal) and no Heimdal equivalent for MIT krb5's KRB5_TC_SUPPORTED_KTYPES
+ * (which matches against enctypes from the krb5_context rather than the
+ * matching cred).
+ */
+static inline krb5_flags
+map_tcflags(krb5_flags mitflags)
+{
+    krb5_flags heimflags = 0;
+
+    if (mitflags & KRB5_TC_MATCH_TIMES)
+        heimflags |= KCM_TC_MATCH_TIMES;
+    if (mitflags & KRB5_TC_MATCH_IS_SKEY)
+        heimflags |= KCM_TC_MATCH_IS_SKEY;
+    if (mitflags & KRB5_TC_MATCH_FLAGS)
+        heimflags |= KCM_TC_MATCH_FLAGS;
+    if (mitflags & KRB5_TC_MATCH_TIMES_EXACT)
+        heimflags |= KCM_TC_MATCH_TIMES_EXACT;
+    if (mitflags & KRB5_TC_MATCH_FLAGS_EXACT)
+        heimflags |= KCM_TC_MATCH_FLAGS_EXACT;
+    if (mitflags & KRB5_TC_MATCH_AUTHDATA)
+        heimflags |= KCM_TC_MATCH_AUTHDATA;
+    if (mitflags & KRB5_TC_MATCH_SRV_NAMEONLY)
+        heimflags |= KCM_TC_MATCH_SRV_NAMEONLY;
+    if (mitflags & KRB5_TC_MATCH_2ND_TKT)
+        heimflags |= KCM_TC_MATCH_2ND_TKT;
+    if (mitflags & KRB5_TC_MATCH_KTYPE)
+        heimflags |= KCM_TC_MATCH_KEYTYPE;
+    return heimflags;
+}
+
+/*
+ * Return true if code could indicate an unsupported operation.  Heimdal's KCM
+ * returns KRB5_FCC_INTERNAL.  sssd's KCM daemon (as of sssd 2.4) returns
+ * KRB5_CC_NO_SUPP if it recognizes the operation but does not implement it,
+ * and KRB5_CC_IO if it doesn't recognize the operation (which is unfortunate
+ * since it could also indicate a communication failure).
+ */
+static krb5_boolean
+unsupported_op_error(krb5_error_code code)
+{
+    return code == KRB5_FCC_INTERNAL || code == KRB5_CC_IO ||
+        code == KRB5_CC_NOSUPP;
+}
+
 /* Begin a request for the given opcode.  If cache is non-null, supply the
  * cache name as a request parameter. */
 static void
@@ -490,6 +549,69 @@
 }
 
 static void
+free_cred_list(struct cred_list *list)
+{
+    size_t i;
+
+    if (list == NULL)
+        return;
+
+    /* Creds are transferred to the caller as list->pos is incremented, so we
+     * can start freeing there. */
+    for (i = list->pos; i < list->count; i++)
+        krb5_free_cred_contents(NULL, &list->credsi);
+    free(list->creds);
+    free(list);
+}
+
+/* Fetch a cred list from req->reply. */
+static krb5_error_code
+kcmreq_get_cred_list(struct kcmreq *req, struct cred_list **creds_out)
+{
+    struct cred_list *list;
+    const unsigned char *data;
+    krb5_error_code ret = 0;
+    size_t count, len, i;
+
+    *creds_out = NULL;
+
+    /* Check a rough bound on the count to prevent very large allocations. */
+    count = k5_input_get_uint32_be(&req->reply);
+    if (count > req->reply.len / 4)
+        return KRB5_KCM_MALFORMED_REPLY;
+
+    list = malloc(sizeof(*list));
+    if (list == NULL)
+        return ENOMEM;
+
+    list->creds = NULL;
+    list->count = count;
+    list->pos = 0;
+    list->creds = k5calloc(count, sizeof(*list->creds), &ret);
+    if (list->creds == NULL) {
+        free(list);
+        return ret;
+    }
+
+    for (i = 0; i < count; i++) {
+        len = k5_input_get_uint32_be(&req->reply);
+        data = k5_input_get_bytes(&req->reply, len);
+        if (data == NULL)
+            break;
+        ret = k5_unmarshal_cred(data, len, 4, &list->credsi);
+        if (ret)
+            break;
+    }
+    if (i < count) {
+        free_cred_list(list);
+        return (ret == ENOMEM) ? ENOMEM : KRB5_KCM_MALFORMED_REPLY;
+    }
+
+    *creds_out = list;
+    return 0;
+}
+
+static void
 kcmreq_free(struct kcmreq *req)
 {
     k5_buf_free(&req->reqbuf);
@@ -718,9 +840,55 @@
 kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags,
              krb5_creds *mcred, krb5_creds *cred_out)
 {
-    /* There is a KCM opcode for retrieving creds, but Heimdal's client doesn't
-     * use it.  It causes the KCM daemon to actually make a TGS request. */
-    return k5_cc_retrieve_cred_default(context, cache, flags, mcred, cred_out);
+    krb5_error_code ret;
+    struct kcmreq req = EMPTY_KCMREQ;
+    krb5_creds cred;
+    krb5_enctype *enctypes = NULL;
+
+    memset(&cred, 0, sizeof(cred));
+
+    /* Include KCM_GC_CACHED in flags to prevent Heimdal's sssd from making a
+     * TGS request itself. */
+    kcmreq_init(&req, KCM_OP_RETRIEVE, cache);
+    k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags) | KCM_GC_CACHED);
+    k5_marshal_mcred(&req.reqbuf, mcred);
+    ret = cache_call(context, cache, &req);
+
+    /* Fall back to iteration if the server does not support retrieval. */
+    if (unsupported_op_error(ret)) {
+        ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred,
+                                          cred_out);
+        goto cleanup;
+    }
+    if (ret)
+        goto cleanup;
+
+    ret = k5_unmarshal_cred(req.reply.ptr, req.reply.len, 4, &cred);
+    if (ret)
+        goto cleanup;
+
+    /* In rare cases we might retrieve a credential with a session key this
+     * context can't support, in which case we must retry using iteration. */
+    if (flags & KRB5_TC_SUPPORTED_KTYPES) {
+        ret = krb5_get_tgs_ktypes(context, cred.server, &enctypes);
+        if (ret)
+            goto cleanup;
+        if (!k5_etypes_contains(enctypes, cred.keyblock.enctype)) {
+            ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred,
+                                              cred_out);
+            goto cleanup;
+        }
+    }
+
+    *cred_out = cred;
+    memset(&cred, 0, sizeof(cred));
+
+cleanup:
+    kcmreq_free(&req);
+    krb5_free_cred_contents(context, &cred);
+    free(enctypes);
+    /* Heimdal's KCM returns KRB5_CC_END if no cred is found. */
+    return (ret == KRB5_CC_END) ? KRB5_CC_NOTFOUND : map_invalid(ret);
 }
 
 static krb5_error_code KRB5_CALLCONV
@@ -753,33 +921,53 @@
 {
     krb5_error_code ret;
     struct kcmreq req = EMPTY_KCMREQ;
-    struct uuid_list *uuids;
+    struct uuid_list *uuids = NULL;
+    struct cred_list *creds = NULL;
+    struct kcm_cursor *cursor;
 
     *cursor_out = NULL;
 
     get_kdc_offset(context, cache);
 
-    kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache);
+    kcmreq_init(&req, KCM_OP_GET_CRED_LIST, cache);
     ret = cache_call(context, cache, &req);
-    if (ret)
+    if (ret == 0) {
+        /* GET_CRED_LIST is available. */
+        ret = kcmreq_get_cred_list(&req, &creds);
+        if (ret)
+            goto cleanup;
+    } else if (unsupported_op_error(ret)) {
+        /* Fall back to GET_CRED_UUID_LIST. */
+        kcmreq_free(&req);
+        kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache);
+        ret = cache_call(context, cache, &req);
+        if (ret)
+            goto cleanup;
+        ret = kcmreq_get_uuid_list(&req, &uuids);
+        if (ret)
+            goto cleanup;
+    } else {
         goto cleanup;
-    ret = kcmreq_get_uuid_list(&req, &uuids);
-    if (ret)
+    }
+
+    cursor = k5alloc(sizeof(*cursor), &ret);
+    if (cursor == NULL)
         goto cleanup;
-    *cursor_out = (krb5_cc_cursor)uuids;
+    cursor->uuids = uuids;
+    cursor->creds = creds;
+    *cursor_out = (krb5_cc_cursor)cursor;
 
 cleanup:
     kcmreq_free(&req);
     return ret;
 }
 
-static krb5_error_code KRB5_CALLCONV
-kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
-              krb5_creds *cred_out)
+static krb5_error_code
+next_cred_by_uuid(krb5_context context, krb5_ccache cache,
+                  struct uuid_list *uuids, krb5_creds *cred_out)
 {
     krb5_error_code ret;
     struct kcmreq req;
-    struct uuid_list *uuids = (struct uuid_list *)*cursor;
 
     memset(cred_out, 0, sizeof(*cred_out));
 
@@ -798,10 +986,38 @@
 }
 
 static krb5_error_code KRB5_CALLCONV
+kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
+              krb5_creds *cred_out)
+{
+    struct kcm_cursor *c = (struct kcm_cursor *)*cursor;
+    struct cred_list *list;
+
+    if (c->uuids != NULL)
+        return next_cred_by_uuid(context, cache, c->uuids, cred_out);
+
+    list = c->creds;
+    if (list->pos >= list->count)
+        return KRB5_CC_END;
+
+    /* Transfer memory ownership of one cred to the caller. */
+    *cred_out = list->credslist->pos;
+    memset(&list->credslist->pos, 0, sizeof(*list->creds));
+    list->pos++;
+
+    return 0;
+}
+
+static krb5_error_code KRB5_CALLCONV
 kcm_end_seq_get(krb5_context context, krb5_ccache cache,
                 krb5_cc_cursor *cursor)
 {
-    free_uuid_list((struct uuid_list *)*cursor);
+    struct kcm_cursor *c = *cursor;
+
+    if (c == NULL)
+        return 0;
+    free_uuid_list(c->uuids);
+    free_cred_list(c->creds);
+    free(c);
     *cursor = NULL;
     return 0;
 }
@@ -814,7 +1030,7 @@
     struct kcmreq req;
 
     kcmreq_init(&req, KCM_OP_REMOVE_CRED, cache);
-    k5_buf_add_uint32_be(&req.reqbuf, flags);
+    k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags));
     k5_marshal_mcred(&req.reqbuf, mcred);
     ret = cache_call(context, cache, &req);
     kcmreq_free(&req);
@@ -1019,6 +1235,43 @@
 }
 
 static krb5_error_code KRB5_CALLCONV
+kcm_replace(krb5_context context, krb5_ccache cache, krb5_principal princ,
+            krb5_creds **creds)
+{
+    krb5_error_code ret;
+    struct kcmreq req = EMPTY_KCMREQ;
+    size_t pos;
+    uint8_t *lenptr;
+    int ncreds, i;
+    krb5_os_context octx = &context->os_context;
+    int32_t offset;
+
+    kcmreq_init(&req, KCM_OP_REPLACE, cache);
+    offset = (octx->os_flags & KRB5_OS_TOFFSET_VALID) ? octx->time_offset : 0;
+    k5_buf_add_uint32_be(&req.reqbuf, offset);
+    k5_marshal_princ(&req.reqbuf, 4, princ);
+    for (ncreds = 0; credsncreds != NULL; ncreds++);
+    k5_buf_add_uint32_be(&req.reqbuf, ncreds);
+    for (i = 0; credsi != NULL; i++) {
+        /* Store a dummy length, then fix it up after marshalling the cred. */
+        pos = req.reqbuf.len;
+        k5_buf_add_uint32_be(&req.reqbuf, 0);
+        k5_marshal_cred(&req.reqbuf, 4, credsi);
+        if (k5_buf_status(&req.reqbuf) == 0) {
+            lenptr = (uint8_t *)req.reqbuf.data + pos;
+            store_32_be(req.reqbuf.len - (pos + 4), lenptr);
+        }
+    }
+    ret = cache_call(context, cache, &req);
+    kcmreq_free(&req);
+
+    if (unsupported_op_error(ret))
+        return k5_nonatomic_replace(context, cache, princ, creds);
+
+    return ret;
+}
+
+static krb5_error_code KRB5_CALLCONV
 kcm_lock(krb5_context context, krb5_ccache cache)
 {
     k5_cc_mutex_lock(context, &((struct kcm_cache_data *)cache->data)->lock);
@@ -1065,7 +1318,7 @@
     kcm_ptcursor_new,
     kcm_ptcursor_next,
     kcm_ptcursor_free,
-    NULL, /* move */
+    kcm_replace,
     NULL, /* wasdefault */
     kcm_lock,
     kcm_unlock,

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/cc_memory.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/cc_memory.c Changed

@@ -108,6 +108,7 @@
     k5_cc_mutex lock;
     krb5_principal prin;
     krb5_mcc_link *link;
+    krb5_mcc_link **tail;       /* Where to store next added cred */
     /* Time offsets for clock-skewed clients.  */
     krb5_int32 time_offset;
     krb5_int32 usec_offset;
@@ -159,11 +160,51 @@
         free(curr);
     }
     d->link = NULL;
+    d->tail = &d->link;
     d->generation++;
     krb5_free_principal(context, d->prin);
     d->prin = NULL;
 }
 
+/* Remove all creds from d and initialize it with princ as the default client
+ * principal.  The caller is responsible for locking. */
+static krb5_error_code
+init_mcc_cache(krb5_context context, krb5_mcc_data *d, krb5_principal princ)
+{
+    krb5_os_context os_ctx = &context->os_context;
+
+    empty_mcc_cache(context, d);
+    if (os_ctx->os_flags & KRB5_OS_TOFFSET_VALID) {
+        /* Store client time offsets in the cache. */
+        d->time_offset = os_ctx->time_offset;
+        d->usec_offset = os_ctx->usec_offset;
+    }
+    return krb5_copy_principal(context, princ, &d->prin);
+}
+
+/* Add cred to d.  The caller is responsible for locking. */
+static krb5_error_code
+store_cred(krb5_context context, krb5_mcc_data *d, krb5_creds *cred)
+{
+    krb5_error_code ret;
+    krb5_mcc_link *new_node;
+
+    new_node = malloc(sizeof(*new_node));
+    if (new_node == NULL)
+        return ENOMEM;
+    new_node->next = NULL;
+    ret = krb5_copy_creds(context, cred, &new_node->creds);
+    if (ret) {
+        free(new_node);
+        return ret;
+    }
+
+    /* Place the new node at the tail of the list. */
+    *d->tail = new_node;
+    d->tail = &new_node->next;
+    return 0;
+}
+
 /*
  * Modifies:
  * id
@@ -178,21 +219,11 @@
 krb5_error_code KRB5_CALLCONV
 krb5_mcc_initialize(krb5_context context, krb5_ccache id, krb5_principal princ)
 {
-    krb5_os_context os_ctx = &context->os_context;
     krb5_error_code ret;
     krb5_mcc_data *d = id->data;
 
     k5_cc_mutex_lock(context, &d->lock);
-    empty_mcc_cache(context, d);
-
-    ret = krb5_copy_principal(context, princ, &d->prin);
-
-    if (os_ctx->os_flags & KRB5_OS_TOFFSET_VALID) {
-        /* Store client time offsets in the cache */
-        d->time_offset = os_ctx->time_offset;
-        d->usec_offset = os_ctx->usec_offset;
-    }
-
+    ret = init_mcc_cache(context, d, princ);
     k5_cc_mutex_unlock(context, &d->lock);
     if (ret == KRB5_OK)
         krb5_change_cache();
@@ -470,6 +501,7 @@
         return KRB5_CC_NOMEM;
     }
     d->link = NULL;
+    d->tail = &d->link;
     d->prin = NULL;
     d->time_offset = 0;
     d->usec_offset = 0;
@@ -657,30 +689,19 @@
  * Save away creds in the ccache.
  *
  * Errors:
- * system errors (mutex locking)
  * ENOMEM
  */
 krb5_error_code KRB5_CALLCONV
-krb5_mcc_store(krb5_context ctx, krb5_ccache id, krb5_creds *creds)
+krb5_mcc_store(krb5_context context, krb5_ccache id, krb5_creds *creds)
 {
-    krb5_error_code err;
-    krb5_mcc_link *new_node;
-    krb5_mcc_data *mptr = (krb5_mcc_data *)id->data;
+    krb5_error_code ret;
+    krb5_mcc_data *d = id->data;
 
-    new_node = malloc(sizeof(krb5_mcc_link));
-    if (new_node == NULL)
-        return ENOMEM;
-    err = krb5_copy_creds(ctx, creds, &new_node->creds);
-    if (err)
-        goto cleanup;
-    k5_cc_mutex_lock(ctx, &mptr->lock);
-    new_node->next = mptr->link;
-    mptr->link = new_node;
-    k5_cc_mutex_unlock(ctx, &mptr->lock);
-    return 0;
-cleanup:
-    free(new_node);
-    return err;
+    /* Place the new node at the tail of the list. */
+    k5_cc_mutex_lock(context, &d->lock);
+    ret = store_cred(context, d, creds);
+    k5_cc_mutex_unlock(context, &d->lock);
+    return ret;
 }
 
 static krb5_error_code KRB5_CALLCONV
@@ -745,6 +766,24 @@
 }
 
 static krb5_error_code KRB5_CALLCONV
+krb5_mcc_replace(krb5_context context, krb5_ccache id, krb5_principal princ,
+                 krb5_creds **creds)
+{
+    krb5_error_code ret;
+    krb5_mcc_data *d = id->data;
+    int i;
+
+    k5_cc_mutex_lock(context, &d->lock);
+    ret = init_mcc_cache(context, d, princ);
+    for (i = 0; !ret && credsi != NULL; i++)
+        ret = store_cred(context, d, credsi);
+    k5_cc_mutex_unlock(context, &d->lock);
+    if (!ret)
+        krb5_change_cache();
+    return ret;
+}
+
+static krb5_error_code KRB5_CALLCONV
 krb5_mcc_lock(krb5_context context, krb5_ccache id)
 {
     krb5_mcc_data *data = (krb5_mcc_data *) id->data;
@@ -783,7 +822,7 @@
     krb5_mcc_ptcursor_new,
     krb5_mcc_ptcursor_next,
     krb5_mcc_ptcursor_free,
-    NULL, /* move */
+    krb5_mcc_replace,
     NULL, /* wasdefault */
     krb5_mcc_lock,
     krb5_mcc_unlock,

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/ccbase.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/ccbase.c Changed

@@ -348,50 +348,103 @@
     return 0;
 }
 
+krb5_error_code
+k5_nonatomic_replace(krb5_context context, krb5_ccache ccache,
+                     krb5_principal princ, krb5_creds **creds)
+{
+    krb5_error_code ret;
+    int i;
+
+    ret = krb5_cc_initialize(context, ccache, princ);
+    for (i = 0; !ret && credsi != NULL; creds++)
+        ret = krb5_cc_store_cred(context, ccache, credsi);
+    return ret;
+}
+
+static krb5_error_code
+read_creds(krb5_context context, krb5_ccache ccache, krb5_creds ***creds_out)
+{
+    krb5_error_code ret;
+    krb5_cc_cursor cur = NULL;
+    krb5_creds **list = NULL, *cred = NULL, **newptr;
+    int i;
+
+    *creds_out = NULL;
+
+    ret = krb5_cc_start_seq_get(context, ccache, &cur);
+    if (ret)
+        goto cleanup;
+
+    /* Allocate one extra entry so that list remains valid for freeing after
+     * we add the next entry and before we reallocate it. */
+    list = k5calloc(2, sizeof(*list), &ret);
+    if (list == NULL)
+        goto cleanup;
+
+    i = 0;
+    for (;;) {
+        cred = k5alloc(sizeof(*cred), &ret);
+        if (cred == NULL)
+            goto cleanup;
+        ret = krb5_cc_next_cred(context, ccache, &cur, cred);
+        if (ret == KRB5_CC_END)
+            break;
+        if (ret)
+            goto cleanup;
+        listi++ = cred;
+        listi = NULL;
+        cred = NULL;
+
+        newptr = realloc(list, (i + 2) * sizeof(*list));
+        if (newptr == NULL) {
+            ret = ENOMEM;
+            goto cleanup;
+        }
+        list = newptr;
+        listi + 1 = NULL;
+    }
+    ret = 0;
+
+    *creds_out = list;
+    list = NULL;
+
+cleanup:
+    if (cur != NULL)
+        (void)krb5_cc_end_seq_get(context, ccache, &cur);
+    krb5_free_tgt_creds(context, list);
+    free(cred);
+    return ret;
+}
+
 krb5_error_code KRB5_CALLCONV
 krb5_cc_move(krb5_context context, krb5_ccache src, krb5_ccache dst)
 {
-    krb5_error_code ret = 0;
+    krb5_error_code ret;
     krb5_principal princ = NULL;
+    krb5_creds **creds = NULL;
 
     TRACE_CC_MOVE(context, src, dst);
-    ret = k5_cccol_lock(context);
-    if (ret) {
-        return ret;
-    }
-
-    ret = k5_cc_lock(context, src);
-    if (ret) {
-        k5_cccol_unlock(context);
-        return ret;
-    }
 
     ret = krb5_cc_get_principal(context, src, &princ);
-    if (!ret) {
-        ret = krb5_cc_initialize(context, dst, princ);
-    }
-    if (ret) {
-        k5_cc_unlock(context, src);
-        k5_cccol_unlock(context);
-        return ret;
-    }
+    if (ret)
+        goto cleanup;
 
-    ret = k5_cc_lock(context, dst);
-    if (!ret) {
-        ret = krb5_cc_copy_creds(context, src, dst);
-        k5_cc_unlock(context, dst);
-    }
+    ret = read_creds(context, src, &creds);
+    if (ret)
+        goto cleanup;
 
-    k5_cc_unlock(context, src);
-    if (!ret) {
-        ret = krb5_cc_destroy(context, src);
-    }
-    k5_cccol_unlock(context);
-    if (princ) {
-        krb5_free_principal(context, princ);
-        princ = NULL;
-    }
+    if (dst->ops->replace == NULL)
+        ret = k5_nonatomic_replace(context, dst, princ, creds);
+    else
+        ret = dst->ops->replace(context, dst, princ, creds);
+    if (ret)
+        goto cleanup;
+
+    ret = krb5_cc_destroy(context, src);
 
+cleanup:
+    krb5_free_principal(context, princ);
+    krb5_free_tgt_creds(context, creds);
     return ret;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/cccursor.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/cccursor.c Changed

@@ -30,6 +30,7 @@
 
 #include "cc-int.h"
 #include "../krb/int-proto.h"
+#include "../os/os-proto.h"
 
 #include <assert.h>
 
@@ -141,18 +142,18 @@
     return 0;
 }
 
-krb5_error_code KRB5_CALLCONV
-krb5_cc_cache_match(krb5_context context, krb5_principal client,
-                    krb5_ccache *cache_out)
+static krb5_error_code
+match_caches(krb5_context context, krb5_const_principal client,
+             krb5_ccache *cache_out)
 {
     krb5_error_code ret;
     krb5_cccol_cursor cursor;
     krb5_ccache cache = NULL;
     krb5_principal princ;
-    char *name;
     krb5_boolean eq;
 
     *cache_out = NULL;
+
     ret = krb5_cccol_cursor_new(context, &cursor);
     if (ret)
         return ret;
@@ -169,20 +170,52 @@
         krb5_cc_close(context, cache);
     }
     krb5_cccol_cursor_free(context, &cursor);
+
     if (ret)
         return ret;
-    if (cache == NULL) {
-        ret = krb5_unparse_name(context, client, &name);
-        if (ret == 0) {
-            k5_setmsg(context, KRB5_CC_NOTFOUND,
+    if (cache == NULL)
+        return KRB5_CC_NOTFOUND;
+
+    *cache_out = cache;
+    return 0;
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5_cc_cache_match(krb5_context context, krb5_principal client,
+                    krb5_ccache *cache_out)
+{
+    krb5_error_code ret;
+    struct canonprinc iter = { client, .subst_defrealm = TRUE };
+    krb5_const_principal canonprinc = NULL;
+    krb5_ccache cache = NULL;
+    char *name;
+
+    *cache_out = NULL;
+
+    while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 &&
+           canonprinc != NULL) {
+        ret = match_caches(context, canonprinc, &cache);
+        if (ret != KRB5_CC_NOTFOUND)
+            break;
+    }
+    free_canonprinc(&iter);
+
+    if (ret == 0 && canonprinc == NULL) {
+        ret = KRB5_CC_NOTFOUND;
+        if (krb5_unparse_name(context, client, &name) == 0) {
+            k5_setmsg(context, ret,
                       _("Can't find client principal %s in cache collection"),
                       name);
             krb5_free_unparsed_name(context, name);
         }
-        ret = KRB5_CC_NOTFOUND;
-    } else
-        *cache_out = cache;
-    return ret;
+    }
+
+    TRACE_CC_CACHE_MATCH(context, client, ret);
+    if (ret)
+        return ret;
+
+    *cache_out = cache;
+    return 0;
 }
 
 /* Store the error state for code from context into errsave, but only if code
@@ -191,41 +224,17 @@
 save_first_error(krb5_context context, krb5_error_code code,
                  struct errinfo *errsave)
 {
-    if (code && code != KRB5_CC_END && !errsave->code)
+    if (code && code != KRB5_FCC_NOFILE && !errsave->code)
         k5_save_ctx_error(context, code, errsave);
 }
 
-/* Return 0 if cache contains any non-config credentials.  Return KRB5_CC_END
- * if it does not, or another error if we failed to read through it. */
-static krb5_error_code
-has_content(krb5_context context, krb5_ccache cache)
-{
-    krb5_error_code ret;
-    krb5_boolean found = FALSE;
-    krb5_cc_cursor cache_cursor;
-    krb5_creds creds;
-
-    ret = krb5_cc_start_seq_get(context, cache, &cache_cursor);
-    if (ret)
-        return ret;
-    while (!found) {
-        ret = krb5_cc_next_cred(context, cache, &cache_cursor, &creds);
-        if (ret)
-            break;
-        if (!krb5_is_config_principal(context, creds.server))
-            found = TRUE;
-        krb5_free_cred_contents(context, &creds);
-    }
-    krb5_cc_end_seq_get(context, cache, &cache_cursor);
-    return ret;
-}
-
 krb5_error_code KRB5_CALLCONV
 krb5_cccol_have_content(krb5_context context)
 {
     krb5_error_code ret;
     krb5_cccol_cursor col_cursor;
     krb5_ccache cache;
+    krb5_principal princ;
     krb5_boolean found = FALSE;
     struct errinfo errsave = EMPTY_ERRINFO;
     const char *defname;
@@ -240,15 +249,18 @@
         save_first_error(context, ret, &errsave);
         if (ret || cache == NULL)
             break;
-        ret = has_content(context, cache);
+        ret = krb5_cc_get_principal(context, cache, &princ);
         save_first_error(context, ret, &errsave);
         if (!ret)
             found = TRUE;
+        krb5_free_principal(context, princ);
         krb5_cc_close(context, cache);
     }
     krb5_cccol_cursor_free(context, &col_cursor);
-    if (found)
+    if (found) {
+        k5_clear_error(&errsave);
         return 0;
+    }
 
 no_entries:
     if (errsave.code) {

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/ccmarshal.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/ccmarshal.c Changed

@@ -515,3 +515,56 @@
     if (mcred->second_ticket.length > 0)
         put_data(buf, version, &mcred->second_ticket);
 }
+
+krb5_error_code KRB5_CALLCONV
+krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds,
+                         krb5_data **data_out)
+{
+    krb5_error_code ret;
+    krb5_data *data;
+    struct k5buf buf;
+
+    *data_out = NULL;
+
+    data = k5alloc(sizeof(krb5_data), &ret);
+    if (ret)
+        return ret;
+
+    k5_buf_init_dynamic(&buf);
+    k5_marshal_cred(&buf, 4, in_creds);
+
+    ret = k5_buf_status(&buf);
+    if (ret) {
+        free(data);
+        return ret;
+    }
+
+    /* Steal payload from buf. */
+    *data = make_data(buf.data, buf.len);
+    *data_out = data;
+    return 0;
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5_unmarshal_credentials(krb5_context context, const krb5_data *data,
+                           krb5_creds **creds_out)
+{
+    krb5_error_code ret;
+    krb5_creds *creds;
+
+    *creds_out = NULL;
+
+    creds = k5alloc(sizeof(krb5_creds), &ret);
+    if (ret)
+        return ret;
+
+    ret = k5_unmarshal_cred((unsigned char *)data->data, data->length, 4,
+                            creds);
+    if (ret) {
+        free(creds);
+        return ret;
+    }
+
+    *creds_out = creds;
+    return 0;
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/ccselect.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/ccselect.c Changed

@@ -147,18 +147,19 @@
         server->type == KRB5_NT_SRV_HST && server->length == 2) {
         ret = krb5_get_fallback_host_realm(context, &server->data1,
                                            &fbrealms);
-        if (ret)
-            goto cleanup;
-
-        /* Make a copy with the first fallback realm. */
-        ret = krb5_copy_principal(context, server, &srvcp);
-        if (ret)
-            goto cleanup;
-        ret = krb5_set_principal_realm(context, srvcp, fbrealms0);
-        if (ret)
+        /* Continue without realm if we failed due to no default realm. */
+        if (ret && ret != KRB5_CONFIG_NODEFREALM)
             goto cleanup;
-
-        server = srvcp;
+        if (!ret) {
+            /* Make a copy with the first fallback realm. */
+            ret = krb5_copy_principal(context, server, &srvcp);
+            if (ret)
+                goto cleanup;
+            ret = krb5_set_principal_realm(context, srvcp, fbrealms0);
+            if (ret)
+                goto cleanup;
+            server = srvcp;
+        }
     }
 
     /* Consult authoritative modules first, then heuristic ones. */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/deps Changed

@@ -25,12 +25,13 @@
 cccursor.so cccursor.po $(OUTPRE)cccursor.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../krb/int-proto.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+  $(COM_ERR_DEPS) $(srcdir)/../krb/int-proto.h $(srcdir)/../os/os-proto.h \
+  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
   $(top_srcdir)/include/socket-utils.h cc-int.h cccursor.c
 ccdefault.so ccdefault.po $(OUTPRE)ccdefault.$(OBJEXT): \

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/t_cc.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/t_cc.c Changed

@@ -560,6 +560,49 @@
     free_test_cred(context);
 }
 
+/* Check that order is preserved during iteration.  Not all cache types have
+ * this property. */
+static void
+test_order(krb5_context context, const char *name)
+{
+    krb5_error_code kret;
+    krb5_ccache id;
+    krb5_cc_cursor cursor;
+    krb5_creds creds;
+
+    kret = init_test_cred(context);
+    CHECK(kret, "init_creds");
+
+    kret = krb5_cc_resolve(context, name, &id);
+    CHECK(kret, "resolve");
+    kret = krb5_cc_initialize(context, id, test_creds.client);
+    CHECK(kret, "initialize");
+    kret = krb5_cc_store_cred(context, id, &test_creds);
+    CHECK(kret, "store 1");
+    kret = krb5_cc_store_cred(context, id, &test_creds2);
+    CHECK(kret, "store 2");
+
+    kret = krb5_cc_start_seq_get(context, id, &cursor);
+    CHECK(kret, "start_seq_get");
+    kret = krb5_cc_next_cred(context, id, &cursor, &creds);
+    CHECK(kret, "next_cred 1");
+    CHECK_BOOL(krb5_principal_compare(context, creds.server,
+                                      test_creds.server) != TRUE,
+               "first cred does not match", "principal_compare");
+    krb5_free_cred_contents(context, &creds);
+
+    kret = krb5_cc_next_cred(context, id, &cursor, &creds);
+    CHECK(kret, "next_cred 2");
+    CHECK_BOOL(krb5_principal_compare(context, creds.server,
+                                      test_creds2.server) != TRUE,
+               "second cred does not match", "principal_compare");
+    krb5_free_cred_contents(context, &creds);
+
+    krb5_cc_end_seq_get(context, id, &cursor);
+    krb5_cc_close(context, id);
+    free_test_cred(context);
+}
+
 extern const krb5_cc_ops krb5_mcc_ops;
 extern const krb5_cc_ops krb5_fcc_ops;
 
@@ -610,6 +653,8 @@
 
     test_memory_concurrent(context);
 
+    test_order(context, "MEMORY:order");
+
     krb5_free_context(context);
     return 0;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/ccache/t_marshal.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/ccache/t_marshal.c Changed

@@ -268,13 +268,14 @@
     krb5_context context;
     krb5_ccache cache;
     krb5_principal princ;
-    krb5_creds cred1, cred2;
+    krb5_creds cred1, cred2, *alloc_cred;
     krb5_cc_cursor cursor;
     const char *filename;
     char *ccname, filebuf256;
     int version, fd;
     const struct test *t;
     struct k5buf buf;
+    krb5_data ser_data, *alloc_data;
 
     if (argc != 2)
         abort();
@@ -285,6 +286,18 @@
     if (krb5_init_context(&context) != 0)
         abort();
 
+    /* Test public functions for unmarshalling and marshalling. */
+    ser_data = make_data((char *)tests3.cred1, tests3.cred1len);
+    if (krb5_unmarshal_credentials(context, &ser_data, &alloc_cred) != 0)
+        abort();
+    verify_cred1(alloc_cred);
+    if (krb5_marshal_credentials(context, alloc_cred, &alloc_data) != 0)
+        abort();
+    assert(alloc_data->length == tests3.cred1len);
+    assert(memcmp(tests3.cred1, alloc_data->data, alloc_data->length) == 0);
+    krb5_free_data(context, alloc_data);
+    krb5_free_creds(context, alloc_cred);
+
     for (version = FIRST_VERSION; version <= 4; version++) {
         t = &testsversion - 1;

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/error_tables/k5e1_err.et -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/error_tables/k5e1_err.et Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/Makefile.in Changed

@@ -100,7 +100,6 @@
 	rd_safe.o	\
 	recvauth.o	\
 	response_items.o	\
-	s4u_authdata.o	\
 	s4u_creds.o	\
 	sendauth.o	\
 	send_tgs.o	\
@@ -214,7 +213,6 @@
 	$(OUTPRE)rd_safe.$(OBJEXT)	\
 	$(OUTPRE)recvauth.$(OBJEXT)	\
 	$(OUTPRE)response_items.$(OBJEXT)	\
-	$(OUTPRE)s4u_authdata.$(OBJEXT)	\
 	$(OUTPRE)s4u_creds.$(OBJEXT)	\
 	$(OUTPRE)sendauth.$(OBJEXT)	\
 	$(OUTPRE)send_tgs.$(OBJEXT)	\
@@ -328,7 +326,6 @@
 	$(srcdir)/rd_safe.c	\
 	$(srcdir)/recvauth.c	\
 	$(srcdir)/response_items.c	\
-	$(srcdir)/s4u_authdata.c\
 	$(srcdir)/s4u_creds.c	\
 	$(srcdir)/sendauth.c	\
 	$(srcdir)/send_tgs.c	\
@@ -390,20 +387,19 @@
 
 COMERRLIB=$(TOPLIBD)/libcom_err.a
 
-T_WALK_RTREE_OBJS= t_walk_rtree.o walk_rtree.o tgtname.o unparse.o \
-	bld_pr_ext.o copy_data.o
+T_WALK_RTREE_OBJS= t_walk_rtree.o
 
 T_KERB_OBJS= t_kerb.o conv_princ.o unparse.o set_realm.o str_conv.o
 
 T_SER_OBJS= t_ser.o ser_actx.o ser_adata.o ser_addr.o ser_auth.o ser_cksum.o \
 	ser_ctx.o ser_key.o ser_princ.o serialize.o authdata.o pac.o \
-	pac_sign.o ai_authdata.o authdata_exp.o s4u_authdata.o copy_data.o etype_list.o
+	pac_sign.o ai_authdata.o authdata_exp.o copy_data.o etype_list.o
 
 T_DELTAT_OBJS= t_deltat.o deltat.o
 
 T_PAC_OBJS= t_pac.o pac.o pac_sign.o copy_data.o
 
-T_PRINC_OBJS= t_princ.o parse.o unparse.o
+T_PRINC_OBJS= t_princ.o
 
 T_ETYPES_OBJS= t_etypes.o init_ctx.o etype_list.o plugin.o
 
@@ -486,6 +482,10 @@
 		parse_name tytso\\\\0/\\0@B\\n\\t\\\\GAG \
 		parse_name tytso/\\n/\\b\\t@B\\0hacky-test \
 		parse_name \\/slash/\\@atsign/octa\\/thorpe@\\/slash\\@at\\/sign \
+		name_type host/www.krb5.test@KRB5.TEST \
+		name_type krbtg/KRB5.TEST@KRB5.TEST \
+		name_type krbtgt/KRB5.TEST@KRB5.TEST \
+		name_type WELLKNOWN/ANONYMOUS@KRB5.TEST \
 		425_conv_principal rcmd e40-po ATHENA.MIT.EDU \
 		425_conv_principal rcmd mit ATHENA.MIT.EDU \
 		425_conv_principal rcmd lithium ATHENA.MIT.EDU \

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/authdata.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/authdata.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/bld_pr_ext.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/bld_pr_ext.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/bld_princ.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/bld_princ.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/deps Changed

@@ -136,7 +136,7 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  bld_pr_ext.c
+  bld_pr_ext.c int-proto.h
 bld_princ.so bld_princ.po $(OUTPRE)bld_princ.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -147,7 +147,7 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  bld_princ.c
+  bld_princ.c int-proto.h
 brand.so brand.po $(OUTPRE)brand.$(OBJEXT): $(top_srcdir)/patchlevel.h \
   brand.c
 chk_trans.so chk_trans.po $(OUTPRE)chk_trans.$(OBJEXT): \
@@ -710,7 +710,7 @@
   $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  authdata.h pac.c
+  authdata.h int-proto.h pac.c
 pac_sign.so pac_sign.po $(OUTPRE)pac_sign.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -721,7 +721,8 @@
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/k5-utf8.h \
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h authdata.h pac_sign.c
+  $(top_srcdir)/include/socket-utils.h authdata.h int-proto.h \
+  pac_sign.c
 padata.so padata.po $(OUTPRE)padata.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
@@ -741,7 +742,7 @@
   $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h parse.c
+  $(top_srcdir)/include/socket-utils.h int-proto.h parse.c
 parse_host_string.so parse_host_string.po $(OUTPRE)parse_host_string.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -984,18 +985,6 @@
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
   int-proto.h response_items.c
-s4u_authdata.so s4u_authdata.po $(OUTPRE)s4u_authdata.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(srcdir)/../rcache/memrcache.h $(top_srcdir)/include/k5-buf.h \
-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
-  $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \
-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  auth_con.h authdata.h int-proto.h s4u_authdata.c
 s4u_creds.so s4u_creds.po $(OUTPRE)s4u_creds.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/gen_save_subkey.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/gen_save_subkey.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/gen_seqnum.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/gen_seqnum.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/gen_subkey.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/gen_subkey.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/get_in_tkt.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/get_in_tkt.c Changed

@@ -506,12 +506,7 @@
         if (ret)
             return ret;
     }
-    /*
-     * Windows Server 2008 R2 RODC insists on TGS principal names having the
-     * right name type.
-     */
-    if (server->length == 2 && data_eq_string(server->data0, KRB5_TGS_NAME))
-        server->type = KRB5_NT_SRV_INST;
+
     *server_out = server;
     return 0;
 }
@@ -1188,7 +1183,6 @@
     krb5_data config;
     char *encoded;
     krb5_error_code code;
-    int i;
     krb5_ccache in_ccache = k5_gic_opt_get_in_ccache(ctx->opt);
 
     k5_json_release(ctx->cc_config_in);
@@ -1203,9 +1197,9 @@
     if (code)
         return code;
 
-    i = asprintf(&encoded, "%.*s", (int)config.length, config.data);
+    encoded = k5memdup0(config.data, config.length, &code);
     krb5_free_data_contents(context, &config);
-    if (i < 0)
+    if (encoded == NULL)
         return ENOMEM;
 
     code = k5_json_decode(encoded, &val);
@@ -1609,6 +1603,61 @@
     (*ctx->prompter)(context, ctx->prompter_data, NULL, banner, 0, NULL);
 }
 
+/*
+ * If ctx specifies an output ccache, create or refresh it (atomically, if
+ * possible) with the obtained credential and any appropriate ccache
+ * configuration.
+ */
+static krb5_error_code
+write_out_ccache(krb5_context context, krb5_init_creds_context ctx,
+                 krb5_boolean fast_avail)
+{
+    krb5_error_code ret;
+    krb5_ccache out_ccache = k5_gic_opt_get_out_ccache(ctx->opt);
+    krb5_ccache mcc = NULL;
+    krb5_data yes = string2data("yes");
+
+    if (out_ccache == NULL)
+        return 0;
+
+    ret = krb5_cc_new_unique(context, "MEMORY", NULL, &mcc);
+    if (ret)
+        goto cleanup;
+
+    ret = krb5_cc_initialize(context, mcc, ctx->cred.client);
+    if (ret)
+        goto cleanup;
+
+    if (fast_avail) {
+        ret = krb5_cc_set_config(context, mcc, ctx->cred.server,
+                                 KRB5_CC_CONF_FAST_AVAIL, &yes);
+        if (ret)
+            goto cleanup;
+    }
+
+    ret = save_selected_preauth_type(context, mcc, ctx);
+    if (ret)
+        goto cleanup;
+
+    ret = save_cc_config_out_data(context, mcc, ctx);
+    if (ret)
+        goto cleanup;
+
+    ret = k5_cc_store_primary_cred(context, mcc, &ctx->cred);
+    if (ret)
+        goto cleanup;
+
+    ret = krb5_cc_move(context, mcc, out_ccache);
+    if (ret)
+        goto cleanup;
+    mcc = NULL;
+
+cleanup:
+    if (mcc != NULL)
+        krb5_cc_destroy(context, mcc);
+    return ret;
+}
+
 static krb5_error_code
 init_creds_step_reply(krb5_context context,
                       krb5_init_creds_context ctx,
@@ -1623,7 +1672,6 @@
     krb5_keyblock *strengthen_key = NULL;
     krb5_keyblock encrypting_key;
     krb5_boolean fast_avail;
-    krb5_ccache out_ccache = k5_gic_opt_get_out_ccache(ctx->opt);
 
     encrypting_key.length = 0;
     encrypting_key.contents = NULL;
@@ -1791,30 +1839,9 @@
     code = stash_as_reply(context, ctx->reply, &ctx->cred, NULL);
     if (code != 0)
         goto cleanup;
-    if (out_ccache != NULL) {
-        krb5_data config_data;
-        code = krb5_cc_initialize(context, out_ccache, ctx->cred.client);
-        if (code != 0)
-            goto cc_cleanup;
-        code = k5_cc_store_primary_cred(context, out_ccache, &ctx->cred);
-        if (code != 0)
-            goto cc_cleanup;
-        if (fast_avail) {
-            config_data.data = "yes";
-            config_data.length = strlen(config_data.data);
-            code = krb5_cc_set_config(context, out_ccache, ctx->cred.server,
-                                      KRB5_CC_CONF_FAST_AVAIL, &config_data);
-            if (code != 0)
-                goto cc_cleanup;
-        }
-        code = save_selected_preauth_type(context, out_ccache, ctx);
-        if (code != 0)
-            goto cc_cleanup;
-        code = save_cc_config_out_data(context, out_ccache, ctx);
-    cc_cleanup:
-        if (code != 0)
-            k5_prependmsg(context, code, _("Failed to store credentials"));
-    }
+    code = write_out_ccache(context, ctx, fast_avail);
+    if (code)
+        k5_prependmsg(context, code, _("Failed to store credentials"));
 
     k5_preauth_request_context_fini(context, ctx);

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/gic_keytab.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/gic_keytab.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/init_ctx.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/init_ctx.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/int-proto.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/int-proto.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/kfree.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/kfree.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/pac.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/pac.c Changed

@@ -25,8 +25,11 @@
  */
 
 #include "k5-int.h"
+#include "int-proto.h"
 #include "authdata.h"
 
+#define MAX_BUFFERS 4096
+
 /* draft-brezak-win2k-krb-authz-00 */
 
 /*
@@ -316,6 +319,9 @@
     if (version != 0)
         return EINVAL;
 
+    if (cbuffers < 1 || cbuffers > MAX_BUFFERS)
+        return ERANGE;
+
     header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH);
     if (len < header_len)
         return ERANGE;
@@ -348,8 +354,8 @@
             krb5_pac_free(context, pac);
             return EINVAL;
         }
-        if (buffer->Offset < header_len ||
-            buffer->Offset + buffer->cbBufferSize > len) {
+        if (buffer->Offset < header_len || buffer->Offset > len ||
+            buffer->cbBufferSize > len - buffer->Offset) {
             krb5_pac_free(context, pac);
             return ERANGE;
         }
@@ -370,32 +376,22 @@
 }
 
 static krb5_error_code
-k5_time_to_seconds_since_1970(int64_t ntTime, krb5_timestamp *elapsedSeconds)
+k5_time_to_seconds_since_1970(uint64_t ntTime, krb5_timestamp *elapsedSeconds)
 {
-    uint64_t abstime;
-
-    ntTime /= 10000000;
-
-    abstime = ntTime > 0 ? ntTime - NT_TIME_EPOCH : -ntTime;
+    uint64_t abstime = ntTime / 10000000 - NT_TIME_EPOCH;
 
     if (abstime > UINT32_MAX)
         return ERANGE;
-
     *elapsedSeconds = abstime;
-
     return 0;
 }
 
 krb5_error_code
 k5_seconds_since_1970_to_time(krb5_timestamp elapsedSeconds, uint64_t *ntTime)
 {
-    *ntTime = elapsedSeconds;
-
-    if (elapsedSeconds > 0)
-        *ntTime += NT_TIME_EPOCH;
-
+    *ntTime = (uint32_t)elapsedSeconds;
+    *ntTime += NT_TIME_EPOCH;
     *ntTime *= 10000000;
-
     return 0;
 }
 
@@ -411,7 +407,7 @@
     unsigned char *p;
     krb5_timestamp pac_authtime;
     krb5_ui_2 pac_princname_length;
-    int64_t pac_nt_authtime;
+    uint64_t pac_nt_authtime;
 
     if (authtime_out != NULL)
         *authtime_out = 0;
@@ -487,10 +483,8 @@
 }
 
 static krb5_error_code
-k5_pac_zero_signature(krb5_context context,
-                      const krb5_pac pac,
-                      krb5_ui_4 type,
-                      krb5_data *data)
+zero_signature(krb5_context context, const krb5_pac pac, krb5_ui_4 type,
+               krb5_data *data)
 {
     PAC_INFO_BUFFER *buffer = NULL;
     size_t i;
@@ -524,114 +518,192 @@
 }
 
 static krb5_error_code
-k5_pac_verify_server_checksum(krb5_context context,
-                              const krb5_pac pac,
-                              const krb5_keyblock *server)
+verify_checksum(krb5_context context, const krb5_pac pac, uint32_t buffer_type,
+                const krb5_keyblock *key, krb5_keyusage usage,
+                const krb5_data *data)
 {
     krb5_error_code ret;
-    krb5_data pac_data; /* PAC with zeroed checksums */
+    krb5_data buffer;
+    krb5_cksumtype cksumtype;
     krb5_checksum checksum;
-    krb5_data checksum_data;
     krb5_boolean valid;
-    krb5_octet *p;
+    size_t cksumlen;
 
-    ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM,
-                               &checksum_data);
+    ret = k5_pac_locate_buffer(context, pac, buffer_type, &buffer);
     if (ret != 0)
         return ret;
-
-    if (checksum_data.length < PAC_SIGNATURE_DATA_LENGTH)
+    if (buffer.length < PAC_SIGNATURE_DATA_LENGTH)
         return KRB5_BAD_MSIZE;
 
-    p = (krb5_octet *)checksum_data.data;
-    checksum.checksum_type = load_32_le(p);
-    checksum.length = checksum_data.length - PAC_SIGNATURE_DATA_LENGTH;
-    checksum.contents = p + PAC_SIGNATURE_DATA_LENGTH;
-    if (!krb5_c_is_keyed_cksum(checksum.checksum_type))
-        return KRB5KRB_AP_ERR_INAPP_CKSUM;
-
-    pac_data.length = pac->data.length;
-    pac_data.data = k5memdup(pac->data.data, pac->data.length, &ret);
-    if (pac_data.data == NULL)
-        return ret;
+    cksumtype = load_32_le(buffer.data);
+    if (buffer_type == KRB5_PAC_SERVER_CHECKSUM && cksumtype == CKSUMTYPE_SHA1)
+        return KRB5KDC_ERR_SUMTYPE_NOSUPP;
+    if (!krb5_c_is_keyed_cksum(cksumtype))
+        return KRB5KRB_ERR_GENERIC;
 
-    /* Zero out both checksum buffers */
-    ret = k5_pac_zero_signature(context, pac, KRB5_PAC_SERVER_CHECKSUM,
-                                &pac_data);
-    if (ret != 0) {
-        free(pac_data.data);
+    /* There may be an RODCIdentifier trailer (see MS-PAC 2.8), so look up
+     * the length of the checksum by its type. */
+    ret = krb5_c_checksum_length(context, cksumtype, &cksumlen);
+    if (ret)
         return ret;
-    }
-
-    ret = k5_pac_zero_signature(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM,
-                                &pac_data);
-    if (ret != 0) {
-        free(pac_data.data);
-        return ret;
-    }
+    if (cksumlen > buffer.length - PAC_SIGNATURE_DATA_LENGTH)
+        return KRB5_BAD_MSIZE;
+    checksum.checksum_type = cksumtype;
+    checksum.length = cksumlen;
+    checksum.contents = (uint8_t *)buffer.data + PAC_SIGNATURE_DATA_LENGTH;
 
-    ret = krb5_c_verify_checksum(context, server,
-                                 KRB5_KEYUSAGE_APP_DATA_CKSUM,
-                                 &pac_data, &checksum, &valid);
+    ret = krb5_c_verify_checksum(context, key, usage, data, &checksum, &valid);
+    return ret ? ret : (valid ? 0 : KRB5KRB_AP_ERR_MODIFIED);
+}
 
-    free(pac_data.data);
+static krb5_error_code
+verify_server_checksum(krb5_context context, const krb5_pac pac,
+                       const krb5_keyblock *server)
+{
+    krb5_error_code ret;
+    krb5_data copy;             /* PAC with zeroed checksums */
 
-    if (ret != 0) {
+    ret = krb5int_copy_data_contents(context, &pac->data, &copy);
+    if (ret)
         return ret;
-    }
-
-    if (valid == FALSE)
-        ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 
+    /* Zero out both checksum buffers */
+    ret = zero_signature(context, pac, KRB5_PAC_SERVER_CHECKSUM, &copy);
+    if (ret)
+        goto cleanup;
+    ret = zero_signature(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, &copy);
+    if (ret)
+        goto cleanup;
+
+    ret = verify_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, server,
+                          KRB5_KEYUSAGE_APP_DATA_CKSUM, &copy);
+
+cleanup:
+    free(copy.data);
     return ret;
 }
 
 static krb5_error_code
-k5_pac_verify_kdc_checksum(krb5_context context,
-                           const krb5_pac pac,
-                           const krb5_keyblock *privsvr)
+verify_kdc_checksum(krb5_context context, const krb5_pac pac,
+                    const krb5_keyblock *privsvr)
 {
     krb5_error_code ret;
-    krb5_data server_checksum, privsvr_checksum;
-    krb5_checksum checksum;
-    krb5_boolean valid;
-    krb5_octet *p;
-
-    ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM,
-                               &privsvr_checksum);
-    if (ret != 0)
-        return ret;
-
-    if (privsvr_checksum.length < PAC_SIGNATURE_DATA_LENGTH)
-        return KRB5_BAD_MSIZE;
+    krb5_data server_checksum;
 
     ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM,
                                &server_checksum);
-    if (ret != 0)
+    if (ret)
         return ret;
-
     if (server_checksum.length < PAC_SIGNATURE_DATA_LENGTH)
         return KRB5_BAD_MSIZE;
-
-    p = (krb5_octet *)privsvr_checksum.data;
-    checksum.checksum_type = load_32_le(p);
-    checksum.length = privsvr_checksum.length - PAC_SIGNATURE_DATA_LENGTH;
-    checksum.contents = p + PAC_SIGNATURE_DATA_LENGTH;
-    if (!krb5_c_is_keyed_cksum(checksum.checksum_type))
-        return KRB5KRB_AP_ERR_INAPP_CKSUM;
-
     server_checksum.data += PAC_SIGNATURE_DATA_LENGTH;
     server_checksum.length -= PAC_SIGNATURE_DATA_LENGTH;
 
-    ret = krb5_c_verify_checksum(context, privsvr,
-                                 KRB5_KEYUSAGE_APP_DATA_CKSUM,
-                                 &server_checksum, &checksum, &valid);
-    if (ret != 0)
-        return ret;
+    return verify_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, privsvr,
+                           KRB5_KEYUSAGE_APP_DATA_CKSUM, &server_checksum);
+}
+
+/* Per MS-PAC 2.8.3, tickets encrypted to TGS and password change principals
+ * should not have ticket signatures. */
+krb5_boolean
+k5_pac_should_have_ticket_signature(krb5_const_principal sprinc)
+{
+    if (IS_TGS_PRINC(sprinc))
+        return FALSE;
+    if (sprinc->length == 2 && data_eq_string(sprinc->data0, "kadmin") &&
+        data_eq_string(sprinc->data1, "changepw"))
+        return FALSE;
+    return TRUE;
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                       krb5_const_principal server_princ,
+                       const krb5_keyblock *server,
+                       const krb5_keyblock *privsvr, krb5_pac *pac_out)
+{
+    krb5_error_code ret;
+    krb5_pac pac = NULL;
+    krb5_data *recoded_tkt = NULL;
+    krb5_authdata **authdata, *orig, **ifrel = NULL, **recoded_ifrel = NULL;
+    uint8_t z = 0;
+    krb5_authdata zpac = { KV5M_AUTHDATA, KRB5_AUTHDATA_WIN2K_PAC, 1, &z };
+    size_t i, j;
+
+    *pac_out = NULL;
+
+    /*
+     * Find the position of the PAC in the ticket authdata.  ifrel will be the
+     * decoded AD-IF-RELEVANT container at position i containing a PAC, and j
+     * will be the offset within the container.
+     */
+    authdata = enc_tkt->authorization_data;
+    for (i = 0; authdata != NULL && authdatai != NULL; i++) {
+        if (authdatai->ad_type != KRB5_AUTHDATA_IF_RELEVANT)
+            continue;
+
+        ret = krb5_decode_authdata_container(context,
+                                             KRB5_AUTHDATA_IF_RELEVANT,
+                                             authdatai, &ifrel);
+        if (ret)
+            goto cleanup;
+
+        for (j = 0; ifrelj != NULL; j++) {
+            if (ifrelj->ad_type == KRB5_AUTHDATA_WIN2K_PAC)
+                break;
+        }
+        if (ifrelj != NULL)
+            break;
+
+        krb5_free_authdata(context, ifrel);
+        ifrel = NULL;
+    }
+
+    /* Stop and return successfully if we didn't find a PAC. */
+    if (ifrel == NULL) {
+        ret = 0;
+        goto cleanup;
+    }
+
+    ret = krb5_pac_parse(context, ifrelj->contents, ifrelj->length, &pac);
+    if (ret)
+        goto cleanup;
+
+    if (privsvr != NULL && k5_pac_should_have_ticket_signature(server_princ)) {
+        /* To check the PAC ticket signatures, re-encode the ticket with the
+         * PAC contents replaced by a single zero. */
+        orig = ifrelj;
+        ifrelj = &zpac;
+        ret = krb5_encode_authdata_container(context,
+                                             KRB5_AUTHDATA_IF_RELEVANT,
+                                             ifrel, &recoded_ifrel);
+        ifrelj = orig;
+        if (ret)
+            goto cleanup;
+        orig = authdatai;
+        authdatai = recoded_ifrel0;
+        ret = encode_krb5_enc_tkt_part(enc_tkt, &recoded_tkt);
+        authdatai = orig;
+        if (ret)
+            goto cleanup;
+
+        ret = verify_checksum(context, pac, KRB5_PAC_TICKET_CHECKSUM, privsvr,
+                              KRB5_KEYUSAGE_APP_DATA_CKSUM, recoded_tkt);
+        if (ret)
+            goto cleanup;
+    }
+
+    ret = krb5_pac_verify_ext(context, pac, enc_tkt->times.authtime, NULL,
+                              server, privsvr, FALSE);
 
-    if (valid == FALSE)
-        ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+    *pac_out = pac;
+    pac = NULL;
 
+cleanup:
+    krb5_pac_free(context, pac);
+    krb5_free_data(context, recoded_tkt);
+    krb5_free_authdata(context, ifrel);
+    krb5_free_authdata(context, recoded_ifrel);
     return ret;
 }
 
@@ -659,13 +731,13 @@
     krb5_error_code ret;
 
     if (server != NULL) {
-        ret = k5_pac_verify_server_checksum(context, pac, server);
+        ret = verify_server_checksum(context, pac, server);
         if (ret != 0)
             return ret;
     }
 
     if (privsvr != NULL) {
-        ret = k5_pac_verify_kdc_checksum(context, pac, privsvr);
+        ret = verify_kdc_checksum(context, pac, privsvr);
         if (ret != 0)
             return ret;
     }

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/pac_sign.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/pac_sign.c Changed

@@ -25,6 +25,7 @@
  */
 
 #include "k5-int.h"
+#include "int-proto.h"
 #include "authdata.h"
 
 /* draft-brezak-win2k-krb-authz-00 */
@@ -286,3 +287,123 @@
 
     return 0;
 }
+
+/* Add a signature over der_enc_tkt in privsvr to pac.  der_enc_tkt should be
+ * encoded with a dummy PAC authdata element containing a single zero byte. */
+static krb5_error_code
+add_ticket_signature(krb5_context context, const krb5_pac pac,
+                     krb5_data *der_enc_tkt, const krb5_keyblock *privsvr)
+{
+    krb5_error_code ret;
+    krb5_data ticket_cksum;
+    krb5_cksumtype ticket_cksumtype;
+    krb5_crypto_iov iov2;
+
+    /* Create zeroed buffer for checksum. */
+    ret = k5_insert_checksum(context, pac, KRB5_PAC_TICKET_CHECKSUM,
+                             privsvr, &ticket_cksumtype);
+    if (ret)
+        return ret;
+
+    ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_TICKET_CHECKSUM,
+                               &ticket_cksum);
+    if (ret)
+        return ret;
+
+    iov0.flags = KRB5_CRYPTO_TYPE_DATA;
+    iov0.data = *der_enc_tkt;
+    iov1.flags = KRB5_CRYPTO_TYPE_CHECKSUM;
+    iov1.data = make_data(ticket_cksum.data + PAC_SIGNATURE_DATA_LENGTH,
+                            ticket_cksum.length - PAC_SIGNATURE_DATA_LENGTH);
+    ret = krb5_c_make_checksum_iov(context, ticket_cksumtype, privsvr,
+                                   KRB5_KEYUSAGE_APP_DATA_CKSUM, iov, 2);
+    if (ret)
+        return ret;
+
+    store_32_le(ticket_cksumtype, ticket_cksum.data);
+    return 0;
+}
+
+/* Set *out to an AD-IF-RELEVANT authdata element containing a PAC authdata
+ * element with contents pac_data. */
+static krb5_error_code
+encode_pac_ad(krb5_context context, krb5_data *pac_data, krb5_authdata **out)
+{
+    krb5_error_code ret;
+    krb5_authdata *container2, **encoded_container = NULL;
+    krb5_authdata pac_ad = { KV5M_AUTHDATA, KRB5_AUTHDATA_WIN2K_PAC };
+    uint8_t z = 0;
+
+    pac_ad.contents = (pac_data != NULL) ? (uint8_t *)pac_data->data : &z;
+    pac_ad.length = (pac_data != NULL) ? pac_data->length : 1;
+    container0 = &pac_ad;
+    container1 = NULL;
+
+    ret = krb5_encode_authdata_container(context, KRB5_AUTHDATA_IF_RELEVANT,
+                                         container, &encoded_container);
+    if (ret)
+        return ret;
+
+    *out = encoded_container0;
+    free(encoded_container);
+    return 0;
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt,
+                     const krb5_pac pac, krb5_const_principal server_princ,
+                     krb5_const_principal client_princ,
+                     const krb5_keyblock *server, const krb5_keyblock *privsvr,
+                     krb5_boolean with_realm)
+{
+    krb5_error_code ret;
+    krb5_data *der_enc_tkt = NULL, pac_data = empty_data();
+    krb5_authdata **list, *pac_ad;
+    size_t count;
+
+    /* Reallocate space for another authdata element in enc_tkt. */
+    list = enc_tkt->authorization_data;
+    for (count = 0; list != NULL && listcount != NULL; count++);
+    list = realloc(enc_tkt->authorization_data, (count + 2) * sizeof(*list));
+    if (list == NULL)
+        return ENOMEM;
+    listcount = NULL;
+    enc_tkt->authorization_data = list;
+
+    /* Create a dummy PAC for ticket signing and make it the first element. */
+    ret = encode_pac_ad(context, NULL, &pac_ad);
+    if (ret)
+        goto cleanup;
+    memmove(list + 1, list, (count + 1) * sizeof(*list));
+    list0 = pac_ad;
+
+    if (k5_pac_should_have_ticket_signature(server_princ)) {
+        ret = encode_krb5_enc_tkt_part(enc_tkt, &der_enc_tkt);
+        if (ret)
+            goto cleanup;
+
+        assert(privsvr != NULL);
+        ret = add_ticket_signature(context, pac, der_enc_tkt, privsvr);
+        if (ret)
+            goto cleanup;
+    }
+
+    ret = krb5_pac_sign_ext(context, pac, enc_tkt->times.authtime,
+                            client_princ, server, privsvr, with_realm,
+                            &pac_data);
+    if (ret)
+        goto cleanup;
+
+    /* Replace the dummy PAC with the signed real one. */
+    ret = encode_pac_ad(context, &pac_data, &pac_ad);
+    if (ret)
+        goto cleanup;
+    free(list0->contents);
+    free(list0);
+    list0 = pac_ad;
+
+cleanup:
+    krb5_free_data(context, der_enc_tkt);
+    krb5_free_data_contents(context, &pac_data);
+    return ret;
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/parse.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/parse.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/preauth_otp.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/preauth_otp.c Changed

@@ -504,38 +504,33 @@
                      void *prompter_data, krb5_otp_tokeninfo **tis,
                      krb5_otp_tokeninfo **out_ti)
 {
-    char *banner = NULL, *tmp, response1024;
+    char response1024;
     krb5_otp_tokeninfo *ti = NULL;
     krb5_error_code retval = 0;
+    struct k5buf buf;
     int i = 0, j = 0;
 
+    k5_buf_init_dynamic(&buf);
+    k5_buf_add(&buf, _("Please choose from the following:\n"));
     for (i = 0; tisi != NULL; i++) {
-        if (asprintf(&tmp, "%s\t%d. %s %.*s\n",
-                     banner ? banner :
-                         _("Please choose from the following:\n"),
-                     i + 1, _("Vendor:"), tisi->vendor.length,
-                     tisi->vendor.data) < 0) {
-            free(banner);
-            return ENOMEM;
-        }
-
-        free(banner);
-        banner = tmp;
+        k5_buf_add_fmt(&buf, "\t%d. %s ", i + 1, _("Vendor:"));
+        k5_buf_add_len(&buf, tisi->vendor.data, tisi->vendor.length);
+        k5_buf_add(&buf, "\n");
     }
+    if (k5_buf_status(&buf) != 0)
+        return ENOMEM;
 
     do {
-        retval = doprompt(context, prompter, prompter_data,
-                          banner, _("Enter #"), response, sizeof(response));
-        if (retval != 0) {
-            free(banner);
-            return retval;
-        }
+        retval = doprompt(context, prompter, prompter_data, buf.data,
+                          _("Enter #"), response, sizeof(response));
+        if (retval != 0)
+            goto cleanup;
 
         errno = 0;
         j = strtol(response, NULL, 0);
         if (errno != 0) {
-            free(banner);
-            return errno;
+            retval = errno;
+            goto cleanup;
         }
         if (j < 1 || j > i)
             continue;
@@ -543,9 +538,11 @@
         ti = tis--j;
     } while (ti == NULL);
 
-    free(banner);
     *out_ti = ti;
-    return 0;
+
+cleanup:
+    k5_buf_free(&buf);
+    return retval;
 }
 
 /* Builds a challenge string from the given tokeninfo. */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/send_tgs.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/send_tgs.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/sendauth.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/sendauth.c Changed

@@ -126,29 +126,6 @@
         credsp = in_creds;
     }
 
-    if (ap_req_options & AP_OPTS_USE_SUBKEY) {
-        /* Provide some more fodder for random number code.
-           This isn't strong cryptographically; the point here is
-           not to guarantee randomness, but to make it less likely
-           that multiple sessions could pick the same subkey.  */
-        struct sockaddr_storage rnd_data;
-        GETPEERNAME_ARG3_TYPE len2;
-        krb5_data d = make_data(&rnd_data, sizeof(rnd_data));
-
-        len2 = sizeof(rnd_data);
-        if (getpeername(*(int *)fd, ss2sa(&rnd_data), &len2) == 0) {
-            d.length = len2;
-            (void)krb5_c_random_add_entropy(
-                context, KRB5_C_RANDSOURCE_EXTERNAL_PROTOCOL, &d);
-        }
-        len2 = sizeof(rnd_data);
-        if (getsockname(*(int *)fd, ss2sa(&rnd_data), &len2) == 0) {
-            d.length = len2;
-            (void)krb5_c_random_add_entropy(
-                context, KRB5_C_RANDSOURCE_EXTERNAL_PROTOCOL, &d);
-        }
-    }
-
     outbuf0.data = NULL;      /* Coverity is confused otherwise */
     if ((retval = krb5_mk_req_extended(context, auth_context,
                                        ap_req_options, in_data, credsp,

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/t_kerb.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/t_kerb.c Changed

@@ -14,6 +14,7 @@
 void test_425_conv_principal (krb5_context, char *, char*, char *);
 void test_524_conv_principal (krb5_context, char *);
 void test_parse_name (krb5_context, const char *);
+void test_name_type (krb5_context, const char *);
 void test_set_realm (krb5_context, const char *, const char *);
 void usage (char *);
 
@@ -121,6 +122,21 @@
 }
 
 void
+test_name_type(krb5_context ctx, const char *name)
+{
+    krb5_error_code retval;
+    krb5_principal  princ = 0;
+
+    retval = krb5_parse_name(ctx, name, &princ);
+    if (retval) {
+        com_err("krb5_parse_name", retval, 0);
+        return;
+    }
+    printf("name_type principal(%s): %d\n", name, krb5_princ_type(ctx, princ));
+    krb5_free_principal(ctx, princ);
+}
+
+void
 test_set_realm(krb5_context ctx, const char *name, const char *realm)
 {
     krb5_error_code retval;
@@ -154,10 +170,11 @@
 void
 usage(char *progname)
 {
-    fprintf(stderr, "%s: Usage: %s 425_conv_principal <name> <inst> <realm\n",
+    fprintf(stderr, "%s: Usage: %s 425_conv_principal <name> <inst> <realm>\n",
             progname, progname);
     fprintf(stderr, "\t%s 524_conv_principal <name>\n", progname);
     fprintf(stderr, "\t%s parse_name <name>\n", progname);
+    fprintf(stderr, "\t%s name_type <name>\n", progname);
     fprintf(stderr, "\t%s set_realm <name> <realm>\n", progname);
     fprintf(stderr, "\t%s string_to_timestamp <time>\n", progname);
     exit(1);
@@ -198,6 +215,11 @@
             if (!argc) usage(progname);
             name = *argv;
             test_parse_name(ctx, name);
+        } else if (strcmp(*argv, "name_type") == 0) {
+            argc--; argv++;
+            if (!argc) usage(progname);
+            name = *argv;
+            test_name_type(ctx, name);
         } else if (strcmp(*argv, "set_realm") == 0) {
             argc--; argv++;
             if (!argc) usage(progname);

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/t_pac.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/t_pac.c Changed

@@ -431,6 +431,16 @@
     0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00
 };
 
+static const unsigned char fuzz1 = {
+    0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,
+    0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5
+};
+
+static const unsigned char fuzz2 = {
+    0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00,
+    0x20, 0x20
+};
+
 static const char *s4u_principal = "w2k8u@ACME.COM";
 static const char *s4u_enterprise = "w2k8u@abc@ACME.COM";
 
@@ -595,6 +605,186 @@
     krb5_pac_free(context, pac);
 }
 
+static const krb5_keyblock ticket_sig_krbtgt_key = {
+    0, ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+    32, U("\x7a\x58\x98\xd2\xaf\xa6\xaf\xc0\x6a\xce\x06\x04\x4b\xc2\x70\x84"
+          "\x9b\x8e\x0a\x6c\x4c\x07\xdc\x6f\xbb\x48\x43\xe1\xd2\xaa\x97\xf7")
+};
+
+static const krb5_keyblock ticket_sig_server_key = {
+    0, ENCTYPE_ARCFOUR_HMAC,
+    16, U("\xed\x23\x11\x20\x7a\x21\x44\x20\xbf\xc0\x8d\x36\xf7\xf6\xb2\x3e")
+};
+
+static const krb5_data ticket_data = {
+    .length = 972, .data =
+    "\x61\x82\x03\xC8\x30\x82\x03\xC4\xA0\x03\x02\x01\x05\xA1\x0A\x1B"
+    "\x08\x43\x44\x4F\x4D\x2E\x43\x4F\x4D\xA2\x0F\x30\x0D\xA0\x03\x02"
+    "\x01\x01\xA1\x06\x30\x04\x1B\x02\x73\x31\xA3\x82\x03\x9E\x30\x82"
+    "\x03\x9A\xA0\x03\x02\x01\x17\xA1\x03\x02\x01\x03\xA2\x82\x03\x8C"
+    "\x04\x82\x03\x88\x44\x31\x61\x20\x17\xC9\xFE\xBC\xAC\x46\xB5\x77"
+    "\xE9\x68\x04\x4C\x9B\x31\x91\x0C\xC1\xD4\xDD\xEF\xC7\x34\x20\x08"
+    "\x90\x91\xE8\x79\xE0\xB5\x03\x26\xA4\x65\xDE\xEC\x47\x03\x2A\x8F"
+    "\x61\xE7\x4D\x38\x5A\x42\x95\x5A\xF9\x2F\x41\x2C\x2A\x6E\x60\xA1"
+    "\xEB\x51\xB3\xBD\x4C\x00\x41\x2A\x44\x76\x08\x37\x1A\x51\xFD\x65"
+    "\x67\x7E\xBF\x3D\x90\x86\xE3\x9A\x54\x6B\x67\xA8\x08\x7A\x73\xCC"
+    "\xC3\xB7\x4B\xD5\x5C\x3A\x14\x6C\xC1\x5F\x54\x4B\x92\x55\xB4\xB7"
+    "\x92\x23\x3F\x53\x89\x47\x8E\x1F\x8B\xB9\xDB\x3B\x93\xE8\x70\xE4"
+    "\x24\xB8\x9D\xF0\x0E\x35\x28\xF8\x7A\x27\x5D\xF7\x25\x97\x9C\xF5"
+    "\x9F\x9F\x64\x04\xF2\xA3\xAB\x11\x15\xB6\xDA\x18\xD6\x46\xD5\xE6"
+    "\xB8\x08\xDE\x0A\x62\xFD\xF8\xAA\x52\x90\xD9\x67\x29\xB2\xCD\x06"
+    "\xB6\xB0\x50\x2B\x3F\x0F\xA3\xA5\xBF\xAA\x6E\x40\x03\xD6\x5F\x02"
+    "\xBC\xD8\x18\x47\x97\x09\xD7\xE4\x96\x3B\xCB\xEB\x92\x2C\x3C\x49"
+    "\xFF\x1F\x71\xE0\x52\x94\x0F\x8B\x9F\xB8\x2A\xBB\x9C\xE2\xA3\xDD"
+    "\x38\x89\xE2\xB1\x0B\x9E\x1F\x7A\xB3\xE3\xD2\xB0\x94\xDC\x87\xBE"
+    "\x37\xA6\xD3\xB3\x29\x35\x9A\x72\xC3\x7A\xF1\xA9\xE6\xC5\xD1\x26"
+    "\x83\x65\x44\x17\xBA\x55\xA8\x5E\x94\x26\xED\xE9\x8A\x93\x11\x5D"
+    "\x7E\x20\x1B\x9C\x15\x9E\x13\x37\x03\x4D\xDD\x99\x51\xD8\x66\x29"
+    "\x6A\xB9\xFB\x49\xFE\x52\x78\xDA\x86\x85\xA9\xA3\xB9\xEF\xEC\xAD"
+    "\x35\xA6\x8D\xAC\x0F\x75\x22\xBB\x0B\x49\x1C\x13\x52\x40\xC9\x52"
+    "\x69\x09\x54\xD1\x0F\x94\x3F\x22\x48\x67\xB0\x96\x28\xAA\xE6\x28"
+    "\xD9\x0C\x08\xEF\x51\xED\x15\x5E\xA2\x53\x59\xA5\x03\xB4\x06\x20"
+    "\x3D\xCC\xB4\xC5\xF8\x8C\x73\x67\xA3\x21\x3D\x19\xCD\xD4\x12\x28"
+    "\xD2\x93\xDE\x0D\xF0\x71\x10\x50\xD6\x33\x35\x04\x11\x64\x43\x39"
+    "\xC3\xDF\x96\xE3\x66\xE3\x85\xCA\xE7\x67\x14\x3A\xF0\x43\xAA\xBB"
+    "\xD4\x1D\xB5\x24\xB5\x74\x90\x25\xA7\x87\x7E\xDB\xD3\x83\x8A\x3A"
+    "\x69\xA8\x2D\xAF\xB7\xB8\xF3\xDC\x13\xAF\x45\x61\x3F\x59\x39\x7E"
+    "\x69\xDE\x0C\x04\xF1\x10\x6B\xB4\x56\xFA\x21\x9F\x72\x2B\x60\x86"
+    "\xE3\x23\x0E\xC4\x51\xF6\xBE\xD8\xE1\x5F\xEE\x73\x4C\x17\x4C\x2C"
+    "\x1B\xFB\x9F\x1F\x7A\x3B\x07\x5B\x8E\xF1\x01\xAC\xD6\x30\x94\x8A"
+    "\x5D\x22\x6F\x08\xCE\xED\x5E\xB6\xDB\x86\x8C\x87\xEB\x8D\x91\xFF"
+    "\x0A\x86\x30\xBD\xC0\xF8\x25\xE7\xAE\x24\x35\xF2\xFC\xE5\xFD\x1B"
+    "\xB0\x05\x4A\xA3\xE5\xEB\x2E\x05\xAD\x99\x67\x49\x87\xE6\xB3\x87"
+    "\x82\xA4\x59\xA7\x6E\xDD\xF2\xB6\x66\xE8\xF7\x70\xF5\xBD\xC9\x0E"
+    "\xFA\x9C\x79\x84\xD4\x9B\x05\x0E\xBB\xF5\xDB\xEF\xFC\xCC\x26\xF2"
+    "\x93\xCF\xD2\x04\x3C\xA9\x2C\x65\x42\x97\x86\xD8\x38\x0A\x1E\xF6"
+    "\xD6\xCA\x30\xB5\x1A\xEC\xFB\xBA\x3B\x84\x57\xB0\xFD\xFB\xE6\xBC"
+    "\xF2\x76\xF6\x4C\xBB\xAB\xB1\x31\xA1\x27\x7C\xE6\xE6\x81\xB6\xCE"
+    "\x84\x86\x40\xB6\x40\x33\xC4\xF8\xB4\x15\xCF\xAA\xA5\x51\x78\xB9"
+    "\x8B\x50\x25\xB2\x88\x86\x96\x72\x8C\x71\x4D\xB5\x3A\x94\x86\x77"
+    "\x0E\x95\x9B\x16\x93\xEF\x3A\x11\x79\xBA\x83\xF7\x74\xD3\x8D\xBA"
+    "\x15\xE1\x2C\x04\x57\xA8\x92\x1E\x9D\x00\x8E\x20\xFD\x30\x70\xE7"
+    "\xF5\x65\x2F\x19\x0C\x94\xBA\x03\x71\x12\x96\xCD\xC8\xB4\x96\xDB"
+    "\xCE\x19\xC2\xDF\x3C\xC2\xF6\x3D\x53\xED\x98\xA5\x41\x72\x2A\x22"
+    "\x7B\xF3\x2B\x17\x6C\xE1\x39\x7D\xAE\x9B\x11\xF9\xC1\xA6\x9E\x9F"
+    "\x89\x3C\x12\xAA\x94\x74\xA7\x4F\x70\xE8\xB9\xDE\x04\xF0\x9D\x39"
+    "\x24\x2D\x92\xE8\x46\x2D\x2E\xF0\x40\x66\x1A\xD9\x27\xF9\x98\xF1"
+    "\x81\x1D\x70\x62\x63\x30\x6D\xCD\x84\x04\x5F\xFA\x83\xD3\xEC\x8D"
+    "\x86\xFB\x40\x61\xC1\x8A\x45\xFF\x7B\xD9\xD4\x18\x61\x7F\x51\xE3"
+    "\xFC\x1E\x18\xF0\xAF\xC6\x18\x2C\xE1\x6D\x5D\xF9\x62\xFC\x20\xA3"
+    "\xB2\x8A\x5F\xE5\xBB\x29\x0F\x99\x63\x07\x88\x38\x3A\x3B\x73\x2A"
+    "\x6D\xDA\x3D\xA8\x0D\x8F\x56\x41\x89\x82\xE5\xB8\x61\x00\x64\x7D"
+    "\x17\x0C\xCE\x03\x55\x8F\xF4\x5B\x0D\x50\xF2\xEB\x05\x67\xBE\xDB"
+    "\x7B\x75\xC5\xEA\xA1\xAB\x1D\xB0\x3C\x6D\x42\x08\x0B\x9A\x45\x20"
+    "\xA8\x8F\xE5\x67\x47\x30\xDE\x93\x5F\x43\x05\xEB\xA8\x2D\x80\xF5"
+    "\x1A\xB8\x4A\x4E\x42\x2D\x0B\x7A\xDC\x46\x20\x2D\x13\x17\xDD\x4B"
+    "\x94\x96\xAA\x1F\x06\x0C\x1F\x62\x07\x9C\x40\xA1"
+};
+
+static void
+test_pac_ticket_signature(krb5_context context)
+{
+    krb5_error_code ret;
+    krb5_ticket *ticket;
+    krb5_principal sprinc;
+    krb5_authdata **authdata1, **authdata2;
+    krb5_pac pac, pac2, pac3;
+    uint32_t *list;
+    size_t len, i;
+    krb5_data data;
+
+    ret = krb5_decode_ticket(&ticket_data, &ticket);
+    if (ret)
+        err(context, ret, "while decoding ticket");
+
+    ret = krb5_decrypt_tkt_part(context, &ticket_sig_server_key, ticket);
+    if (ret)
+        err(context, ret, "while decrypting ticket");
+
+    ret = krb5_parse_name(context, "s1@CDOM.COM", &sprinc);
+    if (ret)
+        err(context, ret, "krb5_parse_name");
+
+    ret = krb5_kdc_verify_ticket(context, ticket->enc_part2, sprinc,
+                                 &ticket_sig_server_key,
+                                 &ticket_sig_krbtgt_key, &pac);
+    if (ret)
+        err(context, ret, "while verifying ticket");
+
+    /* In this test, the server is also the client. */
+    ret = krb5_pac_verify(context, pac, ticket->enc_part2->times.authtime,
+                          ticket->server, NULL, NULL);
+    if (ret)
+        err(context, ret, "while verifying PAC client info");
+
+    /* We know there is only a PAC in this test's ticket. */
+    authdata1 = ticket->enc_part2->authorization_data;
+    ticket->enc_part2->authorization_data = NULL;
+
+    ret = krb5_kdc_sign_ticket(context, ticket->enc_part2, pac, sprinc,
+                               sprinc, &ticket_sig_server_key,
+                               &ticket_sig_krbtgt_key, FALSE);
+    if (ret)
+        err(context, ret, "while signing ticket");
+
+    authdata2 = ticket->enc_part2->authorization_data;
+    assert(authdata2 != NULL);
+    assert(authdata21 == NULL);
+
+    assert(authdata10->length == authdata20->length);
+    assert(memcmp(authdata10->contents, authdata20->contents,
+                  authdata10->length) == 0);
+
+    /* Test adding signatures to a new PAC. */
+    ret = krb5_pac_init(context, &pac2);
+    if (ret)
+        err(context, ret, "krb5_pac_init");
+
+    ret = krb5_pac_get_types(context, pac, &len, &list);
+    if (ret)
+        err(context, ret, "krb5_pac_get_types");
+
+    for (i = 0; i < len; i++) {
+        /* Skip server_cksum, privsvr_cksum, and ticket_cksum. */
+        if (listi == 6 || listi == 7 || listi == 16)
+            continue;
+
+        ret = krb5_pac_get_buffer(context, pac, listi, &data);
+        if (ret)
+            err(context, ret, "krb5_pac_get_buffer");
+
+        ret = krb5_pac_add_buffer(context, pac2, listi, &data);
+        if (ret)
+            err(context, ret, "krb5_pac_add_buffer");
+
+        krb5_free_data_contents(context, &data);
+    }
+    free(list);
+
+    krb5_free_authdata(context, authdata1);
+    krb5_free_authdata(context, ticket->enc_part2->authorization_data);
+    ticket->enc_part2->authorization_data = NULL;
+
+    ret = krb5_kdc_sign_ticket(context, ticket->enc_part2, pac2, sprinc, NULL,
+                               &ticket_sig_server_key, &ticket_sig_krbtgt_key,
+                               FALSE);
+    if (ret)
+        err(context, ret, "while signing ticket");
+
+    /* We can't compare the data since the order of the buffers may differ. */
+    ret = krb5_kdc_verify_ticket(context, ticket->enc_part2, sprinc,
+                                 &ticket_sig_server_key,
+                                 &ticket_sig_krbtgt_key, &pac3);
+    if (ret)
+        err(context, ret, "while verifying ticket");
+
+    krb5_pac_free(context, pac);
+    krb5_pac_free(context, pac2);
+    krb5_pac_free(context, pac3);
+    krb5_free_principal(context, sprinc);
+    krb5_free_ticket(context, ticket);
+}
+
 int
 main(int argc, char **argv)
 {
@@ -608,6 +798,8 @@
     if (ret)
         err(NULL, 0, "krb5_init_contex");
 
+    test_pac_ticket_signature(context);
+
     ret = krb5_set_default_realm(context, "WIN2K3.THINKER.LOCAL");
     if (ret)
         err(context, ret, "krb5_set_default_realm");
@@ -646,6 +838,14 @@
         krb5_free_principal(context, sep);
     }
 
+    /* Check problematic PACs found by fuzzing. */
+    ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac);
+    if (!ret)
+        err(context, ret, "krb5_pac_parse should have failed");
+    ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac);
+    if (!ret)
+        err(context, ret, "krb5_pac_parse should have failed");
+
     /*
      * Test empty free
      */

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/t_ref_kerb.out -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/t_ref_kerb.out Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/t_vfy_increds.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/t_vfy_increds.c Changed

@@ -26,9 +26,9 @@
 
 /*
  * This program is intended to be run from t_vfy_increds.py.  It retrieves the
- * first credential from the default ccache and verifies it against the default
- * keytab, exiting with status 0 on successful verification and 1 on
- * unsuccessful verification.
+ * first non-config credential from the default ccache and verifies it against
+ * the default keytab, exiting with status 0 on successful verification and 1
+ * on unsuccessful verification.
  */
 
 #include "k5-int.h"
@@ -64,10 +64,15 @@
     if (*argv != NULL)
         check(krb5_parse_name(context, *argv, &princ));
 
-    /* Fetch the first credential from the default ccache. */
+    /* Fetch the first non-config credential from the default ccache. */
     check(krb5_cc_default(context, &ccache));
     check(krb5_cc_start_seq_get(context, ccache, &cursor));
-    check(krb5_cc_next_cred(context, ccache, &cursor, &creds));
+    for (;;) {
+        check(krb5_cc_next_cred(context, ccache, &cursor, &creds));
+        if (!krb5_is_config_principal(context, creds.server))
+            break;
+        krb5_free_cred_contents(context, &creds);
+    }
     check(krb5_cc_end_seq_get(context, ccache, &cursor));
     check(krb5_cc_close(context, ccache));

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/krb/tgtname.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/krb/tgtname.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/libkrb5.exports -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/libkrb5.exports Changed

@@ -1,6 +1,5 @@
 _krb5_conf_boolean
 decode_krb5_ad_kdcissued
-decode_krb5_ad_signedpath
 decode_krb5_ap_rep
 decode_krb5_ap_rep_enc_part
 decode_krb5_ap_req
@@ -53,8 +52,6 @@
 decode_krb5_typed_data
 decode_utf8_strings
 encode_krb5_ad_kdcissued
-encode_krb5_ad_signedpath_data
-encode_krb5_ad_signedpath
 encode_krb5_ap_rep
 encode_krb5_ap_rep_enc_part
 encode_krb5_ap_req
@@ -175,12 +172,14 @@
 k5_rc_close
 k5_rc_get_name
 k5_rc_resolve
+k5_rc_store
 k5_size_auth_context
 k5_size_authdata
 k5_size_authdata_context
 k5_size_context
 k5_size_keyblock
 k5_size_principal
+k5_sname_compare
 k5_unmarshal_cred
 k5_unmarshal_princ
 k5_unwrap_cammac_svc
@@ -321,7 +320,6 @@
 krb5_fcc_ops
 krb5_find_authdata
 krb5_free_ad_kdcissued
-krb5_free_ad_signedpath
 krb5_free_address
 krb5_free_addresses
 krb5_free_ap_rep
@@ -463,6 +461,8 @@
 krb5_is_referral_realm
 krb5_is_thread_safe
 krb5_kdc_rep_decrypt_proc
+krb5_kdc_sign_ticket
+krb5_kdc_verify_ticket
 krb5_kt_add_entry
 krb5_kt_client_default
 krb5_kt_close
@@ -489,6 +489,7 @@
 krb5_make_authdata_kdc_issued
 krb5_make_full_ipaddr
 krb5_make_fulladdr
+krb5_marshal_credentials
 krb5_mcc_ops
 krb5_merge_authdata
 krb5_mk_1cred
@@ -592,6 +593,7 @@
 krb5_timestamp_to_sfstring
 krb5_timestamp_to_string
 krb5_unlock_file
+krb5_unmarshal_credentials
 krb5_unpack_full_ipaddr
 krb5_unparse_name
 krb5_unparse_name_ext

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/os/changepw.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/os/changepw.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/os/dnssrv.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/os/dnssrv.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/os/os-proto.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/os/os-proto.h Changed

@@ -49,6 +49,7 @@
     UDP_FIRST = 0,
     UDP_LAST,
     NO_UDP,
+    ONLY_UDP
 } k5_transport_strategy;
 
 /* A single server hostname or address. */
@@ -85,10 +86,15 @@
 
 /*
  * Initialize with all zeros except for princ.  Set no_hostrealm to disable
- * host-to-realm lookup, which ordinarily happens after canonicalizing the host
- * part.  Set subst_defrealm to substitute the default realm for the referral
- * realm after realm lookup (this has no effect if no_hostrealm is set).  Free
- * with free_canonprinc() when done.
+ * host-to-realm lookup, which ordinarily happens during fallback processing
+ * after canonicalizing the host part.  Set subst_defrealm to substitute the
+ * default realm for the referral realm after realm lookup.  Do not set both
+ * flags.  Free with free_canonprinc() when done.
+ *
+ * no_hostrealm only applies if fallback processing is in use
+ * (dns_canonicalize_hostname = fallback).  It will not remove the realm if
+ * krb5_sname_to_principal() already canonicalized the hostname and looked up a
+ * realm.  subst_defrealm applies whether or not fallback processing is in use.
  */
 struct canonprinc {
     krb5_const_principal princ;

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/os/prompter.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/os/prompter.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/os/sendto_kdc.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/os/sendto_kdc.c Changed

@@ -722,8 +722,10 @@
 
         if (*udpbufp == NULL) {
             *udpbufp = malloc(MAX_DGRAM_SIZE);
-            if (*udpbufp == 0)
+            if (*udpbufp == NULL) {
+                free(state);
                 return ENOMEM;
+            }
         }
         state->in.buf = *udpbufp;
         state->in.bufsize = MAX_DGRAM_SIZE;
@@ -802,11 +804,14 @@
     int err, result;
     char portbufPORT_LENGTH;
 
-    /* Skip UDP entries if we don't want UDP. */
+    /* Skip entries excluded by the strategy. */
     if (strategy == NO_UDP && entry->transport == UDP)
         return 0;
+    if (strategy == ONLY_UDP && entry->transport != UDP &&
+        entry->transport != TCP_OR_UDP)
+        return 0;
 
-    transport = (strategy == UDP_FIRST) ? UDP : TCP;
+    transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP;
     if (entry->hostname == NULL) {
         /* Added by a module, so transport is either TCP or UDP. */
         ai.ai_socktype = socktype_for_transport(entry->transport);
@@ -850,8 +855,9 @@
     }
 
     /* For TCP_OR_UDP entries, add each address again with the non-preferred
-     * transport, unless we are avoiding UDP.  Flag these as deferred. */
-    if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) {
+     * transport, if there is one.  Flag these as deferred. */
+    if (retval == 0 && entry->transport == TCP_OR_UDP &&
+        (strategy == UDP_FIRST || strategy == UDP_LAST)) {
         transport = (strategy == UDP_FIRST) ? TCP : UDP;
         for (a = addrs; a != 0 && retval == 0; a = a->ai_next) {
             a->ai_socktype = socktype_for_transport(transport);

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/os/sn2princ.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/os/sn2princ.c Changed

@@ -174,7 +174,7 @@
      * IPv6 address will have more than one colon, so don't accept that. */
     if (p == NULL || tlen == 1 || memchr(p + 1, ':', tlen - 1) != NULL) {
         *host = *data;
-        *trailer = empty_data();
+        *trailer = make_data("", 0);
     } else {
         *host = make_data(data->data, p - data->data);
         *trailer = make_data(p, tlen);
@@ -271,23 +271,62 @@
 k5_canonprinc(krb5_context context, struct canonprinc *iter,
               krb5_const_principal *princ_out)
 {
+    krb5_error_code ret;
     int step = ++iter->step;
 
     *princ_out = NULL;
 
-    /* If we're not doing fallback, the input principal is canonical. */
-    if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK ||
-        iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2) {
+    /* If the hostname isn't from krb5_sname_to_principal(), the input
+     * principal is canonical. */
+    if (iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 ||
+        iter->princ->data1.length == 0) {
         *princ_out = (step == 1) ? iter->princ : NULL;
         return 0;
     }
 
+    /* If we're not doing fallback, the hostname is canonical, but we may need
+     * to substitute the default realm. */
+    if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK) {
+        if (step > 1)
+            return 0;
+        iter->copy = *iter->princ;
+        if (iter->subst_defrealm && iter->copy.realm.length == 0) {
+            ret = krb5_get_default_realm(context, &iter->realm);
+            if (ret)
+                return ret;
+            iter->copy = *iter->princ;
+            iter->copy.realm = string2data(iter->realm);
+        }
+        *princ_out = &iter->copy;
+        return 0;
+    }
+
     /* Canonicalize without DNS at step 1, with DNS at step 2. */
     if (step > 2)
         return 0;
     return canonicalize_princ(context, iter, step == 2, princ_out);
 }
 
+krb5_boolean
+k5_sname_compare(krb5_context context, krb5_const_principal sname,
+                 krb5_const_principal princ)
+{
+    krb5_error_code ret;
+    struct canonprinc iter = { sname, .subst_defrealm = TRUE };
+    krb5_const_principal canonprinc = NULL;
+    krb5_boolean match = FALSE;
+
+    while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 &&
+           canonprinc != NULL) {
+        if (krb5_principal_compare(context, canonprinc, princ)) {
+            match = TRUE;
+            break;
+        }
+    }
+    free_canonprinc(&iter);
+    return match;
+}
+
 krb5_error_code KRB5_CALLCONV
 krb5_sname_to_principal(krb5_context context, const char *hostname,
                         const char *sname, krb5_int32 type,

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5/os/trace.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5/os/trace.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/krb5_32.def -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/krb5_32.def Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/lib/win_glue.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/lib/win_glue.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/k5identity.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/k5identity.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/k5login.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/k5login.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/k5srvutil.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/k5srvutil.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kadm5.acl.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kadm5.acl.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kadmin.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kadmin.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kadmind.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kadmind.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kdb5_ldap_util.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kdb5_ldap_util.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kdb5_util.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kdb5_util.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kdc.conf.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kdc.conf.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kdestroy.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kdestroy.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kerberos.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kerberos.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kinit.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kinit.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/klist.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/klist.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kpasswd.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kpasswd.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kprop.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kprop.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kpropd.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kpropd.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kproplog.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kproplog.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/krb5-config.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/krb5-config.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/krb5.conf.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/krb5.conf.man Changed

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5.CONF" "5" " " "1.19.2" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.20.1" "MIT Kerberos"
 .SH NAME
 krb5.conf \- Kerberos configuration file
 .
@@ -654,15 +654,12 @@
 .UNINDENT
 .SS domain_realm
 .sp
-The domain_realm section provides a translation from a domain name
-or hostname to a Kerberos realm name.  The tag name can be a host name
-or domain name, where domain names are indicated by a prefix of a
-period (\fB\&.\fP).  The value of the relation is the Kerberos realm name
-for that particular host or domain.  A host name relation implicitly
-provides the corresponding domain name relation, unless an explicit domain
-name relation is provided.  The Kerberos realm may be
+The domain_realm section provides a translation from hostnames to
+Kerberos realms.  Each tag is a domain name, providing the mapping for
+that domain and all subdomains.  If the tag begins with a period
+(\fB\&.\fP) then it applies only to subdomains.  The Kerberos realm may be
 identified either in the \fI\%realms\fP section or using DNS SRV records.
-Host names and domain names should be in lower case.  For example:
+Tag names should be in lower case.  For example:
 .INDENT 0.0
 .INDENT 3.5
 .sp
@@ -1491,6 +1488,6 @@
 .SH AUTHOR
 MIT
 .SH COPYRIGHT
-1985-2021, MIT
+1985-2022, MIT
 .\" Generated by docutils manpage writer.
 .

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/krb5kdc.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/krb5kdc.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/ksu.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/ksu.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kswitch.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kswitch.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/ktutil.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/ktutil.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/kvno.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/kvno.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/sclient.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/sclient.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/man/sserver.man -> _service:tar_scm:krb5-1.20.1.tar.gz/src/man/sserver.man Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/patchlevel.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/patchlevel.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/audit/kdc_j_encode.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/audit/kdc_j_encode.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/certauth/test/certauth_test.exports -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/certauth/test/certauth_test.exports Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/certauth/test/main.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/certauth/test/main.c Changed

@@ -38,7 +38,7 @@
     int initialized;
 };
 
-/* Test module 1 returns OK with an indicator. */
+/* Test module 1 passes with an indicator. */
 static krb5_error_code
 test1_authorize(krb5_context context, krb5_certauth_moddata moddata,
                 const uint8_t *cert, size_t cert_len,
@@ -131,9 +131,9 @@
 }
 
 /*
- * Test module 2 returns OK if princ matches the CN part of the subject name,
- * and returns indicators of the module name and princ.  If the "hwauth" string
- * attribute is set on db_entry, it returns KRB5_CERTAUTH_HWAUTH.
+ * Test module 2 passes if the principal name is "nocert".  Otherwise it
+ * returns OK if the CN of the cert matches the principal name, with indicators
+ * of the module name and princ, and errors if the certificate does not match.
  */
 static krb5_error_code
 test2_authorize(krb5_context context, krb5_certauth_moddata moddata,
@@ -143,7 +143,7 @@
                 char ***authinds_out)
 {
     krb5_error_code ret;
-    char *name = NULL, *strval = NULL, **ais = NULL;
+    char *name = NULL, **ais = NULL;
 
     *authinds_out = NULL;
 
@@ -153,6 +153,10 @@
                                   KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
     if (ret)
         goto cleanup;
+    if (strcmp(name, "nocert") == 0) {
+        ret = KRB5_PLUGIN_NO_HANDLE;
+        goto cleanup;
+    }
 
     if (!has_cn(context, cert, cert_len, name)) {
         ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
@@ -169,16 +173,50 @@
 
     ais = NULL;
 
+cleanup:
+    krb5_free_unparsed_name(context, name);
+    return ret;
+}
+
+/*
+ * Test module 3 reads the "hwauth" string attribute on db_entry, and adds an
+ * authentication indicator of "hwauth:<value>" if the attribute is set.  It
+ * returns KRB5_CERTAUTH_HWAUTH if the value is "ok", and
+ * KRB5_CERTAUTH_HWAUTH_PASS if the value is "pass".  Otherwise it passes.
+ */
+static krb5_error_code
+test3_authorize(krb5_context context, krb5_certauth_moddata moddata,
+                const uint8_t *cert, size_t cert_len,
+                krb5_const_principal princ, const void *opts,
+                const struct _krb5_db_entry_new *db_entry,
+                char ***authinds_out)
+{
+    krb5_error_code ret;
+    char *strval = NULL, **ais = NULL;
+
     ret = krb5_dbe_get_string(context, (krb5_db_entry *)db_entry, "hwauth",
                               &strval);
     if (ret)
-        goto cleanup;
+        return ret;
+    if (strval != NULL && strcmp(strval, "ok") == 0)
+        ret = KRB5_CERTAUTH_HWAUTH;
+    else if (strval != NULL && strcmp(strval, "pass") == 0)
+        ret = KRB5_CERTAUTH_HWAUTH_PASS;
+    else
+        ret = KRB5_PLUGIN_NO_HANDLE;
 
-    ret = (strval != NULL) ? KRB5_CERTAUTH_HWAUTH : 0;
-    krb5_dbe_free_string(context, strval);
+    if (strval != NULL) {
+        ais = calloc(2, sizeof(*ais));
+        assert(ais != NULL);
+        if (asprintf(&ais0, "hwauth:%s", strval) < 0)
+            abort();
+        assert(ais0 != NULL);
+    }
 
-cleanup:
-    krb5_free_unparsed_name(context, name);
+    *authinds_out = ais;
+    ais = NULL;
+
+    krb5_dbe_free_string(context, strval);
     return ret;
 }
 
@@ -219,3 +257,22 @@
     vt->free_ind = test_free_ind;
     return 0;
 }
+
+krb5_error_code
+certauth_test3_initvt(krb5_context context, int maj_ver, int min_ver,
+                      krb5_plugin_vtable vtable);
+
+krb5_error_code
+certauth_test3_initvt(krb5_context context, int maj_ver, int min_ver,
+                      krb5_plugin_vtable vtable)
+{
+    krb5_certauth_vtable vt;
+
+    if (maj_ver != 1)
+        return KRB5_PLUGIN_VER_NOTSUPP;
+    vt = (krb5_certauth_vtable)vtable;
+    vt->name = "test3";
+    vt->authorize = test3_authorize;
+    vt->free_ind = test_free_ind;
+    return 0;
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/db2/adb_policy.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/db2/adb_policy.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/db2/db2_exp.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/db2/db2_exp.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/db2/kdb_db2.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/db2/kdb_db2.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/ldap/ldap_exp.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/ldap/ldap_exp.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c Changed

@@ -188,20 +188,22 @@
                 for (i=0; valuesi != NULL; ++i) {
                     if (krb5_ldap_parse_principal_name(valuesi, &princ_name) != 0)
                         continue;
-                    if (krb5_parse_name(context, princ_name, &principal) != 0)
+                    st = krb5_parse_name(context, princ_name, &principal);
+                    free(princ_name);
+                    if (st)
                         continue;
+
                     if (is_principal_in_realm(ldap_context, principal)) {
-                        if ((st = populate_krb5_db_entry(context, ldap_context, ld, ent, principal,
-                                                         &entry)) != 0)
+                        st = populate_krb5_db_entry(context, ldap_context, ld,
+                                                    ent, principal, &entry);
+                        krb5_free_principal(context, principal);
+                        if (st)
                             goto cleanup;
                         (*func)(func_arg, &entry);
                         krb5_dbe_free_contents(context, &entry);
-                        (void) krb5_free_principal(context, principal);
-                        free(princ_name);
                         break;
                     }
                     (void) krb5_free_principal(context, principal);
-                    free(princ_name);
                 }
                 ldap_value_free(values);
             }

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c Changed

@@ -785,6 +785,7 @@
     char                        *polname = NULL;
     OPERATION optype;
     krb5_boolean                found_entry = FALSE;
+    char                        *filter = NULL;
 
     /* Clear the global error string */
     krb5_clear_error_message(context);
@@ -833,7 +834,6 @@
     if (entry->mask & KADM5_LOAD) {
         unsigned int     tree = 0;
         int              numlentries = 0;
-        char             *filter = NULL;
 
         /*  A load operation is special, will do a mix-in (add krbprinc
          *  attrs to a non-krb object entry) if an object exists with a
@@ -864,7 +864,6 @@
             if (st == LDAP_SUCCESS) {
                 numlentries = ldap_count_entries(ld, result);
                 if (numlentries > 1) {
-                    free(filter);
                     st = EINVAL;
                     k5_setmsg(context, st,
                               _("operation can not continue, more than one "
@@ -880,7 +879,6 @@
                             if ((principal_dn = ldap_get_dn(ld, ent)) == NULL) {
                                 ldap_get_option (ld, LDAP_OPT_RESULT_CODE, &st);
                                 st = set_ldap_error (context, st, 0);
-                                free(filter);
                                 goto cleanup;
                             }
                         }
@@ -889,7 +887,6 @@
             } else if (st != LDAP_NO_SUCH_OBJECT) {
                 /* could not perform search, return with failure */
                 st = set_ldap_error (context, st, 0);
-                free(filter);
                 goto cleanup;
             }
             ldap_msgfree(result);
@@ -900,8 +897,6 @@
              */
         } /* end for (tree = 0; principal_dn == ... */
 
-        free(filter);
-
         if (found_entry == FALSE && principal_dn != NULL) {
             /*
              * if principal_dn is null then there is code further down to
@@ -1450,6 +1445,7 @@
     }
 
 cleanup:
+    free(filter);
     if (user)
         free(user);

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/kdb/test/kdb_test.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/kdb/test/kdb_test.c Changed

@@ -205,7 +205,7 @@
                  (int)salttype, princstr, (int)realm->length, realm->data) < 0)
         abort();
     d = string2data(hashstr);
-    check(krb5_c_make_checksum(NULL, CKSUMTYPE_NIST_SHA, NULL, 0, &d, &cksum));
+    check(krb5_c_make_checksum(NULL, CKSUMTYPE_SHA1, NULL, 0, &d, &cksum));
 
     /* Make the appropriate number of input bytes from the hash result. */
     for (pos = 0; pos < keybytes; pos += n) {
@@ -407,9 +407,8 @@
         check(krb5_parse_name(context, canon, &princ));
         if (!krb5_realm_compare(context, search_for, princ)) {
             /* Out of realm */
-            if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) &&
-                ((flags & KRB5_KDB_FLAG_CANONICALIZE) ||
-                 search_for->type == KRB5_NT_ENTERPRISE_PRINCIPAL)) {
+            if ((flags & KRB5_KDB_FLAG_CLIENT) &&
+                (flags & KRB5_KDB_FLAG_REFERRAL_OK)) {
                 /* Return a client referral by creating an entry with only the
                  * principal set. */
                 *entry = ealloc(sizeof(**entry));
@@ -417,7 +416,7 @@
                 princ = NULL;
                 ret = 0;
                 goto cleanup;
-            } else if (flags & KRB5_KDB_FLAG_CANONICALIZE) {
+            } else if (flags & KRB5_KDB_FLAG_REFERRAL_OK) {
                 /* Generate a server referral by looking up the TGT for the
                  * canonical name's realm. */
                 tgtprinc = tgtname(context, &princ->realm, &search_for->realm);
@@ -530,7 +529,7 @@
 
     ret = test_get_principal(context, cert_princ, flags, entry);
     krb5_free_principal(context, cert_princ);
-    if (ret || (flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY))
+    if (ret || (flags & KRB5_KDB_FLAG_REFERRAL_OK))
         return ret;
 
     if (!krb5_realm_compare(context, princ, (*entry)->princ))
@@ -612,362 +611,12 @@
     return 0;
 }
 
-typedef struct {
-    char *pac_princ;
-    struct {
-        char *proxy_target;
-        char *impersonator;
-    } deleg_info;
-    krb5_boolean not_delegated;
-    krb5_pac pac;
-} pac_info;
-
-static void
-free_pac_info(krb5_context context, pac_info *info)
-{
-    if (info == NULL)
-        return;
-
-    free(info->pac_princ);
-    free(info->deleg_info.proxy_target);
-    free(info->deleg_info.impersonator);
-    krb5_pac_free(context, info->pac);
-    free(info);
-}
-
-/*
- * Create a PAC object with a fake logon-info blob.  Instead of a real
- * KERB_VALIDATION_INFO structure, store a byte indicating whether the
- * USER_NOT_DELEGATED bit is set.
- */
-static krb5_error_code
-create_pac(krb5_context context, krb5_boolean not_delegated, krb5_pac *pac_out)
-{
-    krb5_data data;
-    krb5_pac pac;
-    char nd;
-
-    nd = not_delegated ? 1 : 0;
-    data = make_data(&nd, 1);
-    check(krb5_pac_init(context, &pac));
-    check(krb5_pac_add_buffer(context, pac, KRB5_PAC_LOGON_INFO, &data));
-
-    *pac_out = pac;
-    return 0;
-}
-
-/* Create a fake PAC, setting the USER_NOT_DELEGATED bit if the client DB entry
- * disallows forwardable tickets. */
-static krb5_error_code
-create_pac_db(krb5_context context, krb5_db_entry *client, krb5_pac *pac_out)
-{
-    krb5_boolean not_delegated;
-    /* Use disallow_forwardable as delegation_not_allowed attribute */
-    not_delegated = (client->attributes & KRB5_KDB_DISALLOW_FORWARDABLE);
-    return create_pac(context, not_delegated, pac_out);
-}
-
-/* Locate the PAC in tgt_authdata and set *pac_out to its PAC object
- * representation.  Set it to NULL if no PAC is present. */
-static void
-parse_ticket_pac(krb5_context context, krb5_authdata **tgt_auth_data,
-                 krb5_pac *pac_out)
-{
-    krb5_authdata **authdata;
-
-    *pac_out = NULL;
-
-    check(krb5_find_authdata(context, tgt_auth_data, NULL,
-                             KRB5_AUTHDATA_WIN2K_PAC, &authdata));
-    if (authdata == NULL)
-        return;
-    assert(authdata1 == NULL);
-    check(krb5_pac_parse(context, authdata0->contents, authdata0->length,
-                         pac_out));
-    krb5_free_authdata(context, authdata);
-}
-
-/* Verify the KDC signature against the local TGT key.  tgt_key must be the
- * decrypted first key data entry of tgt. */
-static krb5_error_code
-verify_kdc_signature(krb5_context context, krb5_pac pac,
-                     krb5_keyblock *tgt_key, krb5_db_entry *tgt)
-{
-    krb5_error_code ret;
-    krb5_key_data *kd;
-    krb5_keyblock old_key;
-    krb5_kvno kvno;
-    int tries;
-
-    ret = krb5_pac_verify(context, pac, 0, NULL, NULL, tgt_key);
-    if (ret != KRB5KRB_AP_ERR_BAD_INTEGRITY)
-        return ret;
-
-    kvno = tgt->key_data0.key_data_kvno - 1;
-
-    /* There is no kvno in PAC signatures, so try two previous versions. */
-    for (tries = 2; tries > 0 && kvno > 0; tries--, kvno--) {
-        ret = krb5_dbe_find_enctype(context, tgt, -1, -1, kvno, &kd);
-        if (ret)
-            return KRB5KRB_AP_ERR_BAD_INTEGRITY;
-        ret = krb5_dbe_decrypt_key_data(context, NULL, kd, &old_key, NULL);
-        if (ret)
-            return ret;
-        ret = krb5_pac_verify(context, pac, 0, NULL, NULL, &old_key);
-        krb5_free_keyblock_contents(context, &old_key);
-        if (!ret)
-            return 0;
-
-        /* Try the next lower kvno on the next iteration. */
-        kvno = kd->key_data_kvno - 1;
-    }
-
-    return KRB5KRB_AP_ERR_BAD_INTEGRITY;
-}
-
-static krb5_error_code
-verify_ticket_pac(krb5_context context, krb5_pac pac, unsigned int flags,
-                  krb5_const_principal client_princ, krb5_boolean check_realm,
-                  krb5_keyblock *server_key, krb5_keyblock *local_tgt_key,
-                  krb5_db_entry *local_tgt, krb5_timestamp authtime)
-{
-    check(krb5_pac_verify_ext(context, pac, authtime, client_princ, server_key,
-                              NULL, check_realm));
-    if (flags & KRB5_KDB_FLAG_CROSS_REALM)
-        return 0;
-    return verify_kdc_signature(context, pac, local_tgt_key, local_tgt);
-}
-
-static void
-get_pac_info(krb5_context context, krb5_authdata **in_authdata,
-             pac_info **info_out)
-{
-    krb5_error_code ret;
-    krb5_pac pac = NULL;
-    krb5_data data;
-    char *sep = NULL;
-    pac_info *info;
-
-    *info_out = NULL;
-
-    parse_ticket_pac(context, in_authdata, &pac);
-    if (pac == NULL)
-        return;
-
-    info = ealloc(sizeof(*info));
-
-    /* Read the fake logon-info buffer from the PAC and set not_delegated
-     * according to the byte value. */
-    check(krb5_pac_get_client_info(context, pac, NULL, &info->pac_princ));
-    check(krb5_pac_get_buffer(context, pac, KRB5_PAC_LOGON_INFO, &data));
-    assert(data.length == 1);
-    info->not_delegated = *data.data;
-    krb5_free_data_contents(context, &data);
-
-    ret = krb5_pac_get_buffer(context, pac, KRB5_PAC_DELEGATION_INFO, &data);
-    if (ret && ret != ENOENT)
-        abort();
-    if (!ret) {
-        sep = memchr(data.data, ':', data.length);
-        assert(sep != NULL);
-        info->deleg_info.proxy_target = k5memdup0(data.data, sep - data.data,
-                                                  &ret);
-        check(ret);
-        info->deleg_info.impersonator = k5memdup0(sep + 1, data.length - 1 -
-                                                  (sep - data.data), &ret);
-        check(ret);
-        krb5_free_data_contents(context, &data);
-    }
-
-    info->pac = pac;
-    *info_out = info;
-}
-
-/* Add a fake delegation-info buffer to pac containing the proxy target and
- * impersonator from info. */
 static void
-add_delegation_info(krb5_context context, krb5_pac pac, pac_info *info)
+change_auth_indicators(krb5_context context, krb5_data ***auth_indicators)
 {
-    krb5_data data;
-    char *str;
-
-    if (info->deleg_info.proxy_target == NULL)
-        return;
-
-    if (asprintf(&str, "%s:%s", info->deleg_info.proxy_target,
-                 info->deleg_info.impersonator) < 0)
-        abort();
-    data = string2data(str);
-    check(krb5_pac_add_buffer(context, pac, KRB5_PAC_DELEGATION_INFO, &data));
-    free(str);
-}
-
-/* Set *out to an AD-IF-RELEVANT authdata element containing a PAC authdata
- * element with contents pac_data. */
-static void
-encode_pac_ad(krb5_context context, krb5_data *pac_data, krb5_authdata **out)
-{
-    krb5_authdata pac_ad, *list2, **ifrel;
-
-    pac_ad.magic = KV5M_AUTHDATA;
-    pac_ad.ad_type = KRB5_AUTHDATA_WIN2K_PAC;
-    pac_ad.contents = (krb5_octet *)pac_data->data;;
-    pac_ad.length = pac_data->length;
-    list0 = &pac_ad;
-    list1 = NULL;
-
-    check(krb5_encode_authdata_container(context, KRB5_AUTHDATA_IF_RELEVANT,
-                                         list, &ifrel));
-    assert(ifrel1 == NULL);
-    *out = ifrel0;
-    free(ifrel);
-}
-
-/* Parse a PAC client-info string into a principal name.  If xrealm_s4u is
- * true, expect a realm in the string. */
-static krb5_error_code
-parse_pac_princ(krb5_context context, krb5_boolean xrealm_s4u, char *pac_princ,
-                krb5_principal *client_out)
-{
-    int n_atsigns = 0, flags = 0;
-    char *p = pac_princ;
-
-    while (*p++) {
-        if (*p == '@')
-            n_atsigns++;
-    }
-    if (xrealm_s4u) {
-        flags |= KRB5_PRINCIPAL_PARSE_REQUIRE_REALM;
-        n_atsigns--;
-    } else {
-        flags |= KRB5_PRINCIPAL_PARSE_NO_REALM;
-    }
-    assert(n_atsigns == 0 || n_atsigns == 1);
-    if (n_atsigns == 1)
-        flags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
-    check(krb5_parse_name_flags(context, pac_princ, flags, client_out));
-    (*client_out)->type = KRB5_NT_MS_PRINCIPAL;
-    return 0;
-}
-
-/* Set *ad_out to a fake PAC for testing, or to NULL if it doesn't make sense
- * to generate a PAC for the request. */
-static void
-generate_pac(krb5_context context, unsigned int flags,
-             krb5_const_principal client_princ,
-             krb5_const_principal server_princ, krb5_db_entry *client,
-             krb5_db_entry *header_server, krb5_db_entry *local_tgt,
-             krb5_keyblock *server_key, krb5_keyblock *header_key,
-             krb5_keyblock *local_tgt_key, krb5_timestamp authtime,
-             pac_info *info, krb5_authdata **ad_out)
-{
-    krb5_boolean sign_realm, check_realm;
-    krb5_data pac_data;
-    krb5_pac pac = NULL;
-    krb5_principal pac_princ = NULL;
-
-    *ad_out = NULL;
-
-    check_realm = ((flags & KRB5_KDB_FLAGS_S4U) &&
-                   (flags & KRB5_KDB_FLAG_CROSS_REALM));
-    sign_realm = ((flags & KRB5_KDB_FLAGS_S4U) &&
-                  (flags & KRB5_KDB_FLAG_ISSUING_REFERRAL));
-
-    if (client != NULL &&
-        ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) ||
-         (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) {
-        /* For AS or local-realm S4U2Self, generate an initial PAC. */
-        check(create_pac_db(context, client, &pac));
-    } else if (info == NULL) {
-        /* If there is no input PAC, do not generate one. */
-        assert((flags & KRB5_KDB_FLAGS_S4U) == 0);
-        return;
-    } else {
-        if (IS_TGS_PRINC(server_princ) &&
-            info->deleg_info.proxy_target != NULL) {
-            /* RBCD transitive trust. */
-            assert(flags & KRB5_KDB_FLAG_CROSS_REALM);
-            assert(!(flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION));
-            check(parse_pac_princ(context, TRUE, info->pac_princ, &pac_princ));
-            client_princ = pac_princ;
-            check_realm = TRUE;
-            sign_realm = TRUE;
-        } else if ((flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) &&
-                   !(flags & KRB5_KDB_FLAG_CROSS_REALM)) {
-            /*
-             * Initial RBCD and old constrained delegation requests to
-             * impersonator realm; create delegation info blob.  We cannot
-             * assume that proxy_target is NULL as the evidence ticket could
-             * have been acquired via constrained delegation.
-             */
-            free(info->deleg_info.proxy_target);
-            check(krb5_unparse_name_flags(context, server_princ,
-                                          KRB5_PRINCIPAL_UNPARSE_NO_REALM,
-                                          &info->deleg_info.proxy_target));
-            /* This is supposed to be a list of impersonators, but we currently
-             * only deal with one. */
-            free(info->deleg_info.impersonator);
-            check(krb5_unparse_name(context, header_server->princ,
-                                    &info->deleg_info.impersonator));
-        } else if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
-            /* Last cross realm RBCD request to proxy realm. */
-            assert(info->deleg_info.proxy_target != NULL);
-        }
-
-        /* We have already verified the PAC in get_authdata_info, but we should
-         * be able to verify the signatures here as well. */
-        check(verify_ticket_pac(context, info->pac, flags, client_princ,
-                                check_realm, header_key, local_tgt_key,
-                                local_tgt, authtime));
-
-        /* Create a new pac as we may be altering pac principal's realm */
-        check(create_pac(context, info->not_delegated, &pac));
-        add_delegation_info(context, pac, info);
-    }
-    check(krb5_pac_sign_ext(context, pac, authtime, client_princ, server_key,
-                            local_tgt_key, sign_realm, &pac_data));
-    krb5_pac_free(context, pac);
-    krb5_free_principal(context, pac_princ);
-    encode_pac_ad(context, &pac_data, ad_out);
-    krb5_free_data_contents(context, &pac_data);
-}
-
-static krb5_error_code
-test_sign_authdata(krb5_context context, unsigned int flags,
-                   krb5_const_principal client_princ,
-                   krb5_const_principal server_princ, krb5_db_entry *client,
-                   krb5_db_entry *server, krb5_db_entry *header_server,
-                   krb5_db_entry *local_tgt, krb5_keyblock *client_key,
-                   krb5_keyblock *server_key, krb5_keyblock *header_key,
-                   krb5_keyblock *local_tgt_key, krb5_keyblock *session_key,
-                   krb5_timestamp authtime, krb5_authdata **tgt_auth_data,
-                   void *ad_info, krb5_data ***auth_indicators,
-                   krb5_authdata ***signed_auth_data)
-{
-    krb5_authdata *pac_ad = NULL, *test_ad = NULL, **list;
     krb5_data **inds, d;
     int i, val;
 
-    /* Possibly create a PAC authdata element. */
-    generate_pac(context, flags, client_princ, server_princ, client,
-                 header_server, local_tgt, server_key, header_key,
-                 local_tgt_key, authtime, ad_info, &pac_ad);
-
-    /* Always create a TEST_AD_TYPE element. */
-    test_ad = ealloc(sizeof(*test_ad));
-    test_ad->magic = KV5M_AUTHDATA;
-    test_ad->ad_type = TEST_AD_TYPE;
-    test_ad->contents = (uint8_t *)estrdup("db-authdata-test");
-    test_ad->length = strlen((char *)test_ad->contents);
-
-    /* Assemble the authdata into a one-element or two-element list.
-     * The PAC must be the first element. */
-    list = ealloc(3 * sizeof(*list));
-    list0 = (pac_ad != NULL) ? pac_ad : test_ad;
-    list1 = (pac_ad != NULL) ? test_ad : NULL;
-    list2 = NULL;
-    *signed_auth_data = list;
-
     /* If we see an auth indicator "dbincrX", replace the whole indicator list
      * with "dbincr{X+1}". */
     inds = *auth_indicators;
@@ -984,6 +633,66 @@
             break;
         }
     }
+}
+
+static krb5_error_code
+test_issue_pac(krb5_context context, unsigned int flags, krb5_db_entry *client,
+               krb5_keyblock *replaced_reply_key, krb5_db_entry *server,
+               krb5_db_entry *krb5tgt, krb5_timestamp authtime,
+               krb5_pac old_pac, krb5_pac new_pac,
+               krb5_data ***auth_indicators)
+{
+    krb5_data data = empty_data();
+    krb5_boolean found_logon_info = FALSE;
+    krb5_ui_4 *types;
+    size_t num_buffers = 0, i;
+
+    change_auth_indicators(context, auth_indicators);
+
+    if (old_pac == NULL ||
+        (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) {
+        /* Generating an initial PAC. */
+        assert(client != NULL);
+        data = string2data("fake");
+        check(krb5_pac_add_buffer(context, new_pac, KRB5_PAC_LOGON_INFO,
+                                  &data));
+
+        if (replaced_reply_key != NULL) {
+            /* Add a fake PAC_CREDENTIALS_INFO buffer so we can test whether
+             * this parameter was set. */
+            data = string2data("fake credinfo");
+            check(krb5_pac_add_buffer(context, new_pac,
+                                      KRB5_PAC_CREDENTIALS_INFO, &data));
+        }
+        return 0;
+    } else {
+        /* Field copying - my favorite! */
+        if (old_pac != NULL)
+            check(krb5_pac_get_types(context, old_pac, &num_buffers, &types));
+
+        for (i = 0; i < num_buffers; i++) {
+            /* Skip buffer types handled by KDC. */
+            if (typesi == KRB5_PAC_SERVER_CHECKSUM ||
+                typesi == KRB5_PAC_PRIVSVR_CHECKSUM ||
+                typesi == KRB5_PAC_TICKET_CHECKSUM ||
+                typesi == KRB5_PAC_CLIENT_INFO ||
+                typesi == KRB5_PAC_DELEGATION_INFO)
+                continue;
+
+            check(krb5_pac_get_buffer(context, old_pac, typesi, &data));
+
+            if (typesi == KRB5_PAC_LOGON_INFO) {
+                found_logon_info = TRUE;
+                assert(data_eq_string(data, "fake"));
+            }
+
+            check(krb5_pac_add_buffer(context, new_pac, typesi, &data));
+            krb5_free_data_contents(context, &data);
+        }
+
+        if (old_pac != NULL)
+            assert(found_logon_info);
+    }
 
     return 0;
 }
@@ -1003,7 +712,7 @@
     if (ret)
         return FALSE;
     for (v = values; *v != NULL; v++) {
-        if (strcmp(*v, tprinc) == 0) {
+        if (tprinc == NULL || strcmp(*v, tprinc) == 0) {
             found = TRUE;
             break;
         }
@@ -1018,114 +727,51 @@
                                const krb5_db_entry *server,
                                krb5_const_principal proxy)
 {
-    char *sprinc, *tprinc;
+    char *sprinc, *tprinc = NULL;
     krb5_boolean found = FALSE;
 
     check(krb5_unparse_name_flags(context, server->princ,
                                   KRB5_PRINCIPAL_UNPARSE_NO_REALM, &sprinc));
-    check(krb5_unparse_name_flags(context, proxy,
-                                  KRB5_PRINCIPAL_UNPARSE_NO_REALM, &tprinc));
+    if (proxy != NULL) {
+        check(krb5_unparse_name_flags(context, proxy,
+                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM,
+                                      &tprinc));
+    }
     found = match_in_table(context, "delegation", sprinc, tprinc);
     krb5_free_unparsed_name(context, sprinc);
     krb5_free_unparsed_name(context, tprinc);
-    return found ? 0 : KRB5KDC_ERR_POLICY;
+    return found ? 0 : KRB5KDC_ERR_BADOPTION;
 }
 
 static krb5_error_code
 test_allowed_to_delegate_from(krb5_context context,
                               krb5_const_principal client,
                               krb5_const_principal server,
-                              void *server_ad_info, const krb5_db_entry *proxy)
+                              krb5_pac server_pac,
+                              const krb5_db_entry *proxy)
 {
-    char *sprinc, *tprinc;
-    pac_info *info = (pac_info *)server_ad_info;
+    char *proxy_princ, *server_princ, *pac_client_princ, *client_princ;
     krb5_boolean found = FALSE;
 
-    check(krb5_unparse_name(context, proxy->princ, &sprinc));
-    check(krb5_unparse_name(context, server, &tprinc));
-    assert(strncmp(info->pac_princ, tprinc, strlen(info->pac_princ)) == 0);
-    found = match_in_table(context, "rbcd", sprinc, tprinc);
-    krb5_free_unparsed_name(context, sprinc);
-    krb5_free_unparsed_name(context, tprinc);
-    return found ? 0 : KRB5KDC_ERR_POLICY;
-}
+    assert(server_pac != NULL);
 
-static krb5_error_code
-test_get_authdata_info(krb5_context context, unsigned int flags,
-                       krb5_authdata **in_authdata,
-                       krb5_const_principal client_princ,
-                       krb5_const_principal server_princ,
-                       krb5_keyblock *server_key, krb5_keyblock *krbtgt_key,
-                       krb5_db_entry *krbtgt, krb5_timestamp authtime,
-                       void **ad_info_out, krb5_principal *client_out)
-{
-    pac_info *info = NULL;
-    krb5_boolean rbcd_transitive, xrealm_s4u;
-    krb5_principal pac_princ = NULL;
-    char *proxy_name = NULL, *impersonator_name = NULL;
-
-    get_pac_info(context, in_authdata, &info);
-    if (info == NULL)
-        return 0;
+    check(krb5_unparse_name(context, proxy->princ, &proxy_princ));
+    check(krb5_unparse_name(context, server, &server_princ));
+    check(krb5_unparse_name(context, client, &client_princ));
 
-    /* Transitive RBCD requests are not flagged as constrained delegation */
-    if (info->not_delegated &&
-        (info->deleg_info.proxy_target ||
-         (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION))) {
-        free_pac_info(context, info);
-        return KRB5KDC_ERR_BADOPTION;
-    }
-
-    rbcd_transitive = IS_TGS_PRINC(server_princ) &&
-        (flags & KRB5_KDB_FLAG_CROSS_REALM) && info->deleg_info.proxy_target &&
-        !(flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION);
-
-    xrealm_s4u = rbcd_transitive || ((flags & KRB5_KDB_FLAG_CROSS_REALM) &&
-                                     (flags & KRB5_KDB_FLAGS_S4U));
-
-    check(parse_pac_princ(context, xrealm_s4u, info->pac_princ, &pac_princ));
-
-    /* Cross-realm and transitive trust RBCD requests */
-    if (rbcd_transitive || ((flags & KRB5_KDB_FLAG_CROSS_REALM) &&
-                            (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION))) {
-        assert(info->deleg_info.proxy_target != NULL);
-        assert(info->deleg_info.impersonator != NULL);
-        /* We must be able to find the impersonator in the delegation info. */
-        assert(!krb5_principal_compare(context, client_princ, pac_princ));
-        check(krb5_unparse_name(context, client_princ, &impersonator_name));
-        assert(strcmp(info->deleg_info.impersonator, impersonator_name) == 0);
-        krb5_free_unparsed_name(context, impersonator_name);
-        client_princ = pac_princ;
-        /* In the non-transitive case we can match the proxy too. */
-        if (!rbcd_transitive) {
-            check(krb5_unparse_name_flags(context, server_princ,
-                                          KRB5_PRINCIPAL_UNPARSE_NO_REALM,
-                                          &proxy_name));
-            assert(info->deleg_info.proxy_target != NULL);
-            assert(strcmp(info->deleg_info.proxy_target, proxy_name) == 0);
-            krb5_free_unparsed_name(context, proxy_name);
-        }
-    }
+    check(krb5_pac_get_client_info(context, server_pac, NULL,
+                                   &pac_client_princ));
 
-    check(verify_ticket_pac(context, info->pac, flags, client_princ,
-                            xrealm_s4u, server_key, krbtgt_key, krbtgt,
-                            authtime));
+    /* Skip realm portion if not present in PAC. */
+    assert(strncmp(pac_client_princ, server_princ,
+                   strlen(pac_client_princ)) == 0);
 
-    *ad_info_out = info;
-    if (client_out != NULL)
-        *client_out = pac_princ;
-    else
-        krb5_free_principal(context, pac_princ);
-
-    return 0;
-}
-
-static void
-test_free_authdata_info(krb5_context context, void *ad_info)
-{
-    pac_info *info = (pac_info *)ad_info;
+    free(pac_client_princ);
 
-    free_pac_info(context, info);
+    found = match_in_table(context, "rbcd", proxy_princ, server_princ);
+    krb5_free_unparsed_name(context, proxy_princ);
+    krb5_free_unparsed_name(context, server_princ);
+    return found ? 0 : KRB5KDC_ERR_BADOPTION;
 }
 
 kdb_vftabl PLUGIN_SYMBOL_NAME(krb5_test, kdb_function_table) = {
@@ -1158,7 +804,6 @@
     NULL, /* promote_db */
     test_decrypt_key_data,
     test_encrypt_key_data,
-    test_sign_authdata,
     NULL, /* check_transited_realms */
     NULL, /* check_policy_as */
     NULL, /* check_policy_tgs */
@@ -1168,6 +813,5 @@
     NULL, /* free_principal_e_data */
     test_get_s4u_x509_principal,
     test_allowed_to_delegate_from,
-    test_get_authdata_info,
-    test_free_authdata_info
+    test_issue_pac,
 };

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/otp/main.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/otp/main.c Changed

@@ -158,19 +158,36 @@
             char *const *indicators)
 {
     struct request_state rs = *(struct request_state *)data;
+    krb5_context context = rs.context;
+    krb5_keyblock *armor_key;
     char *const *ind;
 
     free(data);
 
     if (retval == 0 && response != otp_response_success)
         retval = KRB5_PREAUTH_FAILED;
+    if (retval)
+        goto done;
 
-    if (retval == 0)
-        rs.enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
+    rs.enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
+    armor_key = rs.preauth_cb->fast_armor(context, rs.rock);
+    if (armor_key == NULL) {
+        retval = ENOENT;
+        goto done;
+    }
 
-    for (ind = indicators; ind != NULL && *ind != NULL && retval == 0; ind++)
-        retval = rs.preauth_cb->add_auth_indicator(rs.context, rs.rock, *ind);
+    retval = rs.preauth_cb->replace_reply_key(context, rs.rock, armor_key,
+                                              FALSE);
+    if (retval)
+        goto done;
 
+    for (ind = indicators; ind != NULL && *ind != NULL; ind++) {
+        retval = rs.preauth_cb->add_auth_indicator(context, rs.rock, *ind);
+        if (retval)
+            goto done;
+    }
+
+done:
     rs.respond(rs.arg, retval, NULL, NULL, NULL);
 }
 
@@ -211,7 +228,7 @@
     krb5_pa_otp_challenge chl;
     krb5_pa_data *pa = NULL;
     krb5_error_code retval;
-    krb5_data *encoding;
+    krb5_data *encoding, nonce = empty_data();
     char *config;
 
     /* Determine if otp is enabled for the user. */
@@ -239,9 +256,10 @@
     ti.iteration_count = -1;
 
     /* Generate the nonce. */
-    retval = nonce_generate(context, armor_key->length, &chl.nonce);
+    retval = nonce_generate(context, armor_key->length, &nonce);
     if (retval != 0)
         goto out;
+    chl.nonce = nonce;
 
     /* Build the output pa-data. */
     retval = encode_krb5_pa_otp_challenge(&chl, &encoding);
@@ -258,6 +276,7 @@
     free(encoding);
 
 out:
+    krb5_free_data_contents(context, &nonce);
     (*respond)(arg, retval, pa);
 }
 
@@ -343,31 +362,6 @@
     (*respond)(arg, retval, NULL, NULL, NULL);
 }
 
-static krb5_error_code
-otp_return_padata(krb5_context context, krb5_pa_data *padata,
-                  krb5_data *req_pkt, krb5_kdc_req *request,
-                  krb5_kdc_rep *reply, krb5_keyblock *encrypting_key,
-                  krb5_pa_data **send_pa_out, krb5_kdcpreauth_callbacks cb,
-                  krb5_kdcpreauth_rock rock, krb5_kdcpreauth_moddata moddata,
-                  krb5_kdcpreauth_modreq modreq)
-{
-    krb5_keyblock *armor_key = NULL;
-
-    if (padata->length == 0)
-        return 0;
-
-    /* Get the armor key. */
-    armor_key = cb->fast_armor(context, rock);
-    if (!armor_key) {
-      com_err("otp", ENOENT, "No armor key found when returning padata");
-      return ENOENT;
-    }
-
-    /* Replace the reply key with the FAST armor key. */
-    krb5_free_keyblock_contents(context, encrypting_key);
-    return krb5_copy_keyblock_contents(context, armor_key, encrypting_key);
-}
-
 krb5_error_code
 kdcpreauth_otp_initvt(krb5_context context, int maj_ver, int min_ver,
                       krb5_plugin_vtable vtable);
@@ -389,7 +383,6 @@
     vt->flags = otp_flags;
     vt->edata = otp_edata;
     vt->verify = otp_verify;
-    vt->return_padata = otp_return_padata;
 
     com_err("otp", 0, "Loaded");

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/otp/otp_state.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/otp/otp_state.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/deps Changed

@@ -44,14 +44,14 @@
   $(top_srcdir)/include/krb5/preauth_plugin.h pkcs11.h \
   pkinit.h pkinit_accessor.h pkinit_crypto.h pkinit_kdf_test.c \
   pkinit_trace.h
-pkinit_kdf_constants.so pkinit_kdf_constants.po $(OUTPRE)pkinit_kdf_constants.$(OBJEXT): \
+pkinit_constants.so pkinit_constants.po $(OUTPRE)pkinit_constants.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-int-pkinit.h \
   $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5/clpreauth_plugin.h \
   $(top_srcdir)/include/krb5/kdcpreauth_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/krb5/preauth_plugin.h pkcs11.h \
-  pkinit.h pkinit_accessor.h pkinit_crypto.h pkinit_kdf_constants.c \
+  pkinit.h pkinit_accessor.h pkinit_constants.c pkinit_crypto.h \
   pkinit_trace.h
 pkinit_clnt.so pkinit_clnt.po $(OUTPRE)pkinit_clnt.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_clnt.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_clnt.c Changed

@@ -34,7 +34,6 @@
 #include "k5-json.h"
 
 #include <unistd.h>
-#include <dlfcn.h>
 #include <sys/stat.h>
 
 /**
@@ -119,8 +118,8 @@
         goto cleanup;
     }
 
-    retval = krb5_c_make_checksum(context, CKSUMTYPE_NIST_SHA, NULL, 0,
-                                  der_req, &cksum);
+    retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req,
+                                  &cksum);
     if (retval)
         goto cleanup;
     TRACE_PKINIT_CLIENT_REQ_CHECKSUM(context, &cksum);
@@ -188,19 +187,15 @@
                      krb5_data ** as_req)
 {
     krb5_error_code retval = ENOMEM;
-    krb5_subject_pk_info info;
-    krb5_data *coded_auth_pack = NULL;
+    krb5_data spki = empty_data(), *coded_auth_pack = NULL;
     krb5_auth_pack auth_pack;
     krb5_pa_pk_as_req *req = NULL;
     krb5_algorithm_identifier **cmstypes = NULL;
     int protocol = reqctx->opts->dh_or_rsa;
-    unsigned char *dh_params = NULL, *dh_pubkey = NULL;
-    unsigned int dh_params_len, dh_pubkey_len;
 
     pkiDebug("pkinit_as_req_create pa_type = %d\n", reqctx->pa_type);
 
     /* Create the authpack */
-    memset(&info, 0, sizeof(info));
     memset(&auth_pack, 0, sizeof(auth_pack));
     auth_pack.pkAuthenticator.ctime = ctsec;
     auth_pack.pkAuthenticator.cusec = cusec;
@@ -209,7 +204,6 @@
     if (!reqctx->opts->disable_freshness)
         auth_pack.pkAuthenticator.freshnessToken = reqctx->freshness_token;
     auth_pack.clientDHNonce.length = 0;
-    auth_pack.clientPublicValue = &info;
     auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids;
 
     /* add List of CMS algorithms */
@@ -224,24 +218,20 @@
     case DH_PROTOCOL:
         TRACE_PKINIT_CLIENT_REQ_DH(context);
         pkiDebug("as_req: DH key transport algorithm\n");
-        info.algorithm.algorithm = dh_oid;
 
         /* create client-side DH keys */
         retval = client_create_dh(context, plgctx->cryptoctx,
                                   reqctx->cryptoctx, reqctx->idctx,
-                                  reqctx->opts->dh_size, &dh_params,
-                                  &dh_params_len, &dh_pubkey, &dh_pubkey_len);
+                                  reqctx->opts->dh_size, &spki);
+        auth_pack.clientPublicValue = spki;
         if (retval != 0) {
             pkiDebug("failed to create dh parameters\n");
             goto cleanup;
         }
-        info.algorithm.parameters = make_data(dh_params, dh_params_len);
-        info.subjectPublicKey = make_data(dh_pubkey, dh_pubkey_len);
         break;
     case RSA_PROTOCOL:
         TRACE_PKINIT_CLIENT_REQ_RSA(context);
         pkiDebug("as_req: RSA key transport algorithm\n");
-        auth_pack.clientPublicValue = NULL;
         break;
     default:
         pkiDebug("as_req: unknown key transport protocol %d\n",
@@ -325,9 +315,8 @@
 
 cleanup:
     free_krb5_algorithm_identifiers(&cmstypes);
-    free(dh_params);
-    free(dh_pubkey);
     free_krb5_pa_pk_as_req(&req);
+    krb5_free_data_contents(context, &spki);
 
     pkiDebug("pkinit_as_req_create retval=%d\n", (int) retval);
 
@@ -709,13 +698,6 @@
             pkiDebug("failed to decode reply_key_pack\n");
             goto cleanup;
         }
-        /*
-         * This is hack but Windows sends back SHA1 checksum
-         * with checksum type of 14. There is currently no
-         * checksum type of 14 defined.
-         */
-        if (key_pack->asChecksum.checksum_type == 14)
-            key_pack->asChecksum.checksum_type = CKSUMTYPE_NIST_SHA;
         retval = krb5_c_make_checksum(context,
                                       key_pack->asChecksum.checksum_type,
                                       &key_pack->replyKey,
@@ -1101,8 +1083,11 @@
     }
 
     if (processing_request) {
-        pkinit_client_profile(context, plgctx, reqctx, cb, rock,
-                              &request->server->realm);
+        if (reqctx->idopts->anchors == NULL) {
+            krb5_set_error_message(context, KRB5_PREAUTH_FAILED,
+                                   _("No pkinit_anchors supplied"));
+            return KRB5_PREAUTH_FAILED;
+        }
         /* Pull in PINs and passwords for identities which we deferred
          * loading earlier. */
         retval = pkinit_client_parse_answers(context, moddata, modreq,

_service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_constants.c Added

@@ -0,0 +1,296 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* plugins/preauth/pkinit/pkinit_constants.c */
+/*
+ * Copyright (C) 2011,2021 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "pkinit.h"
+
+/* statically declare OID constants for all three algorithms */
+static char sha1_oid8 = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01};
+static char sha256_oid8 = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 };
+static char sha512_oid8 = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 };
+
+const krb5_data sha1_id = { KV5M_DATA, sizeof(sha1_oid), sha1_oid };
+const krb5_data sha256_id = { KV5M_DATA, sizeof(sha256_oid), sha256_oid };
+const krb5_data sha512_id = { KV5M_DATA, sizeof(sha512_oid), sha512_oid };
+
+krb5_data const * const supported_kdf_alg_ids = {
+    &sha256_id,
+    &sha1_id,
+    &sha512_id,
+    NULL
+};
+
+/* RFC 2412 section E.2 (well-known group 2) parameters, DER-encoded as
+ * DomainParameters (RFC 3279 section 2.3.3). */
+static const uint8_t o1024 = {
+    0x30, 0x82, 0x01, 0x0A, 0x02, 0x81, 0x81, 0x00,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
+    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
+    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
+    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
+    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
+    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
+    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
+    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
+    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
+    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
+    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
+    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
+    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
+    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0x02, 0x01, 0x02, 0x02, 0x81, 0x80, 0x7F, 0xFF,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xE4, 0x87,
+    0xED, 0x51, 0x10, 0xB4, 0x61, 0x1A, 0x62, 0x63,
+    0x31, 0x45, 0xC0, 0x6E, 0x0E, 0x68, 0x94, 0x81,
+    0x27, 0x04, 0x45, 0x33, 0xE6, 0x3A, 0x01, 0x05,
+    0xDF, 0x53, 0x1D, 0x89, 0xCD, 0x91, 0x28, 0xA5,
+    0x04, 0x3C, 0xC7, 0x1A, 0x02, 0x6E, 0xF7, 0xCA,
+    0x8C, 0xD9, 0xE6, 0x9D, 0x21, 0x8D, 0x98, 0x15,
+    0x85, 0x36, 0xF9, 0x2F, 0x8A, 0x1B, 0xA7, 0xF0,
+    0x9A, 0xB6, 0xB6, 0xA8, 0xE1, 0x22, 0xF2, 0x42,
+    0xDA, 0xBB, 0x31, 0x2F, 0x3F, 0x63, 0x7A, 0x26,
+    0x21, 0x74, 0xD3, 0x1B, 0xF6, 0xB5, 0x85, 0xFF,
+    0xAE, 0x5B, 0x7A, 0x03, 0x5B, 0xF6, 0xF7, 0x1C,
+    0x35, 0xFD, 0xAD, 0x44, 0xCF, 0xD2, 0xD7, 0x4F,
+    0x92, 0x08, 0xBE, 0x25, 0x8F, 0xF3, 0x24, 0x94,
+    0x33, 0x28, 0xF6, 0x73, 0x29, 0xC0, 0xFF, 0xFF,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+
+/* RFC 3526 section 3 (2048-bit MODP Group), RFC 3279 encoding */
+static const uint8_t o2048 = {
+    0x30, 0x82, 0x02, 0x0C, 0x02, 0x82, 0x01, 0x01,
+    0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2,
+    0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C,
+    0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC,
+    0x74, 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B,
+    0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04,
+    0xDD, 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43,
+    0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14,
+    0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2,
+    0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E,
+    0xC6, 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED,
+    0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7,
+    0xED, 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F,
+    0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F,
+    0xE6, 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B,
+    0x3D, 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF,
+    0x05, 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3,
+    0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF,
+    0x5F, 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD,
+    0x96, 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52,
+    0xBB, 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96,
+    0x6D, 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98,
+    0x04, 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21,
+    0x7C, 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE,
+    0x3B, 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86,
+    0x03, 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2,
+    0x8F, 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52,
+    0xC9, 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17,
+    0x18, 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A,
+    0xE5, 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05,
+    0x10, 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA,
+    0x68, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xFF, 0x02, 0x01, 0x02, 0x02, 0x82, 0x01, 0x00,
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xE4, 0x87, 0xED, 0x51, 0x10, 0xB4, 0x61, 0x1A,
+    0x62, 0x63, 0x31, 0x45, 0xC0, 0x6E, 0x0E, 0x68,
+    0x94, 0x81, 0x27, 0x04, 0x45, 0x33, 0xE6, 0x3A,
+    0x01, 0x05, 0xDF, 0x53, 0x1D, 0x89, 0xCD, 0x91,
+    0x28, 0xA5, 0x04, 0x3C, 0xC7, 0x1A, 0x02, 0x6E,
+    0xF7, 0xCA, 0x8C, 0xD9, 0xE6, 0x9D, 0x21, 0x8D,
+    0x98, 0x15, 0x85, 0x36, 0xF9, 0x2F, 0x8A, 0x1B,
+    0xA7, 0xF0, 0x9A, 0xB6, 0xB6, 0xA8, 0xE1, 0x22,
+    0xF2, 0x42, 0xDA, 0xBB, 0x31, 0x2F, 0x3F, 0x63,
+    0x7A, 0x26, 0x21, 0x74, 0xD3, 0x1B, 0xF6, 0xB5,
+    0x85, 0xFF, 0xAE, 0x5B, 0x7A, 0x03, 0x5B, 0xF6,
+    0xF7, 0x1C, 0x35, 0xFD, 0xAD, 0x44, 0xCF, 0xD2,
+    0xD7, 0x4F, 0x92, 0x08, 0xBE, 0x25, 0x8F, 0xF3,
+    0x24, 0x94, 0x33, 0x28, 0xF6, 0x72, 0x2D, 0x9E,
+    0xE1, 0x00, 0x3E, 0x5C, 0x50, 0xB1, 0xDF, 0x82,
+    0xCC, 0x6D, 0x24, 0x1B, 0x0E, 0x2A, 0xE9, 0xCD,
+    0x34, 0x8B, 0x1F, 0xD4, 0x7E, 0x92, 0x67, 0xAF,
+    0xC1, 0xB2, 0xAE, 0x91, 0xEE, 0x51, 0xD6, 0xCB,
+    0x0E, 0x31, 0x79, 0xAB, 0x10, 0x42, 0xA9, 0x5D,
+    0xCF, 0x6A, 0x94, 0x83, 0xB8, 0x4B, 0x4B, 0x36,
+    0xB3, 0x86, 0x1A, 0xA7, 0x25, 0x5E, 0x4C, 0x02,
+    0x78, 0xBA, 0x36, 0x04, 0x65, 0x0C, 0x10, 0xBE,
+    0x19, 0x48, 0x2F, 0x23, 0x17, 0x1B, 0x67, 0x1D,
+    0xF1, 0xCF, 0x3B, 0x96, 0x0C, 0x07, 0x43, 0x01,
+    0xCD, 0x93, 0xC1, 0xD1, 0x76, 0x03, 0xD1, 0x47,
+    0xDA, 0xE2, 0xAE, 0xF8, 0x37, 0xA6, 0x29, 0x64,
+    0xEF, 0x15, 0xE5, 0xFB, 0x4A, 0xAC, 0x0B, 0x8C,
+    0x1C, 0xCA, 0xA4, 0xBE, 0x75, 0x4A, 0xB5, 0x72,
+    0x8A, 0xE9, 0x13, 0x0C, 0x4C, 0x7D, 0x02, 0x88,
+    0x0A, 0xB9, 0x47, 0x2D, 0x45, 0x56, 0x55, 0x34,
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+
+/* RFC 3526 section 5 (4096-bit MODP Group), RFC 3279 encoding */
+static const uint8_t o4096 = {
+    0x30, 0x82, 0x04, 0x0C, 0x02, 0x82, 0x02, 0x01,
+    0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2,
+    0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C,
+    0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC,
+    0x74, 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B,
+    0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04,
+    0xDD, 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43,
+    0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14,
+    0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2,
+    0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E,
+    0xC6, 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED,
+    0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7,
+    0xED, 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F,
+    0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F,
+    0xE6, 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B,
+    0x3D, 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF,
+    0x05, 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3,
+    0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF,
+    0x5F, 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD,
+    0x96, 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52,
+    0xBB, 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96,
+    0x6D, 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98,
+    0x04, 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21,
+    0x7C, 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE,
+    0x3B, 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86,
+    0x03, 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2,
+    0x8F, 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52,
+    0xC9, 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17,
+    0x18, 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A,
+    0xE5, 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05,
+    0x10, 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4,
+    0x2D, 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A,
+    0x33, 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA,
+    0x64, 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF,
+    0x0A, 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C,
+    0x7D, 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4,
+    0xC7, 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33,
+    0xD7, 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61,
+    0x9D, 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE,
+    0x6B, 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08,
+    0x64, 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A,
+    0x64, 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20,
+    0x0C, 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D,
+    0x6C, 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46,
+    0xE2, 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB,
+    0x31, 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10,
+    0x8E, 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08,
+    0x01, 0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6,
+    0xD7, 0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B,
+    0x26, 0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2,
+    0x3C, 0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B,
+    0xDA, 0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C,
+    0xE8, 0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E,
+    0xF9, 0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA,
+    0xA6, 0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0,
+    0x5D, 0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3,
+    0xA2, 0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7,
+    0xED, 0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7,
+    0xAF, 0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48,
+    0x1C, 0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A,
+    0xA9, 0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD,
+    0xC1, 0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0,
+    0x8F, 0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x06, 0x31,
+    0x99, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xFF, 0x02, 0x01, 0x02, 0x02, 0x82, 0x02, 0x00,
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xE4, 0x87, 0xED, 0x51, 0x10, 0xB4, 0x61, 0x1A,
+    0x62, 0x63, 0x31, 0x45, 0xC0, 0x6E, 0x0E, 0x68,
+    0x94, 0x81, 0x27, 0x04, 0x45, 0x33, 0xE6, 0x3A,
+    0x01, 0x05, 0xDF, 0x53, 0x1D, 0x89, 0xCD, 0x91,
+    0x28, 0xA5, 0x04, 0x3C, 0xC7, 0x1A, 0x02, 0x6E,
+    0xF7, 0xCA, 0x8C, 0xD9, 0xE6, 0x9D, 0x21, 0x8D,
+    0x98, 0x15, 0x85, 0x36, 0xF9, 0x2F, 0x8A, 0x1B,
+    0xA7, 0xF0, 0x9A, 0xB6, 0xB6, 0xA8, 0xE1, 0x22,
+    0xF2, 0x42, 0xDA, 0xBB, 0x31, 0x2F, 0x3F, 0x63,
+    0x7A, 0x26, 0x21, 0x74, 0xD3, 0x1B, 0xF6, 0xB5,
+    0x85, 0xFF, 0xAE, 0x5B, 0x7A, 0x03, 0x5B, 0xF6,
+    0xF7, 0x1C, 0x35, 0xFD, 0xAD, 0x44, 0xCF, 0xD2,
+    0xD7, 0x4F, 0x92, 0x08, 0xBE, 0x25, 0x8F, 0xF3,
+    0x24, 0x94, 0x33, 0x28, 0xF6, 0x72, 0x2D, 0x9E,
+    0xE1, 0x00, 0x3E, 0x5C, 0x50, 0xB1, 0xDF, 0x82,
+    0xCC, 0x6D, 0x24, 0x1B, 0x0E, 0x2A, 0xE9, 0xCD,
+    0x34, 0x8B, 0x1F, 0xD4, 0x7E, 0x92, 0x67, 0xAF,
+    0xC1, 0xB2, 0xAE, 0x91, 0xEE, 0x51, 0xD6, 0xCB,
+    0x0E, 0x31, 0x79, 0xAB, 0x10, 0x42, 0xA9, 0x5D,
+    0xCF, 0x6A, 0x94, 0x83, 0xB8, 0x4B, 0x4B, 0x36,
+    0xB3, 0x86, 0x1A, 0xA7, 0x25, 0x5E, 0x4C, 0x02,
+    0x78, 0xBA, 0x36, 0x04, 0x65, 0x0C, 0x10, 0xBE,
+    0x19, 0x48, 0x2F, 0x23, 0x17, 0x1B, 0x67, 0x1D,
+    0xF1, 0xCF, 0x3B, 0x96, 0x0C, 0x07, 0x43, 0x01,
+    0xCD, 0x93, 0xC1, 0xD1, 0x76, 0x03, 0xD1, 0x47,
+    0xDA, 0xE2, 0xAE, 0xF8, 0x37, 0xA6, 0x29, 0x64,
+    0xEF, 0x15, 0xE5, 0xFB, 0x4A, 0xAC, 0x0B, 0x8C,
+    0x1C, 0xCA, 0xA4, 0xBE, 0x75, 0x4A, 0xB5, 0x72,
+    0x8A, 0xE9, 0x13, 0x0C, 0x4C, 0x7D, 0x02, 0x88,
+    0x0A, 0xB9, 0x47, 0x2D, 0x45, 0x55, 0x62, 0x16,
+    0xD6, 0x99, 0x8B, 0x86, 0x82, 0x28, 0x3D, 0x19,
+    0xD4, 0x2A, 0x90, 0xD5, 0xEF, 0x8E, 0x5D, 0x32,
+    0x76, 0x7D, 0xC2, 0x82, 0x2C, 0x6D, 0xF7, 0x85,
+    0x45, 0x75, 0x38, 0xAB, 0xAE, 0x83, 0x06, 0x3E,
+    0xD9, 0xCB, 0x87, 0xC2, 0xD3, 0x70, 0xF2, 0x63,
+    0xD5, 0xFA, 0xD7, 0x46, 0x6D, 0x84, 0x99, 0xEB,
+    0x8F, 0x46, 0x4A, 0x70, 0x25, 0x12, 0xB0, 0xCE,
+    0xE7, 0x71, 0xE9, 0x13, 0x0D, 0x69, 0x77, 0x35,
+    0xF8, 0x97, 0xFD, 0x03, 0x6C, 0xC5, 0x04, 0x32,
+    0x6C, 0x3B, 0x01, 0x39, 0x9F, 0x64, 0x35, 0x32,
+    0x29, 0x0F, 0x95, 0x8C, 0x0B, 0xBD, 0x90, 0x06,
+    0x5D, 0xF0, 0x8B, 0xAB, 0xBD, 0x30, 0xAE, 0xB6,
+    0x3B, 0x84, 0xC4, 0x60, 0x5D, 0x6C, 0xA3, 0x71,
+    0x04, 0x71, 0x27, 0xD0, 0x3A, 0x72, 0xD5, 0x98,
+    0xA1, 0xED, 0xAD, 0xFE, 0x70, 0x7E, 0x88, 0x47,
+    0x25, 0xC1, 0x68, 0x90, 0x54, 0x90, 0x84, 0x00,
+    0x8D, 0x39, 0x1E, 0x09, 0x53, 0xC3, 0xF3, 0x6B,
+    0xC4, 0x38, 0xCD, 0x08, 0x5E, 0xDD, 0x2D, 0x93,
+    0x4C, 0xE1, 0x93, 0x8C, 0x35, 0x7A, 0x71, 0x1E,
+    0x0D, 0x4A, 0x34, 0x1A, 0x5B, 0x0A, 0x85, 0xED,
+    0x12, 0xC1, 0xF4, 0xE5, 0x15, 0x6A, 0x26, 0x74,
+    0x6D, 0xDD, 0xE1, 0x6D, 0x82, 0x6F, 0x47, 0x7C,
+    0x97, 0x47, 0x7E, 0x0A, 0x0F, 0xDF, 0x65, 0x53,
+    0x14, 0x3E, 0x2C, 0xA3, 0xA7, 0x35, 0xE0, 0x2E,
+    0xCC, 0xD9, 0x4B, 0x27, 0xD0, 0x48, 0x61, 0xD1,
+    0x11, 0x9D, 0xD0, 0xC3, 0x28, 0xAD, 0xF3, 0xF6,
+    0x8F, 0xB0, 0x94, 0xB8, 0x67, 0x71, 0x6B, 0xD7,
+    0xDC, 0x0D, 0xEE, 0xBB, 0x10, 0xB8, 0x24, 0x0E,
+    0x68, 0x03, 0x48, 0x93, 0xEA, 0xD8, 0x2D, 0x54,
+    0xC9, 0xDA, 0x75, 0x4C, 0x46, 0xC7, 0xEE, 0xE0,
+    0xC3, 0x7F, 0xDB, 0xEE, 0x48, 0x53, 0x60, 0x47,
+    0xA6, 0xFA, 0x1A, 0xE4, 0x9A, 0x03, 0x18, 0xCC,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+
+const krb5_data oakley_1024 = { KV5M_DATA, sizeof(o1024), (char *)o1024 };
+const krb5_data oakley_2048 = { KV5M_DATA, sizeof(o2048), (char *)o2048 };
+const krb5_data oakley_4096 = { KV5M_DATA, sizeof(o4096), (char *)o4096 };

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_crypto.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_crypto.h Changed

@@ -315,14 +315,8 @@
 	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
 	int dh_size,					/* IN
 		    specifies the DH modulous, eg 1024, 2048, or 4096 */
-	unsigned char **dh_params_out,			/* OUT
-		    contains DER encoded DH params */
-	unsigned int *dh_params_len_out,		/* OUT
-		    contains length of encoded DH params */
-	unsigned char **dh_pubkey_out,			/* OUT
-		    receives DER encoded DH pub key */
-	unsigned int *dh_pubkey_len_out);			/* OUT
-		    receives length of DH pub key */
+	krb5_data *spki_out);				/* OUT
+		    receives SubjectPublicKeyInfo encoding */
 
 /*
  * this function completes client's the DH protocol. client
@@ -353,8 +347,8 @@
 	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
 	pkinit_req_crypto_context req_cryptoctx,	/* IN */
 	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
-	krb5_data *dh_params,				/* IN
-		    ???? */
+	const krb5_data *client_spki,			/* IN
+		    SubjectPublicKeyInfo encoding from client */
 	int minbits);					/* IN
 		    the minimum number of key bits acceptable */
 
@@ -367,10 +361,6 @@
 	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
 	pkinit_req_crypto_context req_cryptoctx,	/* IN */
 	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
-	unsigned char *received_pubkey,			/* IN
-		    contains client's DER encoded DH pub key */
-	unsigned int received_pub_len,			/* IN
-		    contains length of received_pubkey */
 	unsigned char **dh_pubkey_out,			/* OUT
 		    receives KDC's DER encoded DH pub key */
 	unsigned int *dh_pubkey_len_out,		/* OUT
@@ -616,12 +606,13 @@
                        krb5_data *pk_as_rep,
                        krb5_keyblock *key_block);
 
-extern const krb5_octet krb5_pkinit_sha1_oid;
-extern const size_t krb5_pkinit_sha1_oid_len;
-extern const krb5_octet krb5_pkinit_sha256_oid;
-extern const size_t krb5_pkinit_sha256_oid_len;
-extern const krb5_octet krb5_pkinit_sha512_oid;
-extern const size_t  krb5_pkinit_sha512_oid_len;
+extern const krb5_data sha1_id;
+extern const krb5_data sha256_id;
+extern const krb5_data sha512_id;
+extern const krb5_data oakley_1024;
+extern const krb5_data oakley_2048;
+extern const krb5_data oakley_4096;
+
 /**
  * An ordered set of OIDs, stored as krb5_data, of KDF algorithms
  * supported by this implementation. The order of this array controls

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c Changed

@@ -32,12 +32,18 @@
 #include "k5-int.h"
 #include "pkinit_crypto_openssl.h"
 #include "k5-buf.h"
+#include "k5-err.h"
 #include "k5-hex.h"
-#include <dlfcn.h>
 #include <unistd.h>
 #include <dirent.h>
 #include <arpa/inet.h>
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#include <openssl/kdf.h>
+#include <openssl/params.h>
+#endif
+
 static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context );
 static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context );
 
@@ -50,11 +56,6 @@
 static krb5_error_code pkinit_init_pkcs11(pkinit_identity_crypto_context ctx);
 static void pkinit_fini_pkcs11(pkinit_identity_crypto_context ctx);
 
-static krb5_error_code pkinit_encode_dh_params
-(const BIGNUM *, const BIGNUM *, const BIGNUM *, uint8_t **, unsigned int *);
-static DH *decode_dh_params(const uint8_t *, unsigned int );
-static int pkinit_check_dh_params(DH *dh1, DH *dh2);
-
 static krb5_error_code pkinit_sign_data
 (krb5_context context, pkinit_identity_crypto_context cryptoctx,
  unsigned char *data, unsigned int data_len,
@@ -102,8 +103,6 @@
  CK_TOKEN_INFO *tip, const char *password);
 static krb5_error_code pkinit_open_session
 (krb5_context context, pkinit_identity_crypto_context id_cryptoctx);
-static void * pkinit_C_LoadModule(const char *modname, CK_FUNCTION_LIST_PTR_PTR p11p);
-static CK_RV pkinit_C_UnloadModule(void *handle);
 #ifdef SILLYDECRYPT
 CK_RV pkinit_C_Decrypt
 (pkinit_identity_crypto_context id_cryptoctx,
@@ -144,8 +143,8 @@
 wrap_signeddata(unsigned char *data, unsigned int data_len,
                 unsigned char **out, unsigned int *out_len);
 
-static char *
-pkinit_pkcs11_code_to_text(int err);
+static const char *
+pkcs11err(int err);
 
 
 #ifdef HAVE_OPENSSL_CMS
@@ -194,35 +193,34 @@
 #define EVP_MD_CTX_free EVP_MD_CTX_destroy
 #define ASN1_STRING_get0_data ASN1_STRING_data
 
+/*
+ * 1.1 adds DHX support, which uses the RFC 3279 DomainParameters encoding we
+ * need for PKINIT.  For 1.0 we must use the original DH type when creating
+ * EVP_PKEY objects.
+ */
+#define EVP_PKEY_DHX EVP_PKEY_DH
+
 /* 1.1 makes many handle types opaque and adds accessors.  Add compatibility
  * versions of the new accessors we use for pre-1.1. */
 
 #define OBJ_get0_data(o) ((o)->data)
 #define OBJ_length(o) ((o)->length)
 
-#define DH_set0_pqg compat_dh_set0_pqg
-static int compat_dh_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
+#define DH_set0_key compat_dh_set0_key
+static int
+compat_dh_set0_key(DH *dh, BIGNUM *pub, BIGNUM *priv)
 {
-    /* The real function frees the old values and does argument checking, but
-     * our code doesn't need that. */
-    dh->p = p;
-    dh->q = q;
-    dh->g = g;
+    if (pub != NULL) {
+        BN_clear_free(dh->pub_key);
+        dh->pub_key = pub;
+    }
+    if (priv != NULL) {
+        BN_clear_free(dh->priv_key);
+        dh->priv_key = priv;
+    }
     return 1;
 }
 
-#define DH_get0_pqg compat_dh_get0_pqg
-static void compat_dh_get0_pqg(const DH *dh, const BIGNUM **p,
-                               const BIGNUM **q, const BIGNUM **g)
-{
-    if (p != NULL)
-        *p = dh->p;
-    if (q != NULL)
-        *q = dh->q;
-    if (g != NULL)
-        *g = dh->g;
-}
-
 #define DH_get0_key compat_dh_get0_key
 static void compat_dh_get0_key(const DH *dh, const BIGNUM **pub,
                                const BIGNUM **priv)
@@ -233,6 +231,16 @@
         *priv = dh->priv_key;
 }
 
+#define EVP_PKEY_get0_DH compat_get0_DH
+static DH *
+compat_get0_DH(const EVP_PKEY *pkey)
+{
+    if (pkey->type != EVP_PKEY_DH)
+        return NULL;
+    return pkey->pkey.dh;
+
+}
+
 /* Return true if the cert c includes a key usage which doesn't include u.
  * Define using direct member access for pre-1.1. */
 #define ku_reject(c, u)                                                 \
@@ -245,6 +253,581 @@
 
 #endif
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+/* OpenSSL 3.0 changes several preferred function names. */
+#define EVP_PKEY_parameters_eq EVP_PKEY_cmp_parameters
+#define EVP_MD_CTX_get0_md EVP_MD_CTX_md
+#define EVP_PKEY_get_size EVP_PKEY_size
+#define EVP_PKEY_get_bits EVP_PKEY_bits
+
+/*
+ * Convert *dh to an EVP_PKEY object, taking ownership of *dh and setting it to
+ * NULL.  On error, return NULL and do not take ownership of or change *dh.
+ * OpenSSL 3.0 deprecates the low-level DH interfaces, so this helper will only
+ * be used with prior versions.
+ */
+static EVP_PKEY *
+dh_to_pkey(DH **dh)
+{
+    EVP_PKEY *pkey;
+
+    pkey = EVP_PKEY_new();
+    if (pkey == NULL)
+        return NULL;
+    if (!EVP_PKEY_assign(pkey, EVP_PKEY_DHX, *dh)) {
+        EVP_PKEY_free(pkey);
+        return NULL;
+    }
+    *dh = NULL;
+    return pkey;
+}
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+/* Encode a bignum as an ASN.1 integer in DER. */
+static int
+encode_bn_der(const BIGNUM *bn, uint8_t **der_out, int *len_out)
+{
+    ASN1_INTEGER *intval;
+    int len;
+    uint8_t *der = NULL, *outptr;
+
+    intval = BN_to_ASN1_INTEGER(bn, NULL);
+    if (intval == NULL)
+        return 0;
+    len = i2d_ASN1_INTEGER(intval, NULL);
+    if (len > 0 && (outptr = der = malloc(len)) != NULL)
+        (void)i2d_ASN1_INTEGER(intval, &outptr);
+    ASN1_INTEGER_free(intval);
+    if (der == NULL)
+        return 0;
+    *der_out = der;
+    *len_out = len;
+    return 1;
+}
+
+/* Decode an ASN.1 integer, returning a bignum. */
+static BIGNUM *
+decode_bn_der(const uint8_t *der, size_t len)
+{
+    ASN1_INTEGER *intval;
+    BIGNUM *bn;
+
+    intval = d2i_ASN1_INTEGER(NULL, &der, len);
+    if (intval == NULL)
+        return NULL;
+    bn = ASN1_INTEGER_to_BN(intval, NULL);
+    ASN1_INTEGER_free(intval);
+    return bn;
+}
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+static int
+params_valid(EVP_PKEY *params)
+{
+    EVP_PKEY_CTX *ctx;
+    int result;
+
+    ctx = EVP_PKEY_CTX_new(params, NULL);
+    if (ctx == NULL)
+        return 0;
+    result = EVP_PKEY_param_check(ctx);
+    EVP_PKEY_CTX_free(ctx);
+    return result == 1;
+}
+#else
+static int
+params_valid(EVP_PKEY *params)
+{
+    DH *dh;
+    int codes;
+
+    dh = EVP_PKEY_get0_DH(params);
+    return (dh == NULL) ? 0 : (DH_check(dh, &codes) && codes == 0);
+}
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static EVP_PKEY *
+decode_dh_params(const krb5_data *params_der)
+{
+    EVP_PKEY *pkey = NULL;
+    const uint8_t *inptr = (uint8_t *)params_der->data;
+    size_t len = params_der->length;
+    OSSL_DECODER_CTX *dctx;
+    int ok;
+
+    dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", "type-specific", "DHX",
+                                         EVP_PKEY_KEY_PARAMETERS, NULL, NULL);
+    if (dctx == NULL)
+        return NULL;
+
+    ok = OSSL_DECODER_from_data(dctx, &inptr, &len);
+    OSSL_DECODER_CTX_free(dctx);
+    return ok ? pkey : NULL;
+}
+#else
+static EVP_PKEY *
+decode_dh_params(const krb5_data *params_der)
+{
+    const uint8_t *p = (uint8_t *)params_der->data;
+    DH *dh;
+    EVP_PKEY *pkey;
+
+    dh = d2i_DHxparams(NULL, &p, params_der->length);
+    pkey = dh_to_pkey(&dh);
+    DH_free(dh);
+    return pkey;
+}
+#endif
+
+static krb5_error_code
+encode_spki(EVP_PKEY *pkey, krb5_data *spki_out)
+{
+    krb5_error_code ret = ENOMEM;
+    int len;
+    uint8_t *outptr;
+
+    len = i2d_PUBKEY(pkey, NULL);
+    ret = alloc_data(spki_out, len);
+    if (ret)
+        goto cleanup;
+    outptr = (uint8_t *)spki_out->data;
+    (void)i2d_PUBKEY(pkey, &outptr);
+
+cleanup:
+    return ret;
+}
+
+static EVP_PKEY *
+decode_spki(const krb5_data *spki)
+{
+    const uint8_t *inptr = (uint8_t *)spki->data;
+
+    return d2i_PUBKEY(NULL, &inptr, spki->length);
+}
+
+#else /* OPENSSL_VERSION_NUMBER < 0x10100000L */
+
+/*
+ * OpenSSL 1.0 has no DHX support, so we need a custom decoder for RFC 3279
+ * DomainParameters, and we need to use X509_PUBKEY values to marshal
+ * SubjectPublicKeyInfo.
+ */
+
+typedef struct {
+    ASN1_BIT_STRING *seed;
+    BIGNUM *counter;
+} int_dhvparams;
+
+typedef struct {
+    BIGNUM *p;
+    BIGNUM *q;
+    BIGNUM *g;
+    BIGNUM *j;
+    int_dhvparams *vparams;
+} int_dhxparams;
+
+ASN1_SEQUENCE(int_dhvparams) = {
+    ASN1_SIMPLE(int_dhvparams, seed, ASN1_BIT_STRING),
+    ASN1_SIMPLE(int_dhvparams, counter, BIGNUM)
+} ASN1_SEQUENCE_END(int_dhvparams);
+
+ASN1_SEQUENCE(int_dhxparams) = {
+    ASN1_SIMPLE(int_dhxparams, p, BIGNUM),
+    ASN1_SIMPLE(int_dhxparams, g, BIGNUM),
+    ASN1_SIMPLE(int_dhxparams, q, BIGNUM),
+    ASN1_OPT(int_dhxparams, j, BIGNUM),
+    ASN1_OPT(int_dhxparams, vparams, int_dhvparams)
+} ASN1_SEQUENCE_END(int_dhxparams);
+
+static EVP_PKEY *
+decode_dh_params(const krb5_data *params_der)
+{
+    int_dhxparams *params;
+    DH *dh;
+    EVP_PKEY *pkey;
+    const uint8_t *p;
+
+    dh = DH_new();
+    if (dh == NULL)
+        return NULL;
+
+    p = (uint8_t *)params_der->data;
+    params = (int_dhxparams *)ASN1_item_d2i(NULL, &p, params_der->length,
+                                            ASN1_ITEM_rptr(int_dhxparams));
+    if (params == NULL) {
+        DH_free(dh);
+        return NULL;
+    }
+
+    /* Steal p, q, and g from dhparams for dh.  Ignore j and vparams. */
+    dh->p = params->p;
+    dh->q = params->q;
+    dh->g = params->g;
+    params->p = params->q = params->g = NULL;
+    ASN1_item_free((ASN1_VALUE *)params, ASN1_ITEM_rptr(int_dhxparams));
+    pkey = dh_to_pkey(&dh);
+    DH_free(dh);
+    return pkey;
+}
+
+static krb5_error_code
+encode_spki(EVP_PKEY *pkey, krb5_data *spki_out)
+{
+    krb5_error_code ret = ENOMEM;
+    const DH *dh;
+    uint8_t *param_der = NULL, *pubkey_der = NULL, *outptr;
+    int param_der_len, pubkey_der_len, len;
+    X509_PUBKEY pubkey;
+    int_dhxparams dhxparams;
+    X509_ALGOR algor;
+    ASN1_OBJECT algorithm;
+    ASN1_TYPE parameter;
+    ASN1_STRING param_str, pubkey_str;
+
+    dh = EVP_PKEY_get0_DH(pkey);
+    if (dh == NULL)
+        goto cleanup;
+
+    dhxparams.p = dh->p;
+    dhxparams.q = dh->q;
+    dhxparams.g = dh->g;
+    dhxparams.j = NULL;
+    dhxparams.vparams = NULL;
+    param_der_len = ASN1_item_i2d((ASN1_VALUE *)&dhxparams, &param_der,
+                                  ASN1_ITEM_rptr(int_dhxparams));
+    if (param_der_len < 0)
+        goto cleanup;
+    param_str.length = param_der_len;
+    param_str.type = V_ASN1_SEQUENCE;
+    param_str.data = param_der;
+    param_str.flags = 0;
+    parameter.type = V_ASN1_SEQUENCE;
+    parameter.value.sequence = &param_str;
+
+    memset(&algorithm, 0, sizeof(algorithm));
+    algorithm.data = (uint8_t *)dh_oid.data;
+    algorithm.length = dh_oid.length;
+
+    algor.algorithm = &algorithm;
+    algor.parameter = &parameter;
+
+    if (!encode_bn_der(dh->pub_key, &pubkey_der, &pubkey_der_len))
+        goto cleanup;
+    pubkey_str.length = pubkey_der_len;
+    pubkey_str.type = V_ASN1_BIT_STRING;
+    pubkey_str.data = pubkey_der;
+    pubkey_str.flags = ASN1_STRING_FLAG_BITS_LEFT;
+
+    pubkey.algor = &algor;
+    pubkey.public_key = &pubkey_str;
+    len = i2d_X509_PUBKEY(&pubkey, NULL);
+    if (len < 0)
+        goto cleanup;
+    ret = alloc_data(spki_out, len);
+    if (ret)
+        goto cleanup;
+    outptr = (uint8_t *)spki_out->data;
+    i2d_X509_PUBKEY(&pubkey, &outptr);
+
+cleanup:
+    OPENSSL_free(param_der);
+    free(pubkey_der);
+    return ret;
+}
+
+static EVP_PKEY *
+decode_spki(const krb5_data *spki)
+{
+    X509_PUBKEY *pubkey = NULL;
+    const uint8_t *inptr;
+    DH *dh;
+    EVP_PKEY *pkey = NULL, *pkey_ret = NULL;
+    const ASN1_STRING *params;
+    const ASN1_BIT_STRING *public_key;
+    krb5_data d;
+
+    inptr = (uint8_t *)spki->data;
+    pubkey = d2i_X509_PUBKEY(NULL, &inptr, spki->length);
+    if (pubkey == NULL)
+        goto cleanup;
+
+    if (pubkey->algor->parameter->type != V_ASN1_SEQUENCE)
+        goto cleanup;
+    params = pubkey->algor->parameter->value.sequence;
+    d = make_data(params->data, params->length);
+    pkey = decode_dh_params(&d);
+    if (pkey == NULL)
+        goto cleanup;
+    dh = EVP_PKEY_get0_DH(pkey);
+    if (dh == NULL)
+        goto cleanup;
+    public_key = pubkey->public_key;
+    dh->pub_key = decode_bn_der(public_key->data, public_key->length);
+    if (dh->pub_key == NULL)
+        goto cleanup;
+
+    pkey_ret = pkey;
+    pkey = NULL;
+
+cleanup:
+    X509_PUBKEY_free(pubkey);
+    EVP_PKEY_free(pkey);
+    return pkey_ret;
+}
+
+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
+
+/* Attempt to specify padded Diffie-Hellman result derivation.  Don't error out
+ * if this fails since we also detect short results and adjust them. */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static void
+set_padded_derivation(EVP_PKEY_CTX *ctx)
+{
+    EVP_PKEY_CTX_set_dh_pad(ctx, 1);
+}
+#elif OPENSSL_VERSION_NUMBER >= 0x10100000L
+static void
+set_padded_derivation(EVP_PKEY_CTX *ctx)
+{
+    /* We would use EVP_PKEY_CTX_set_dh_pad() but it doesn't work with DHX. */
+    EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DHX, EVP_PKEY_OP_DERIVE,
+                      EVP_PKEY_CTRL_DH_PAD, 1, NULL);
+}
+#else
+static void
+set_padded_derivation(EVP_PKEY_CTX *ctx)
+{
+    /* There's no support for padded derivation in 1.0. */
+}
+#endif
+
+static int
+dh_result(EVP_PKEY *pkey, EVP_PKEY *peer,
+          uint8_t **result_out, unsigned int *len_out)
+{
+    EVP_PKEY_CTX *derive_ctx = NULL;
+    int ok = 0;
+    uint8_t *buf = NULL;
+    size_t len, dh_size = EVP_PKEY_get_size(pkey);
+
+    *result_out = NULL;
+    *len_out = 0;
+
+    derive_ctx = EVP_PKEY_CTX_new(pkey, NULL);
+    if (derive_ctx == NULL)
+        goto cleanup;
+    if (EVP_PKEY_derive_init(derive_ctx) <= 0)
+        goto cleanup;
+    set_padded_derivation(derive_ctx);
+    if (EVP_PKEY_derive_set_peer(derive_ctx, peer) <= 0)
+        goto cleanup;
+
+    buf = malloc(dh_size);
+    if (buf == NULL)
+        goto cleanup;
+    len = dh_size;
+    if (EVP_PKEY_derive(derive_ctx, buf, &len) <= 0)
+        goto cleanup;
+    if (len < dh_size) {        /* only possible without padded derivation */
+        memmove(buf + (dh_size - len), buf, len);
+        memset(buf, 0, dh_size - len);
+    }
+
+    ok = 1;
+    *result_out = buf;
+    *len_out = dh_size;
+    buf = NULL;
+
+cleanup:
+    EVP_PKEY_CTX_free(derive_ctx);
+    free(buf);
+    return ok;
+}
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static int
+dh_pubkey_der(EVP_PKEY *pkey, uint8_t **pubkey_out, unsigned int *len_out)
+{
+    BIGNUM *pubkey_bn = NULL;
+    int len, ok;
+    uint8_t *buf;
+
+    if (!EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pubkey_bn))
+        return 0;
+    ok = encode_bn_der(pubkey_bn, &buf, &len);
+    BN_free(pubkey_bn);
+    if (ok) {
+        *pubkey_out = buf;
+        *len_out = len;
+    }
+    return ok;
+}
+#else
+static int
+dh_pubkey_der(EVP_PKEY *pkey, uint8_t **pubkey_out, unsigned int *len_out)
+{
+    const DH *dh;
+    const BIGNUM *pubkey_bn;
+    uint8_t *buf;
+    int len;
+
+    dh = EVP_PKEY_get0_DH(pkey);
+    if (dh == NULL)
+        return 0;
+    DH_get0_key(dh, &pubkey_bn, NULL);
+    if (!encode_bn_der(pubkey_bn, &buf, &len))
+        return 0;
+    *pubkey_out = buf;
+    *len_out = len;
+    return 1;
+}
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+/* OpenSSL 1.1 and later will copy the q parameter when generating keys. */
+static int
+copy_q_openssl10(EVP_PKEY *src, EVP_PKEY *dest)
+{
+    return 1;
+}
+#else
+/* OpenSSL 1.0 won't copy the q parameter, so we have to do it. */
+static int
+copy_q_openssl10(EVP_PKEY *src, EVP_PKEY *dest)
+{
+    DH *dhsrc = EVP_PKEY_get0_DH(src), *dhdest = EVP_PKEY_get0_DH(dest);
+
+    if (dhsrc == NULL || dhsrc->q == NULL || dhdest == NULL)
+        return 0;
+    if (dhdest->q != NULL)
+        return 1;
+    dhdest->q = BN_dup(dhsrc->q);
+    return dhdest->q != NULL;
+}
+#endif
+
+static EVP_PKEY *
+generate_dh_pkey(EVP_PKEY *params)
+{
+    EVP_PKEY_CTX *ctx = NULL;
+    EVP_PKEY *pkey = NULL;
+
+    ctx = EVP_PKEY_CTX_new(params, NULL);
+    if (ctx == NULL)
+        goto cleanup;
+    if (EVP_PKEY_keygen_init(ctx) <= 0)
+        goto cleanup;
+    if (EVP_PKEY_keygen(ctx, &pkey) <= 0)
+        goto cleanup;
+    if (!copy_q_openssl10(params, pkey)) {
+        EVP_PKEY_free(pkey);
+        pkey = NULL;
+    }
+
+cleanup:
+    EVP_PKEY_CTX_free(ctx);
+    return pkey;
+}
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+static EVP_PKEY *
+compose_dh_pkey(EVP_PKEY *params, const uint8_t *pubkey_der, size_t der_len)
+{
+    EVP_PKEY *pkey = NULL, *pkey_ret = NULL;
+    BIGNUM *pubkey_bn = NULL;
+    uint8_t *pubkey_bin = NULL;
+    int binlen;
+
+    pkey = EVP_PKEY_dup(params);
+    if (pkey == NULL)
+        goto cleanup;
+
+    pubkey_bn = decode_bn_der(pubkey_der, der_len);
+    if (pubkey_bn == NULL)
+        goto cleanup;
+    binlen = EVP_PKEY_get_size(pkey);
+    pubkey_bin = malloc(binlen);
+    if (pubkey_bin == NULL)
+        goto cleanup;
+    if (BN_bn2binpad(pubkey_bn, pubkey_bin, binlen) != binlen)
+        goto cleanup;
+    if (EVP_PKEY_set1_encoded_public_key(pkey, pubkey_bin, binlen) != 1)
+        goto cleanup;
+
+    pkey_ret = pkey;
+    pkey = NULL;
+
+cleanup:
+    EVP_PKEY_free(pkey);
+    BN_free(pubkey_bn);
+    free(pubkey_bin);
+    return pkey_ret;
+}
+
+#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+static DH *
+dup_dh_params(DH *src)
+{
+    return DHparams_dup(src);
+}
+#else
+/* DHparams_dup() won't copy q in OpenSSL 1.0. */
+static DH *
+dup_dh_params(DH *src)
+{
+    DH *dh;
+
+    dh = DH_new();
+    if (dh == NULL)
+        return NULL;
+    dh->p = BN_dup(src->p);
+    dh->q = BN_dup(src->q);
+    dh->g = BN_dup(src->g);
+    if (dh->p == NULL || dh->q == NULL || dh->g == NULL) {
+        DH_free(dh);
+        return NULL;
+    }
+    return dh;
+}
+#endif
+
+static EVP_PKEY *
+compose_dh_pkey(EVP_PKEY *params, const uint8_t *pubkey_der, size_t der_len)
+{
+    DH *dhparams, *dh = NULL;
+    EVP_PKEY *pkey = NULL;
+    BIGNUM *pubkey_bn = NULL;
+
+    pubkey_bn = decode_bn_der(pubkey_der, der_len);
+    if (pubkey_bn == NULL)
+        goto cleanup;
+
+    dhparams = EVP_PKEY_get0_DH(params);
+    if (dhparams == NULL)
+        goto cleanup;
+    dh = dup_dh_params(dhparams);
+    if (dh == NULL)
+        goto cleanup;
+    if (!DH_set0_key(dh, pubkey_bn, NULL))
+        goto cleanup;
+    pubkey_bn = NULL;
+
+    pkey = dh_to_pkey(&dh);
+
+cleanup:
+    BN_free(pubkey_bn);
+    DH_free(dh);
+    return pkey;
+}
+
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
 static struct pkcs11_errstrings {
     short code;
     char *text;
@@ -337,128 +920,6 @@
     { -1,       NULL }
 };
 
-/* DH parameters */
-static uint8_t oakley_1024128 = {
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
-    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
-    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
-    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
-    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
-    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
-    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
-    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
-    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
-    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
-    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
-    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
-    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
-    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-
-static uint8_t oakley_20482048/8 = {
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
-    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
-    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
-    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
-    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
-    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
-    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
-    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
-    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
-    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
-    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
-    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
-    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
-    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
-    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
-    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
-    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
-    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
-    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
-    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
-    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
-    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C,
-    0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
-    0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03,
-    0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
-    0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9,
-    0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
-    0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5,
-    0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
-    0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-
-static uint8_t oakley_40964096/8 = {
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
-    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
-    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
-    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
-    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
-    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
-    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
-    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
-    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
-    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
-    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
-    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
-    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
-    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
-    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
-    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
-    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
-    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
-    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
-    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
-    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
-    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C,
-    0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
-    0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03,
-    0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
-    0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9,
-    0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
-    0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5,
-    0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
-    0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D,
-    0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33,
-    0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64,
-    0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A,
-    0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D,
-    0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7,
-    0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7,
-    0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D,
-    0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B,
-    0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64,
-    0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64,
-    0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C,
-    0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C,
-    0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2,
-    0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31,
-    0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E,
-    0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01,
-    0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7,
-    0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26,
-    0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C,
-    0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA,
-    0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8,
-    0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9,
-    0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6,
-    0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D,
-    0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2,
-    0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED,
-    0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF,
-    0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C,
-    0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9,
-    0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1,
-    0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F,
-    0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x06, 0x31, 0x99,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-};
-
 MAKE_INIT_FUNCTION(pkinit_openssl_init);
 
 static krb5_error_code oerr(krb5_context context, krb5_error_code code,
@@ -629,7 +1090,8 @@
         goto out;
     memset(ctx, 0, sizeof(*ctx));
 
-    ctx->dh = NULL;
+    ctx->client_pkey = NULL;
+    ctx->received_params = NULL;
     ctx->received_cert = NULL;
 
     *cryptoctx = ctx;
@@ -650,10 +1112,9 @@
         return;
 
     pkiDebug("%s: freeing ctx at %p\n", __FUNCTION__, req_cryptoctx);
-    if (req_cryptoctx->dh != NULL)
-        DH_free(req_cryptoctx->dh);
-    if (req_cryptoctx->received_cert != NULL)
-        X509_free(req_cryptoctx->received_cert);
+    EVP_PKEY_free(req_cryptoctx->client_pkey);
+    EVP_PKEY_free(req_cryptoctx->received_params);
+    X509_free(req_cryptoctx->received_cert);
 
     free(req_cryptoctx);
 }
@@ -854,54 +1315,20 @@
     ASN1_OBJECT_free(ctx->id_kp_serverAuth);
 }
 
-/* Construct an OpenSSL DH object for an Oakley group. */
-static DH *
-make_oakley_dh(uint8_t *prime, size_t len)
-{
-    DH *dh = NULL;
-    BIGNUM *p = NULL, *q = NULL, *g = NULL;
-
-    p = BN_bin2bn(prime, len, NULL);
-    if (p == NULL)
-        goto cleanup;
-    q = BN_new();
-    if (q == NULL)
-        goto cleanup;
-    if (!BN_rshift1(q, p))
-        goto cleanup;
-    g = BN_new();
-    if (g == NULL)
-        goto cleanup;
-    if (!BN_set_word(g, DH_GENERATOR_2))
-        goto cleanup;
-
-    dh = DH_new();
-    if (dh == NULL)
-        goto cleanup;
-    DH_set0_pqg(dh, p, q, g);
-    p = g = q = NULL;
-
-cleanup:
-    BN_free(p);
-    BN_free(q);
-    BN_free(g);
-    return dh;
-}
-
 static krb5_error_code
 pkinit_init_dh_params(pkinit_plg_crypto_context plgctx)
 {
     krb5_error_code retval = ENOMEM;
 
-    plgctx->dh_1024 = make_oakley_dh(oakley_1024, sizeof(oakley_1024));
+    plgctx->dh_1024 = decode_dh_params(&oakley_1024);
     if (plgctx->dh_1024 == NULL)
         goto cleanup;
 
-    plgctx->dh_2048 = make_oakley_dh(oakley_2048, sizeof(oakley_2048));
+    plgctx->dh_2048 = decode_dh_params(&oakley_2048);
     if (plgctx->dh_2048 == NULL)
         goto cleanup;
 
-    plgctx->dh_4096 = make_oakley_dh(oakley_4096, sizeof(oakley_4096));
+    plgctx->dh_4096 = decode_dh_params(&oakley_4096);
     if (plgctx->dh_4096 == NULL)
         goto cleanup;
 
@@ -917,13 +1344,9 @@
 static void
 pkinit_fini_dh_params(pkinit_plg_crypto_context plgctx)
 {
-    if (plgctx->dh_1024 != NULL)
-        DH_free(plgctx->dh_1024);
-    if (plgctx->dh_2048 != NULL)
-        DH_free(plgctx->dh_2048);
-    if (plgctx->dh_4096 != NULL)
-        DH_free(plgctx->dh_4096);
-
+    EVP_PKEY_free(plgctx->dh_1024);
+    EVP_PKEY_free(plgctx->dh_2048);
+    EVP_PKEY_free(plgctx->dh_4096);
     plgctx->dh_1024 = plgctx->dh_2048 = plgctx->dh_4096 = NULL;
 }
 
@@ -1006,7 +1429,7 @@
         ctx->p11 = NULL;
     }
     if (ctx->p11_module != NULL) {
-        pkinit_C_UnloadModule(ctx->p11_module);
+        krb5int_close_plugin(ctx->p11_module);
         ctx->p11_module = NULL;
     }
     free(ctx->p11_module_name);
@@ -1196,11 +1619,10 @@
             }
             certstack = X509_STORE_CTX_get1_chain(certctx);
             size = sk_X509_num(certstack);
-            pkiDebug("size of certificate chain = %d\n", size);
             for(i = 0; i < size - 1; i++) {
                 X509 *x = sk_X509_value(certstack, i);
                 X509_NAME_oneline(X509_get_subject_name(x), buf, sizeof(buf));
-                pkiDebug("cert #%d: %s\n", i, buf);
+                TRACE_PKINIT_CERT_CHAIN_NAME(context, (int)i, buf);
                 sk_X509_push(cert_stack, X509_dup(x));
             }
             X509_STORE_CTX_free(certctx);
@@ -1227,7 +1649,7 @@
         /* will not fill-out EVP_PKEY because it's on the smartcard */
 
         /* Set digest algs */
-        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1);
+        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256);
 
         if (p7si->digest_alg->parameter != NULL)
             ASN1_TYPE_free(p7si->digest_alg->parameter);
@@ -1238,19 +1660,20 @@
         /* Set sig algs */
         if (p7si->digest_enc_alg->parameter != NULL)
             ASN1_TYPE_free(p7si->digest_enc_alg->parameter);
-        p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption);
+        p7si->digest_enc_alg->algorithm =
+            OBJ_nid2obj(NID_sha256WithRSAEncryption);
         if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new()))
             goto cleanup;
         p7si->digest_enc_alg->parameter->type = V_ASN1_NULL;
 
         /* add signed attributes */
-        /* compute sha1 digest over the EncapsulatedContentInfo */
+        /* compute sha256 digest over the EncapsulatedContentInfo */
         ctx = EVP_MD_CTX_new();
         if (ctx == NULL)
             goto cleanup;
-        EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
+        EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
         EVP_DigestUpdate(ctx, data, data_len);
-        md_tmp = EVP_MD_CTX_md(ctx);
+        md_tmp = EVP_MD_CTX_get0_md(ctx);
         EVP_DigestFinal_ex(ctx, md_data, &md_len);
         EVP_MD_CTX_free(ctx);
 
@@ -1276,12 +1699,14 @@
             goto cleanup2;
 
 #ifndef WITHOUT_PKCS11
-        /* Some tokens can only do RSAEncryption without sha1 hash */
-        /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash
-         * function and the hash value into an ASN.1 value of type DigestInfo
-         * DigestInfo::=SEQUENCE {
-         *  digestAlgorithm  AlgorithmIdentifier,
-         *  digest OCTET STRING }
+        /*
+         * Some tokens can only do RSAEncryption without a hash.  To compute
+         * sha256WithRSAEncryption, encode the algorithm ID for the hash
+         * function and the hash value into an ASN.1 value of type DigestInfo:
+         * DigestInfo ::= SEQUENCE {
+         *   digestAlgorithm  AlgorithmIdentifier,
+         *   digest  OCTET STRING
+         * }
          */
         if (id_cryptoctx->pkcs11_method == 1 &&
             id_cryptoctx->mech == CKM_RSA_PKCS) {
@@ -1297,7 +1722,7 @@
             alg = X509_ALGOR_new();
             if (alg == NULL)
                 goto cleanup2;
-            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL);
+            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL);
             alg_len = i2d_X509_ALGOR(alg, NULL);
 
             digest = ASN1_OCTET_STRING_new();
@@ -1326,7 +1751,7 @@
 #endif
         {
             pkiDebug("mech = %s\n",
-                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS");
+                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS");
             retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen,
                                       &sig, &sig_len);
         }
@@ -1965,7 +2390,7 @@
     krb5_principal *princs = NULL;
     char **upns = NULL;
     unsigned char **dnss = NULL;
-    unsigned int i, num_found = 0, num_sans = 0;
+    unsigned int i, num_sans = 0;
     X509_EXTENSION *ext = NULL;
     GENERAL_NAMES *ialt = NULL;
     GENERAL_NAME *gen = NULL;
@@ -1989,21 +2414,17 @@
 
     X509_NAME_oneline(X509_get_subject_name(cert),
                       buf, sizeof(buf));
-    pkiDebug("%s: looking for SANs in cert = %s\n", __FUNCTION__, buf);
 
     l = X509_get_ext_by_NID(cert, NID_subject_alt_name, -1);
     if (l < 0)
         return 0;
 
     if (!(ext = X509_get_ext(cert, l)) || !(ialt = X509V3_EXT_d2i(ext))) {
-        pkiDebug("%s: found no subject alt name extensions\n", __FUNCTION__);
+        TRACE_PKINIT_SAN_CERT_NONE(context, buf);
         goto cleanup;
     }
     num_sans = sk_GENERAL_NAME_num(ialt);
 
-    pkiDebug("%s: found %d subject alt name extension(s)\n", __FUNCTION__,
-             num_sans);
-
     /* OK, we're likely returning something. Allocate return values */
     if (princs_ret != NULL) {
         princs = calloc(num_sans + 1, sizeof(krb5_principal));
@@ -2048,7 +2469,6 @@
                              __FUNCTION__);
                 } else {
                     p++;
-                    num_found++;
                 }
             } else if (upns != NULL &&
                        OBJ_cmp(plgctx->id_ms_san_upn,
@@ -2059,6 +2479,7 @@
                 upnsu = k5memdup0(name.data, name.length, &ret);
                 if (upnsu == NULL)
                     goto cleanup;
+                u++;
             } else {
                 pkiDebug("%s: unrecognized othername oid in SAN\n",
                          __FUNCTION__);
@@ -2080,7 +2501,6 @@
                              __FUNCTION__);
                 } else {
                     d++;
-                    num_found++;
                 }
             }
             break;
@@ -2091,6 +2511,8 @@
     }
     sk_GENERAL_NAME_pop_free(ialt, GENERAL_NAME_free);
 
+    TRACE_PKINIT_SAN_CERT_COUNT(context, (int)num_sans, p, u, d, buf);
+
     retval = 0;
     if (princs != NULL && *princs != NULL) {
         *princs_ret = princs;
@@ -2238,22 +2660,28 @@
     unsigned char counter;
     size_t keybytes, keylength, offset;
     krb5_data random_data;
+    EVP_MD_CTX *sha1_ctx = NULL;
 
-    if ((buf = malloc(dh_key_len)) == NULL) {
-        retval = ENOMEM;
+    buf = k5alloc(dh_key_len, &retval);
+    if (buf == NULL)
+        goto cleanup;
+
+    sha1_ctx = EVP_MD_CTX_new();
+    if (sha1_ctx == NULL) {
+        retval = KRB5_CRYPTO_INTERNAL;
         goto cleanup;
     }
-    memset(buf, 0, dh_key_len);
 
     counter = 0;
     offset = 0;
     do {
-        SHA_CTX c;
-
-        SHA1_Init(&c);
-        SHA1_Update(&c, &counter, 1);
-        SHA1_Update(&c, key, dh_key_len);
-        SHA1_Final(md, &c);
+        if (!EVP_DigestInit(sha1_ctx, EVP_sha1()) ||
+            !EVP_DigestUpdate(sha1_ctx, &counter, 1) ||
+            !EVP_DigestUpdate(sha1_ctx, key, dh_key_len) ||
+            !EVP_DigestFinal(sha1_ctx, md, NULL)) {
+            retval = KRB5_CRYPTO_INTERNAL;
+            goto cleanup;
+        }
 
         if (dh_key_len - offset < sizeof(md))
             memcpy(buf + offset, md, dh_key_len - offset);
@@ -2272,11 +2700,9 @@
         goto cleanup;
 
     key_block->length = keylength;
-    key_block->contents = malloc(keylength);
-    if (key_block->contents == NULL) {
-        retval = ENOMEM;
+    key_block->contents = k5alloc(keylength, &retval);
+    if (key_block->contents == NULL)
         goto cleanup;
-    }
 
     random_data.length = keybytes;
     random_data.data = (char *)buf;
@@ -2284,6 +2710,7 @@
     retval = krb5_c_random_to_key(context, etype, &random_data, key_block);
 
 cleanup:
+    EVP_MD_CTX_free(sha1_ctx);
     free(buf);
     /* If this is an error return, free the allocated keyblock, if any */
     if (retval) {
@@ -2294,231 +2721,217 @@
 }
 
 
-/**
- * Given an algorithm_identifier, this function returns the hash length
- * and EVP function associated with that algorithm.
- */
-static krb5_error_code
-pkinit_alg_values(krb5_context context,
-                  const krb5_data *alg_id,
-                  size_t *hash_bytes,
-                  const EVP_MD *(**func)(void))
-{
-    *hash_bytes = 0;
-    *func = NULL;
-    if ((alg_id->length == krb5_pkinit_sha1_oid_len) &&
-        (0 == memcmp(alg_id->data, &krb5_pkinit_sha1_oid,
-                     krb5_pkinit_sha1_oid_len))) {
-        *hash_bytes = 20;
-        *func = &EVP_sha1;
-        return 0;
-    } else if ((alg_id->length == krb5_pkinit_sha256_oid_len) &&
-               (0 == memcmp(alg_id->data, krb5_pkinit_sha256_oid,
-                            krb5_pkinit_sha256_oid_len))) {
-        *hash_bytes = 32;
-        *func = &EVP_sha256;
-        return 0;
-    } else if ((alg_id->length == krb5_pkinit_sha512_oid_len) &&
-               (0 == memcmp(alg_id->data, krb5_pkinit_sha512_oid,
-                            krb5_pkinit_sha512_oid_len))) {
-        *hash_bytes = 64;
-        *func = &EVP_sha512;
-        return 0;
-    } else {
-        krb5_set_error_message(context, KRB5_ERR_BAD_S2K_PARAMS,
-                               "Bad algorithm ID passed to PK-INIT KDF.");
-        return KRB5_ERR_BAD_S2K_PARAMS;
-    }
-} /* pkinit_alg_values() */
+/* Return the OpenSSL descriptor for the given RFC 5652 OID specified in RFC
+ * 8636.  RFC 8636 defines a SHA384 variant, but we don't use it. */
+static const EVP_MD *
+algid_to_md(const krb5_data *alg_id)
+{
+    if (data_eq(*alg_id, sha1_id))
+        return EVP_sha1();
+    if (data_eq(*alg_id, sha256_id))
+        return EVP_sha256();
+    if (data_eq(*alg_id, sha512_id))
+        return EVP_sha512();
+    return NULL;
+}
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 
-/* pkinit_alg_agility_kdf() --
- * This function generates a key using the KDF described in
- * draft_ietf_krb_wg_pkinit_alg_agility-04.txt.  The algorithm is
- * described as follows:
- *
- *     1.  reps = keydatalen (K) / hash length (H)
- *
- *     2.  Initialize a 32-bit, big-endian bit string counter as 1.
- *
- *     3.  For i = 1 to reps by 1, do the following:
- *
- *         -  Compute Hashi = H(counter || Z || OtherInfo).
- *
- *         -  Increment counter (modulo 2^32)
- *
- *     4.  Set key = Hash1 || Hash2 || ... so that length of key is K bytes.
- */
-krb5_error_code
-pkinit_alg_agility_kdf(krb5_context context,
-                       krb5_data *secret,
-                       krb5_data *alg_oid,
-                       krb5_const_principal party_u_info,
-                       krb5_const_principal party_v_info,
-                       krb5_enctype enctype,
-                       krb5_data *as_req,
-                       krb5_data *pk_as_rep,
-                       krb5_keyblock *key_block)
+#define sskdf openssl_sskdf
+static krb5_error_code
+openssl_sskdf(krb5_context context, const EVP_MD *md, krb5_data *key,
+              krb5_data *info, size_t len, krb5_data *out)
 {
-    krb5_error_code retval = 0;
-
-    unsigned int reps = 0;
-    uint32_t counter = 1;       /* Does this type work on Windows? */
-    size_t offset = 0;
-    size_t hash_len = 0;
-    size_t rand_len = 0;
-    size_t key_len = 0;
-    krb5_data random_data;
-    krb5_sp80056a_other_info other_info_fields;
-    krb5_pkinit_supp_pub_info supp_pub_info_fields;
-    krb5_data *other_info = NULL;
-    krb5_data *supp_pub_info = NULL;
-    krb5_algorithm_identifier alg_id;
-    EVP_MD_CTX *ctx = NULL;
-    const EVP_MD *(*EVP_func)(void);
+    krb5_error_code ret;
+    EVP_KDF *kdf = NULL;
+    EVP_KDF_CTX *kctx = NULL;
+    OSSL_PARAM params4, *p = params;
 
-    /* initialize random_data here to make clean-up safe */
-    random_data.length = 0;
-    random_data.data = NULL;
+    ret = alloc_data(out, len);
+    if (ret)
+        goto cleanup;
 
-    /* allocate and initialize the key block */
-    key_block->magic = 0;
-    key_block->enctype = enctype;
-    if (0 != (retval = krb5_c_keylengths(context, enctype, &rand_len,
-                                         &key_len)))
+    kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL);
+    if (kdf == NULL) {
+        ret = oerr(context, KRB5_CRYPTO_INTERNAL, _("Failed to fetch SSKDF"));
         goto cleanup;
+    }
 
-    random_data.length = rand_len;
-    key_block->length = key_len;
+    kctx = EVP_KDF_CTX_new(kdf);
+    if (!kctx) {
+        ret = oerr(context, KRB5_CRYPTO_INTERNAL,
+                   _("Failed to instantiate SSKDF"));
+        goto cleanup;
+    }
 
-    if (NULL == (key_block->contents = malloc(key_block->length))) {
-        retval = ENOMEM;
+    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
+                                            (char *)EVP_MD_get0_name(md), 0);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
+                                             key->data, key->length);
+    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
+                                             info->data, info->length);
+    *p = OSSL_PARAM_construct_end();
+    if (EVP_KDF_derive(kctx, (uint8_t *)out->data, len, params) <= 0) {
+        ret = oerr(context, KRB5_CRYPTO_INTERNAL,
+                   _("Failed to derive key using SSKDF"));
         goto cleanup;
     }
 
-    memset (key_block->contents, 0, key_block->length);
+    ret = 0;
 
-    /* If this is anonymous pkinit, use the anonymous principle for party_u_info */
-    if (party_u_info && krb5_principal_compare_any_realm(context, party_u_info,
-                                                         krb5_anonymous_principal()))
-        party_u_info = (krb5_principal)krb5_anonymous_principal();
+cleanup:
+    EVP_KDF_free(kdf);
+    EVP_KDF_CTX_free(kctx);
+    return ret;
+}
 
-    if (0 != (retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func)))
-        goto cleanup;
+#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+#define sskdf builtin_sskdf
+static krb5_error_code
+builtin_sskdf(krb5_context context, const EVP_MD *md, krb5_data *key,
+              krb5_data *info, size_t len, krb5_data *out)
+{
+    krb5_error_code ret;
+    uint32_t counter = 1, reps;
+    uint8_t be_counter4, *outptr;
+    EVP_MD_CTX *ctx = NULL;
+    unsigned int s, hash_len;
 
-    /* 1.  reps = keydatalen (K) / hash length (H) */
-    reps = key_block->length/hash_len;
+    hash_len = EVP_MD_size(md);
 
-    /* ... and round up, if necessary */
-    if (key_block->length > (reps * hash_len))
-        reps++;
+    /* 1.  reps = keydatalen (K) / hash length (H) rounded up. */
+    reps = (len + hash_len - 1) / hash_len;
 
     /* Allocate enough space in the random data buffer to hash directly into
      * it, even if the last hash will make it bigger than the key length. */
-    if (NULL == (random_data.data = malloc(reps * hash_len))) {
-        retval = ENOMEM;
-        goto cleanup;
-    }
-
-    /* Encode the ASN.1 octet string for "SuppPubInfo" */
-    supp_pub_info_fields.enctype = enctype;
-    supp_pub_info_fields.as_req = *as_req;
-    supp_pub_info_fields.pk_as_rep = *pk_as_rep;
-    if (0 != ((retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields,
-                                                         &supp_pub_info))))
-        goto cleanup;
-
-    /* Now encode the ASN.1 octet string for "OtherInfo" */
-    memset(&alg_id, 0, sizeof alg_id);
-    alg_id.algorithm = *alg_oid; /*alias*/
-
-    other_info_fields.algorithm_identifier = alg_id;
-    other_info_fields.party_u_info = (krb5_principal) party_u_info;
-    other_info_fields.party_v_info = (krb5_principal) party_v_info;
-    other_info_fields.supp_pub_info = *supp_pub_info;
-    if (0 != (retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info)))
+    ret = alloc_data(out, reps * hash_len);
+    if (ret)
         goto cleanup;
+    out->length = len;
 
-    /* 2.  Initialize a 32-bit, big-endian bit string counter as 1.
+    /*
+     * 2.  Initialize a 32-bit, big-endian bit string counter as 1.
      * 3.  For i = 1 to reps by 1, do the following:
      *     -   Compute Hashi = H(counter || Z || OtherInfo).
      *     -   Increment counter (modulo 2^32)
+     * 4.  Set key = Hash1 || Hash2 || ... so that length of key is K
+     *     bytes.
      */
+    outptr = (uint8_t *)out->data;
     for (counter = 1; counter <= reps; counter++) {
-        uint s = 0;
-        uint32_t be_counter = htonl(counter);
+        store_32_be(counter, be_counter);
 
         ctx = EVP_MD_CTX_new();
         if (ctx == NULL) {
-            retval = KRB5_CRYPTO_INTERNAL;
+            ret = KRB5_CRYPTO_INTERNAL;
             goto cleanup;
         }
 
         /* -   Compute Hashi = H(counter || Z || OtherInfo). */
-        if (!EVP_DigestInit(ctx, EVP_func())) {
-            krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL,
-                                   "Call to OpenSSL EVP_DigestInit() returned an error.");
-            retval = KRB5_CRYPTO_INTERNAL;
+        if (!EVP_DigestInit(ctx, md) ||
+            !EVP_DigestUpdate(ctx, be_counter, 4) ||
+            !EVP_DigestUpdate(ctx, key->data, key->length) ||
+            !EVP_DigestUpdate(ctx, info->data, info->length) ||
+            !EVP_DigestFinal(ctx, outptr, &s)) {
+            ret = oerr(context, KRB5_CRYPTO_INTERNAL,
+                       _("Failed to compute digest"));
             goto cleanup;
         }
 
-        if (!EVP_DigestUpdate(ctx, &be_counter, 4) ||
-            !EVP_DigestUpdate(ctx, secret->data, secret->length) ||
-            !EVP_DigestUpdate(ctx, other_info->data, other_info->length)) {
-            krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL,
-                                   "Call to OpenSSL EVP_DigestUpdate() returned an error.");
-            retval = KRB5_CRYPTO_INTERNAL;
-            goto cleanup;
-        }
-
-        /* 4.  Set key = Hash1 || Hash2 || ... so that length of key is K bytes. */
-        if (!EVP_DigestFinal(ctx, (uint8_t *)random_data.data + offset, &s)) {
-            krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL,
-                                   "Call to OpenSSL EVP_DigestUpdate() returned an error.");
-            retval = KRB5_CRYPTO_INTERNAL;
-            goto cleanup;
-        }
-        offset += s;
         assert(s == hash_len);
+        outptr += s;
 
         EVP_MD_CTX_free(ctx);
         ctx = NULL;
     }
 
-    retval = krb5_c_random_to_key(context, enctype, &random_data,
-                                  key_block);
-
 cleanup:
     EVP_MD_CTX_free(ctx);
+    return ret;
+}
 
-    /* If this has been an error, free the allocated key_block, if any */
-    if (retval) {
-        krb5_free_keyblock_contents(context, key_block);
-    }
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
 
-    /* free other allocated resources, either way */
-    if (random_data.data)
-        free(random_data.data);
-    krb5_free_data(context, other_info);
-    krb5_free_data(context, supp_pub_info);
+/* id-pkinit-kdf family, as specified by RFC 8636. */
+krb5_error_code
+pkinit_alg_agility_kdf(krb5_context context, krb5_data *secret,
+                       krb5_data *alg_oid, krb5_const_principal party_u_info,
+                       krb5_const_principal party_v_info,
+                       krb5_enctype enctype, krb5_data *as_req,
+                       krb5_data *pk_as_rep, krb5_keyblock *key_block)
+{
+    krb5_error_code ret;
+    size_t rand_len = 0, key_len = 0;
+    const EVP_MD *md;
+    krb5_sp80056a_other_info other_info_fields;
+    krb5_pkinit_supp_pub_info supp_pub_info_fields;
+    krb5_data *other_info = NULL, *supp_pub_info = NULL;
+    krb5_data random_data = empty_data();
+    krb5_algorithm_identifier alg_id;
+    char *hash_name = NULL;
 
-    return retval;
-} /*pkinit_alg_agility_kdf() */
+    ret = krb5_c_keylengths(context, enctype, &rand_len, &key_len);
+    if (ret)
+        goto cleanup;
 
-/* Call DH_compute_key() and ensure that we left-pad short results instead of
- * leaving junk bytes at the end of the buffer. */
-static void
-compute_dh(unsigned char *buf, int size, BIGNUM *server_pub_key, DH *dh)
-{
-    int len, pad;
+    /* Allocate and initialize the key block. */
+    key_block->magic = 0;
+    key_block->enctype = enctype;
+    key_block->length = key_len;
+    key_block->contents = k5calloc(key_block->length, 1, &ret);
+    if (key_block->contents == NULL)
+        goto cleanup;
+
+    /* If this is anonymous pkinit, use the anonymous principle for
+     * party_u_info. */
+    if (party_u_info &&
+        krb5_principal_compare_any_realm(context, party_u_info,
+                                         krb5_anonymous_principal())) {
+        party_u_info = (krb5_principal)krb5_anonymous_principal();
+    }
 
-    len = DH_compute_key(buf, server_pub_key, dh);
-    assert(len >= 0 && len <= size);
-    if (len < size) {
-        pad = size - len;
-        memmove(buf + pad, buf, len);
-        memset(buf, 0, pad);
+    md = algid_to_md(alg_oid);
+    if (md == NULL) {
+        krb5_set_error_message(context, KRB5_ERR_BAD_S2K_PARAMS,
+                               "Bad algorithm ID passed to PK-INIT KDF.");
+        return KRB5_ERR_BAD_S2K_PARAMS;
     }
+
+    /* Encode the ASN.1 octet string for "SuppPubInfo". */
+    supp_pub_info_fields.enctype = enctype;
+    supp_pub_info_fields.as_req = *as_req;
+    supp_pub_info_fields.pk_as_rep = *pk_as_rep;
+    ret = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields,
+                                           &supp_pub_info);
+    if (ret)
+        goto cleanup;
+
+    /* Now encode the ASN.1 octet string for "OtherInfo". */
+    memset(&alg_id, 0, sizeof(alg_id));
+    alg_id.algorithm = *alg_oid;
+    other_info_fields.algorithm_identifier = alg_id;
+    other_info_fields.party_u_info = (krb5_principal)party_u_info;
+    other_info_fields.party_v_info = (krb5_principal)party_v_info;
+    other_info_fields.supp_pub_info = *supp_pub_info;
+    ret = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info);
+    if (ret)
+        goto cleanup;
+
+    ret = sskdf(context, md, secret, other_info, rand_len, &random_data);
+    if (ret)
+        goto cleanup;
+
+    ret = krb5_c_random_to_key(context, enctype, &random_data, key_block);
+
+cleanup:
+    if (ret)
+        krb5_free_keyblock_contents(context, key_block);
+    free(hash_name);
+    zapfree(random_data.data, random_data.length);
+    krb5_free_data(context, other_info);
+    krb5_free_data(context, supp_pub_info);
+    return ret;
 }
 
 krb5_error_code
@@ -2526,104 +2939,38 @@
                  pkinit_plg_crypto_context plg_cryptoctx,
                  pkinit_req_crypto_context cryptoctx,
                  pkinit_identity_crypto_context id_cryptoctx,
-                 int dh_size,
-                 unsigned char **dh_params_out,
-                 unsigned int *dh_params_len_out,
-                 unsigned char **dh_pubkey_out,
-                 unsigned int *dh_pubkey_len_out)
+                 int dh_size, krb5_data *spki_out)
 {
     krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED;
-    unsigned char *buf = NULL;
-    int dh_err = 0;
-    ASN1_INTEGER *pub_key = NULL;
-    const BIGNUM *pubkey_bn, *p, *q, *g;
-    unsigned char *dh_params = NULL, *dh_pubkey = NULL;
-    unsigned int dh_params_len, dh_pubkey_len;
-
-    *dh_params_out = *dh_pubkey_out = NULL;
-    *dh_params_len_out = *dh_pubkey_len_out = 0;
-
-    if (cryptoctx->dh == NULL) {
-        if (dh_size == 1024)
-            cryptoctx->dh = make_oakley_dh(oakley_1024, sizeof(oakley_1024));
-        else if (dh_size == 2048)
-            cryptoctx->dh = make_oakley_dh(oakley_2048, sizeof(oakley_2048));
-        else if (dh_size == 4096)
-            cryptoctx->dh = make_oakley_dh(oakley_4096, sizeof(oakley_4096));
-        if (cryptoctx->dh == NULL)
-            goto cleanup;
-    }
-
-    DH_generate_key(cryptoctx->dh);
-    DH_get0_key(cryptoctx->dh, &pubkey_bn, NULL);
+    EVP_PKEY *params = NULL, *pkey = NULL;
 
-    DH_check(cryptoctx->dh, &dh_err);
-    if (dh_err != 0) {
-        pkiDebug("Warning: dh_check failed with %d\n", dh_err);
-        if (dh_err & DH_CHECK_P_NOT_PRIME)
-            pkiDebug("p value is not prime\n");
-        if (dh_err & DH_CHECK_P_NOT_SAFE_PRIME)
-            pkiDebug("p value is not a safe prime\n");
-        if (dh_err & DH_UNABLE_TO_CHECK_GENERATOR)
-            pkiDebug("unable to check the generator value\n");
-        if (dh_err & DH_NOT_SUITABLE_GENERATOR)
-            pkiDebug("the g value is not a generator\n");
-    }
-#ifdef DEBUG_DH
-    print_dh(cryptoctx->dh, "client's DH params\n");
-    print_pubkey(cryptoctx->dh->pub_key, "client's pub_key=");
-#endif
+    *spki_out = empty_data();
 
-    DH_check_pub_key(cryptoctx->dh, pubkey_bn, &dh_err);
-    if (dh_err != 0) {
-        pkiDebug("dh_check_pub_key failed with %d\n", dh_err);
+    if (cryptoctx->received_params != NULL)
+        params = cryptoctx->received_params;
+    else if (dh_size == 1024)
+        params = plg_cryptoctx->dh_1024;
+    else if (dh_size == 2048)
+        params = plg_cryptoctx->dh_2048;
+    else if (dh_size == 4096)
+        params = plg_cryptoctx->dh_4096;
+    else
         goto cleanup;
-    }
 
-    /* pack DHparams */
-    /* aglo: usually we could just call i2d_DHparams to encode DH params
-     * however, PKINIT requires RFC3279 encoding and openssl does pkcs#3.
-     */
-    DH_get0_pqg(cryptoctx->dh, &p, &q, &g);
-    retval = pkinit_encode_dh_params(p, g, q, &dh_params, &dh_params_len);
-    if (retval)
+    pkey = generate_dh_pkey(params);
+    if (pkey == NULL)
         goto cleanup;
 
-    /* pack DH public key */
-    /* Diffie-Hellman public key must be ASN1 encoded as an INTEGER; this
-     * encoding shall be used as the contents (the value) of the
-     * subjectPublicKey component (a BIT STRING) of the SubjectPublicKeyInfo
-     * data element
-     */
-    pub_key = BN_to_ASN1_INTEGER(pubkey_bn, NULL);
-    if (pub_key == NULL) {
-        retval = ENOMEM;
-        goto cleanup;
-    }
-    dh_pubkey_len = i2d_ASN1_INTEGER(pub_key, NULL);
-    buf = dh_pubkey = malloc(dh_pubkey_len);
-    if (dh_pubkey == NULL) {
-        retval = ENOMEM;
+    retval = encode_spki(pkey, spki_out);
+    if (retval)
         goto cleanup;
-    }
-    i2d_ASN1_INTEGER(pub_key, &buf);
 
-    *dh_params_out = dh_params;
-    *dh_params_len_out = dh_params_len;
-    *dh_pubkey_out = dh_pubkey;
-    *dh_pubkey_len_out = dh_pubkey_len;
-    dh_params = dh_pubkey = NULL;
-
-    retval = 0;
+    EVP_PKEY_free(cryptoctx->client_pkey);
+    cryptoctx->client_pkey = pkey;
+    pkey = NULL;
 
 cleanup:
-    if (retval) {
-        DH_free(cryptoctx->dh);
-        cryptoctx->dh = NULL;
-    }
-    free(dh_params);
-    free(dh_pubkey);
-    ASN1_INTEGER_free(pub_key);
+    EVP_PKEY_free(pkey);
     return retval;
 }
 
@@ -2638,29 +2985,23 @@
                   unsigned int *client_key_len_out)
 {
     krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED;
-    BIGNUM *server_pub_key = NULL;
-    ASN1_INTEGER *pub_key = NULL;
-    unsigned char *client_key = NULL;
+    EVP_PKEY *server_pkey = NULL;
+    uint8_t *client_key = NULL;
     unsigned int client_key_len;
-    const unsigned char *p = NULL;
 
     *client_key_out = NULL;
     *client_key_len_out = 0;
 
-    client_key_len = DH_size(cryptoctx->dh);
-    client_key = malloc(client_key_len);
-    if (client_key == NULL) {
-        retval = ENOMEM;
-        goto cleanup;
-    }
-    p = subjectPublicKey_data;
-    pub_key = d2i_ASN1_INTEGER(NULL, &p, (long)subjectPublicKey_length);
-    if (pub_key == NULL)
+    server_pkey = compose_dh_pkey(cryptoctx->client_pkey,
+                                  subjectPublicKey_data,
+                                  subjectPublicKey_length);
+    if (server_pkey == NULL)
         goto cleanup;
-    if ((server_pub_key = ASN1_INTEGER_to_BN(pub_key, NULL)) == NULL)
+
+    if (!dh_result(cryptoctx->client_pkey, server_pkey,
+                   &client_key, &client_key_len))
         goto cleanup;
 
-    compute_dh(client_key, client_key_len, server_pub_key, cryptoctx->dh);
 #ifdef DEBUG_DH
     print_pubkey(server_pub_key, "server's pub_key=");
     pkiDebug("client computed key (%d)= ", client_key_len);
@@ -2674,39 +3015,22 @@
     retval = 0;
 
 cleanup:
-    BN_free(server_pub_key);
-    ASN1_INTEGER_free(pub_key);
+    EVP_PKEY_free(server_pkey);
     free(client_key);
     return retval;
 }
 
 /* Return 1 if dh is a permitted well-known group, otherwise return 0. */
 static int
-check_dh_wellknown(pkinit_plg_crypto_context cryptoctx, DH *dh, int nbits)
+check_dh_wellknown(pkinit_plg_crypto_context cryptoctx, EVP_PKEY *pkey,
+                   int nbits)
 {
-
-    switch (nbits) {
-    case 1024:
-        /* Oakley MODP group 2 */
-        if (pkinit_check_dh_params(cryptoctx->dh_1024, dh) == 0)
-            return 1;
-        break;
-
-    case 2048:
-        /* Oakley MODP group 14 */
-        if (pkinit_check_dh_params(cryptoctx->dh_2048, dh) == 0)
-            return 1;
-        break;
-
-    case 4096:
-        /* Oakley MODP group 16 */
-        if (pkinit_check_dh_params(cryptoctx->dh_4096, dh) == 0)
-            return 1;
-        break;
-
-    default:
-        break;
-    }
+    if (nbits == 1024)
+        return EVP_PKEY_parameters_eq(cryptoctx->dh_1024, pkey) == 1;
+    else if (nbits == 2048)
+        return EVP_PKEY_parameters_eq(cryptoctx->dh_2048, pkey) == 1;
+    else if (nbits == 4096)
+        return EVP_PKEY_parameters_eq(cryptoctx->dh_4096, pkey) == 1;
     return 0;
 }
 
@@ -2715,142 +3039,69 @@
                 pkinit_plg_crypto_context cryptoctx,
                 pkinit_req_crypto_context req_cryptoctx,
                 pkinit_identity_crypto_context id_cryptoctx,
-                krb5_data *dh_params,
+                const krb5_data *client_spki,
                 int minbits)
 {
-    DH *dh = NULL;
-    const BIGNUM *p;
+    EVP_PKEY *client_pkey = NULL;
     int dh_prime_bits;
     krb5_error_code retval = KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED;
 
-    dh = decode_dh_params((uint8_t *)dh_params->data, dh_params->length);
-    if (dh == NULL) {
+    client_pkey = decode_spki(client_spki);
+    if (client_pkey == NULL) {
         pkiDebug("failed to decode dhparams\n");
         goto cleanup;
     }
 
     /* KDC SHOULD check to see if the key parameters satisfy its policy */
-    DH_get0_pqg(dh, &p, NULL, NULL);
-    dh_prime_bits = BN_num_bits(p);
+    dh_prime_bits = EVP_PKEY_get_bits(client_pkey);
     if (minbits && dh_prime_bits < minbits) {
         pkiDebug("client sent dh params with %d bits, we require %d\n",
                  dh_prime_bits, minbits);
         goto cleanup;
     }
 
-    if (check_dh_wellknown(cryptoctx, dh, dh_prime_bits))
+    if (check_dh_wellknown(cryptoctx, client_pkey, dh_prime_bits))
         retval = 0;
 
 cleanup:
     if (retval == 0)
-        req_cryptoctx->dh = dh;
+        req_cryptoctx->client_pkey = client_pkey;
     else
-        DH_free(dh);
+        EVP_PKEY_free(client_pkey);
 
     return retval;
 }
 
-/* Duplicate a DH handle (parameters only, not public or private key). */
-static DH *
-dup_dh_params(const DH *src)
-{
-    const BIGNUM *oldp, *oldq, *oldg;
-    BIGNUM *p = NULL, *q = NULL, *g = NULL;
-    DH *dh;
-
-    DH_get0_pqg(src, &oldp, &oldq, &oldg);
-    p = BN_dup(oldp);
-    q = BN_dup(oldq);
-    g = BN_dup(oldg);
-    dh = DH_new();
-    if (p == NULL || q == NULL || g == NULL || dh == NULL) {
-        BN_free(p);
-        BN_free(q);
-        BN_free(g);
-        DH_free(dh);
-        return NULL;
-    }
-    DH_set0_pqg(dh, p, q, g);
-    return dh;
-}
-
 /* kdc's dh function */
 krb5_error_code
 server_process_dh(krb5_context context,
                   pkinit_plg_crypto_context plg_cryptoctx,
                   pkinit_req_crypto_context cryptoctx,
                   pkinit_identity_crypto_context id_cryptoctx,
-                  unsigned char *data,
-                  unsigned int data_len,
                   unsigned char **dh_pubkey_out,
                   unsigned int *dh_pubkey_len_out,
                   unsigned char **server_key_out,
                   unsigned int *server_key_len_out)
 {
     krb5_error_code retval = ENOMEM;
-    DH *dh = NULL, *dh_server = NULL;
-    unsigned char *p = NULL;
-    ASN1_INTEGER *pub_key = NULL;
-    BIGNUM *client_pubkey = NULL;
-    const BIGNUM *server_pubkey;
+    EVP_PKEY *server_pkey = NULL;
     unsigned char *dh_pubkey = NULL, *server_key = NULL;
     unsigned int dh_pubkey_len = 0, server_key_len = 0;
 
     *dh_pubkey_out = *server_key_out = NULL;
     *dh_pubkey_len_out = *server_key_len_out = 0;
 
-    /* get client's received DH parameters that we saved in server_check_dh */
-    dh = cryptoctx->dh;
-    dh_server = dup_dh_params(dh);
-    if (dh_server == NULL)
-        goto cleanup;
-
-    /* decode client's public key */
-    p = data;
-    pub_key = d2i_ASN1_INTEGER(NULL, (const unsigned char **)&p, (int)data_len);
-    if (pub_key == NULL)
-        goto cleanup;
-    client_pubkey = ASN1_INTEGER_to_BN(pub_key, NULL);
-    if (client_pubkey == NULL)
-        goto cleanup;
-    ASN1_INTEGER_free(pub_key);
-
-    if (!DH_generate_key(dh_server))
+    /* Generate a server DH key with the same parameters as the client key. */
+    server_pkey = generate_dh_pkey(cryptoctx->client_pkey);
+    if (server_pkey == NULL)
         goto cleanup;
-    DH_get0_key(dh_server, &server_pubkey, NULL);
 
-    /* generate DH session key */
-    server_key_len = DH_size(dh_server);
-    server_key = malloc(server_key_len);
-    if (server_key == NULL)
+    if (!dh_result(server_pkey, cryptoctx->client_pkey, &server_key,
+                   &server_key_len))
         goto cleanup;
-    compute_dh(server_key, server_key_len, client_pubkey, dh_server);
-
-#ifdef DEBUG_DH
-    print_dh(dh_server, "client&server's DH params\n");
-    print_pubkey(client_pubkey, "client's pub_key=");
-    print_pubkey(server_pubkey, "server's pub_key=");
-    pkiDebug("server computed key=");
-    print_buffer(server_key, server_key_len);
-#endif
 
-    /* KDC reply */
-    /* pack DH public key */
-    /* Diffie-Hellman public key must be ASN1 encoded as an INTEGER; this
-     * encoding shall be used as the contents (the value) of the
-     * subjectPublicKey component (a BIT STRING) of the SubjectPublicKeyInfo
-     * data element
-     */
-    pub_key = BN_to_ASN1_INTEGER(server_pubkey, NULL);
-    if (pub_key == NULL)
+    if (!dh_pubkey_der(server_pkey, &dh_pubkey, &dh_pubkey_len))
         goto cleanup;
-    dh_pubkey_len = i2d_ASN1_INTEGER(pub_key, NULL);
-    p = dh_pubkey = malloc(dh_pubkey_len);
-    if (dh_pubkey == NULL)
-        goto cleanup;
-    i2d_ASN1_INTEGER(pub_key, &p);
-    if (pub_key != NULL)
-        ASN1_INTEGER_free(pub_key);
 
     *dh_pubkey_out = dh_pubkey;
     *dh_pubkey_len_out = dh_pubkey_len;
@@ -2861,8 +3112,7 @@
     retval = 0;
 
 cleanup:
-    BN_free(client_pubkey);
-    DH_free(dh_server);
+    EVP_PKEY_free(server_pkey);
     free(dh_pubkey);
     free(server_key);
 
@@ -2879,191 +3129,6 @@
 }
 
 static krb5_error_code
-pkinit_encode_dh_params(const BIGNUM *p, const BIGNUM *g, const BIGNUM *q,
-                        uint8_t **buf, unsigned int *buf_len)
-{
-    krb5_error_code retval = ENOMEM;
-    int bufsize = 0, r = 0;
-    unsigned char *tmp = NULL;
-    ASN1_INTEGER *ap = NULL, *ag = NULL, *aq = NULL;
-
-    if ((ap = BN_to_ASN1_INTEGER(p, NULL)) == NULL)
-        goto cleanup;
-    if ((ag = BN_to_ASN1_INTEGER(g, NULL)) == NULL)
-        goto cleanup;
-    if ((aq = BN_to_ASN1_INTEGER(q, NULL)) == NULL)
-        goto cleanup;
-    bufsize = i2d_ASN1_INTEGER(ap, NULL);
-    bufsize += i2d_ASN1_INTEGER(ag, NULL);
-    bufsize += i2d_ASN1_INTEGER(aq, NULL);
-
-    r = ASN1_object_size(1, bufsize, V_ASN1_SEQUENCE);
-
-    tmp = *buf = malloc((size_t) r);
-    if (tmp == NULL)
-        goto cleanup;
-
-    ASN1_put_object(&tmp, 1, bufsize, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
-
-    i2d_ASN1_INTEGER(ap, &tmp);
-    i2d_ASN1_INTEGER(ag, &tmp);
-    i2d_ASN1_INTEGER(aq, &tmp);
-
-    *buf_len = r;
-
-    retval = 0;
-
-cleanup:
-    if (ap != NULL)
-        ASN1_INTEGER_free(ap);
-    if (ag != NULL)
-        ASN1_INTEGER_free(ag);
-    if (aq != NULL)
-        ASN1_INTEGER_free(aq);
-
-    return retval;
-}
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-
-/*
- * We need to decode DomainParameters from RFC 3279 section 2.3.3.  We would
- * like to just call d2i_DHxparams(), but Microsoft's implementation may omit
- * the q value in violation of the RFC.  Instead we must copy the internal
- * structures and sequence declarations from dh_asn1.c, modified to make the q
- * field optional.
- */
-
-typedef struct {
-    ASN1_BIT_STRING *seed;
-    BIGNUM *counter;
-} int_dhvparams;
-
-typedef struct {
-    BIGNUM *p;
-    BIGNUM *q;
-    BIGNUM *g;
-    BIGNUM *j;
-    int_dhvparams *vparams;
-} int_dhx942_dh;
-
-ASN1_SEQUENCE(DHvparams) = {
-    ASN1_SIMPLE(int_dhvparams, seed, ASN1_BIT_STRING),
-    ASN1_SIMPLE(int_dhvparams, counter, BIGNUM)
-} static_ASN1_SEQUENCE_END_name(int_dhvparams, DHvparams)
-
-ASN1_SEQUENCE(DHxparams) = {
-    ASN1_SIMPLE(int_dhx942_dh, p, BIGNUM),
-    ASN1_SIMPLE(int_dhx942_dh, g, BIGNUM),
-    ASN1_OPT(int_dhx942_dh, q, BIGNUM),
-    ASN1_OPT(int_dhx942_dh, j, BIGNUM),
-    ASN1_OPT(int_dhx942_dh, vparams, DHvparams),
-} static_ASN1_SEQUENCE_END_name(int_dhx942_dh, DHxparams)
-
-static DH *
-decode_dh_params(const uint8_t *p, unsigned int len)
-{
-    int_dhx942_dh *params;
-    DH *dh;
-
-    dh = DH_new();
-    if (dh == NULL)
-        return NULL;
-
-    params = (int_dhx942_dh *)ASN1_item_d2i(NULL, &p, len,
-                                            ASN1_ITEM_rptr(DHxparams));
-    if (params == NULL) {
-        DH_free(dh);
-        return NULL;
-    }
-
-    /* Steal the p, q, and g values from dhparams for dh.  Ignore j and
-     * vparams. */
-    DH_set0_pqg(dh, params->p, params->q, params->g);
-    params->p = params->q = params->g = NULL;
-    ASN1_item_free((ASN1_VALUE *)params, ASN1_ITEM_rptr(DHxparams));
-    return dh;
-}
-
-#else /* OPENSSL_VERSION_NUMBER < 0x10100000L */
-
-/*
- * Do the same decoding (except without decoding j and vparams or checking the
- * sequence length) using the pre-OpenSSL-1.1 asn1_mac.h.  Define an internal
- * function in the form demanded by the macros, then wrap it for caller
- * convenience.
- */
-
-static DH *
-decode_dh_params_int(DH ** a, uint8_t **pp, unsigned int len)
-{
-    ASN1_INTEGER ai, *aip = NULL;
-    long length = (long) len;
-
-    M_ASN1_D2I_vars(a, DH *, DH_new);
-
-    M_ASN1_D2I_Init();
-    M_ASN1_D2I_start_sequence();
-    aip = &ai;
-    ai.data = NULL;
-    ai.length = 0;
-    M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
-    if (aip == NULL)
-        return NULL;
-    else {
-        ret->p = ASN1_INTEGER_to_BN(aip, NULL);
-        if (ret->p == NULL)
-            return NULL;
-        if (ai.data != NULL) {
-            OPENSSL_free(ai.data);
-            ai.data = NULL;
-            ai.length = 0;
-        }
-    }
-    M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
-    if (aip == NULL)
-        return NULL;
-    else {
-        ret->g = ASN1_INTEGER_to_BN(aip, NULL);
-        if (ret->g == NULL)
-            return NULL;
-        if (ai.data != NULL) {
-            OPENSSL_free(ai.data);
-            ai.data = NULL;
-            ai.length = 0;
-        }
-
-    }
-    M_ASN1_D2I_get_opt(aip, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
-    if (aip == NULL || ai.data == NULL)
-        ret->q = NULL;
-    else {
-        ret->q = ASN1_INTEGER_to_BN(aip, NULL);
-        if (ret->q == NULL)
-            return NULL;
-        if (ai.data != NULL) {
-            OPENSSL_free(ai.data);
-            ai.data = NULL;
-            ai.length = 0;
-        }
-
-    }
-    M_ASN1_D2I_end_sequence();
-    M_ASN1_D2I_Finish(a, DH_free, 0);
-
-}
-
-static DH *
-decode_dh_params(const uint8_t *p, unsigned int len)
-{
-    uint8_t *ptr = (uint8_t *)p;
-
-    return decode_dh_params_int(NULL, &ptr, len);
-}
-
-#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
-
-static krb5_error_code
 pkinit_create_sequence_of_principal_identifiers(
     krb5_context context,
     pkinit_plg_crypto_context plg_cryptoctx,
@@ -3174,151 +3239,50 @@
                                pkinit_plg_opts *opts,
                                krb5_pa_data ***e_data_out)
 {
-    krb5_error_code retval = ENOMEM;
-    unsigned int buf1_len = 0, buf2_len = 0, buf3_len = 0, i = 0;
-    unsigned char *buf1 = NULL, *buf2 = NULL, *buf3 = NULL;
+    krb5_error_code ret;
+    int i;
     krb5_pa_data **pa_data = NULL;
-    krb5_data *encoded_algId = NULL;
-    krb5_algorithm_identifier **algId = NULL;
-    const BIGNUM *p, *q, *g;
-
-    if (opts->dh_min_bits > 4096)
+    krb5_data *der_alglist = NULL;
+    krb5_algorithm_identifier alg_1024 = { dh_oid, oakley_1024 };
+    krb5_algorithm_identifier alg_2048 = { dh_oid, oakley_2048 };
+    krb5_algorithm_identifier alg_4096 = { dh_oid, oakley_4096 };
+    krb5_algorithm_identifier *alglist4;
+
+    if (opts->dh_min_bits > 4096) {
+        ret = KRB5KRB_ERR_GENERIC;
         goto cleanup;
-
-    if (opts->dh_min_bits <= 1024) {
-        DH_get0_pqg(plg_cryptoctx->dh_1024, &p, &q, &g);
-        retval = pkinit_encode_dh_params(p, g, q, &buf1, &buf1_len);
-        if (retval)
-            goto cleanup;
     }
-    if (opts->dh_min_bits <= 2048) {
-        DH_get0_pqg(plg_cryptoctx->dh_2048, &p, &q, &g);
-        retval = pkinit_encode_dh_params(p, g, q, &buf2, &buf2_len);
-        if (retval)
-            goto cleanup;
-    }
-    DH_get0_pqg(plg_cryptoctx->dh_4096, &p, &q, &g);
-    retval = pkinit_encode_dh_params(p, g, q, &buf3, &buf3_len);
-    if (retval)
-        goto cleanup;
-
-    if (opts->dh_min_bits <= 1024) {
-        algId = malloc(4 * sizeof(krb5_algorithm_identifier *));
-        if (algId == NULL)
-            goto cleanup;
-        algId3 = NULL;
-        algId0 = malloc(sizeof(krb5_algorithm_identifier));
-        if (algId0 == NULL)
-            goto cleanup;
-        algId0->parameters.data = malloc(buf2_len);
-        if (algId0->parameters.data == NULL)
-            goto cleanup;
-        memcpy(algId0->parameters.data, buf2, buf2_len);
-        algId0->parameters.length = buf2_len;
-        algId0->algorithm = dh_oid;
-
-        algId1 = malloc(sizeof(krb5_algorithm_identifier));
-        if (algId1 == NULL)
-            goto cleanup;
-        algId1->parameters.data = malloc(buf3_len);
-        if (algId1->parameters.data == NULL)
-            goto cleanup;
-        memcpy(algId1->parameters.data, buf3, buf3_len);
-        algId1->parameters.length = buf3_len;
-        algId1->algorithm = dh_oid;
-
-        algId2 = malloc(sizeof(krb5_algorithm_identifier));
-        if (algId2 == NULL)
-            goto cleanup;
-        algId2->parameters.data = malloc(buf1_len);
-        if (algId2->parameters.data == NULL)
-            goto cleanup;
-        memcpy(algId2->parameters.data, buf1, buf1_len);
-        algId2->parameters.length = buf1_len;
-        algId2->algorithm = dh_oid;
-
-    } else if (opts->dh_min_bits <= 2048) {
-        algId = malloc(3 * sizeof(krb5_algorithm_identifier *));
-        if (algId == NULL)
-            goto cleanup;
-        algId2 = NULL;
-        algId0 = malloc(sizeof(krb5_algorithm_identifier));
-        if (algId0 == NULL)
-            goto cleanup;
-        algId0->parameters.data = malloc(buf2_len);
-        if (algId0->parameters.data == NULL)
-            goto cleanup;
-        memcpy(algId0->parameters.data, buf2, buf2_len);
-        algId0->parameters.length = buf2_len;
-        algId0->algorithm = dh_oid;
 
-        algId1 = malloc(sizeof(krb5_algorithm_identifier));
-        if (algId1 == NULL)
-            goto cleanup;
-        algId1->parameters.data = malloc(buf3_len);
-        if (algId1->parameters.data == NULL)
-            goto cleanup;
-        memcpy(algId1->parameters.data, buf3, buf3_len);
-        algId1->parameters.length = buf3_len;
-        algId1->algorithm = dh_oid;
-
-    } else if (opts->dh_min_bits <= 4096) {
-        algId = malloc(2 * sizeof(krb5_algorithm_identifier *));
-        if (algId == NULL)
-            goto cleanup;
-        algId1 = NULL;
-        algId0 = malloc(sizeof(krb5_algorithm_identifier));
-        if (algId0 == NULL)
-            goto cleanup;
-        algId0->parameters.data = malloc(buf3_len);
-        if (algId0->parameters.data == NULL)
-            goto cleanup;
-        memcpy(algId0->parameters.data, buf3, buf3_len);
-        algId0->parameters.length = buf3_len;
-        algId0->algorithm = dh_oid;
+    i = 0;
+    if (opts->dh_min_bits <= 2048)
+        alglisti++ = &alg_2048;
+    alglisti++ = &alg_4096;
+    if (opts->dh_min_bits <= 1024)
+        alglisti++ = &alg_1024;
+    alglisti = NULL;
 
-    }
-    retval = k5int_encode_krb5_td_dh_parameters((krb5_algorithm_identifier *const *)algId, &encoded_algId);
-    if (retval)
+    ret = k5int_encode_krb5_td_dh_parameters(alglist, &der_alglist);
+    if (ret)
         goto cleanup;
-#ifdef DEBUG_ASN1
-    print_buffer_bin((unsigned char *)encoded_algId->data,
-                     encoded_algId->length, "/tmp/kdc_td_dh_params");
-#endif
-    pa_data = malloc(2 * sizeof(krb5_pa_data *));
-    if (pa_data == NULL) {
-        retval = ENOMEM;
+
+    pa_data = k5calloc(2, sizeof(*pa_data), &ret);
+    if (pa_data == NULL)
         goto cleanup;
-    }
     pa_data1 = NULL;
-    pa_data0 = malloc(sizeof(krb5_pa_data));
+    pa_data0 = k5alloc(sizeof(*pa_data0), &ret);
     if (pa_data0 == NULL) {
         free(pa_data);
-        retval = ENOMEM;
         goto cleanup;
     }
     pa_data0->pa_type = TD_DH_PARAMETERS;
-    pa_data0->length = encoded_algId->length;
-    pa_data0->contents = (krb5_octet *)encoded_algId->data;
+    pa_data0->length = der_alglist->length;
+    pa_data0->contents = (krb5_octet *)der_alglist->data;
+    der_alglist->data = NULL;
     *e_data_out = pa_data;
-    retval = 0;
-cleanup:
 
-    free(buf1);
-    free(buf2);
-    free(buf3);
-    free(encoded_algId);
-
-    if (algId != NULL) {
-        while(algIdi != NULL) {
-            free(algIdi->parameters.data);
-            free(algIdi);
-            i++;
-        }
-        free(algId);
-    }
-
-    return retval;
+cleanup:
+    krb5_free_data(context, der_alglist);
+    return ret;
 }
 
 krb5_error_code
@@ -3355,26 +3319,6 @@
     return 0;
 }
 
-/* Check parameters against a well-known DH group. */
-static int
-pkinit_check_dh_params(DH *dh1, DH *dh2)
-{
-    const BIGNUM *p1, *p2, *g1, *g2;
-
-    DH_get0_pqg(dh1, &p1, NULL, &g1);
-    DH_get0_pqg(dh2, &p2, NULL, &g2);
-    if (BN_cmp(p1, p2) != 0) {
-        pkiDebug("p is not well-known group dhparameter\n");
-        return -1;
-    }
-    if (BN_cmp(g1, g2) != 0) {
-        pkiDebug("bad g dhparameter\n");
-        return -1;
-    }
-    pkiDebug("good %d dhparams\n", BN_num_bits(p1));
-    return 0;
-}
-
 krb5_error_code
 pkinit_process_td_dh_params(krb5_context context,
                             pkinit_plg_crypto_context cryptoctx,
@@ -3384,60 +3328,55 @@
                             int *new_dh_size)
 {
     krb5_error_code retval = KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED;
-    int i = 0, use_sent_dh = 0, ok = 0;
+    EVP_PKEY *params = NULL;
+    int i, dh_prime_bits, old_dh_size;
 
     pkiDebug("dh parameters\n");
 
-    while (algIdi != NULL) {
-        DH *dh = NULL;
-        const BIGNUM *p;
-        int dh_prime_bits = 0;
+    EVP_PKEY_free(req_cryptoctx->received_params);
+    req_cryptoctx->received_params = NULL;
+
+    old_dh_size = *new_dh_size;
 
+    for (i = 0; algIdi != NULL; i++) {
+        /* Free any parameters from the previous iteration. */
+        EVP_PKEY_free(params);
+        params = NULL;
+
+        /* Skip any parameters for algorithms other than DH. */
         if (algIdi->algorithm.length != dh_oid.length ||
             memcmp(algIdi->algorithm.data, dh_oid.data, dh_oid.length))
-            goto cleanup;
+            continue;
 
-        dh = decode_dh_params((uint8_t *)algIdi->parameters.data,
-                              algIdi->parameters.length);
-        if (dh == NULL)
-            goto cleanup;
-        DH_get0_pqg(dh, &p, NULL, NULL);
-        dh_prime_bits = BN_num_bits(p);
+        params = decode_dh_params(&algIdi->parameters);
+        if (params == NULL)
+            continue;
+        dh_prime_bits = EVP_PKEY_get_bits(params);
+        /* Skip any parameters shorter than the previous size. */
+        if (dh_prime_bits < old_dh_size)
+            continue;
         pkiDebug("client sent %d DH bits server prefers %d DH bits\n",
                  *new_dh_size, dh_prime_bits);
-        ok = check_dh_wellknown(cryptoctx, dh, dh_prime_bits);
-        if (ok) {
+
+        /* If this is one of our well-known groups, just save the new size; we
+         * will use our own copy of the parameters. */
+        if (check_dh_wellknown(cryptoctx, params, dh_prime_bits)) {
             *new_dh_size = dh_prime_bits;
+            retval = 0;
+            goto cleanup;
         }
-        if (!ok) {
-            DH_check(dh, &retval);
-            if (retval != 0) {
-                pkiDebug("DH parameters provided by server are unacceptable\n");
-                retval = KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED;
-            }
-            else {
-                use_sent_dh = 1;
-                ok = 1;
-            }
-        }
-        if (!use_sent_dh)
-            DH_free(dh);
-        if (ok) {
-            if (req_cryptoctx->dh != NULL) {
-                DH_free(req_cryptoctx->dh);
-                req_cryptoctx->dh = NULL;
-            }
-            if (use_sent_dh)
-                req_cryptoctx->dh = dh;
-            break;
+
+        /* If the parameters aren't well-known but check out, save them. */
+        if (params_valid(params)) {
+            req_cryptoctx->received_params = params;
+            params = NULL;
+            retval = 0;
+            goto cleanup;
         }
-        i++;
     }
 
-    if (ok)
-        retval = 0;
-
 cleanup:
+    EVP_PKEY_free(params);
     return retval;
 }
 
@@ -3548,33 +3487,48 @@
 }
 
 #ifndef WITHOUT_PKCS11
-static void *
-pkinit_C_LoadModule(const char *modname, CK_FUNCTION_LIST_PTR_PTR p11p)
+static struct plugin_file_handle *
+load_pkcs11_module(krb5_context context, const char *modname,
+                   CK_FUNCTION_LIST_PTR_PTR p11p)
 {
-    void *handle;
+    struct plugin_file_handle *handle = NULL;
     CK_RV (*getflist)(CK_FUNCTION_LIST_PTR_PTR);
+    struct errinfo einfo = EMPTY_ERRINFO;
+    const char *errmsg = NULL;
+    void (*sym)();
+    long err;
+    CK_RV rv;
 
-    pkiDebug("loading module \"%s\"... ", modname);
-    handle = dlopen(modname, RTLD_NOW);
-    if (handle == NULL) {
-        pkiDebug("not found\n");
-        return NULL;
+    TRACE_PKINIT_PKCS11_OPEN(context, modname);
+    err = krb5int_open_plugin(modname, &handle, &einfo);
+    if (err) {
+        errmsg = k5_get_error(&einfo, err);
+        TRACE_PKINIT_PKCS11_OPEN_FAILED(context, errmsg);
+        goto error;
     }
-    getflist = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR)) dlsym(handle, "C_GetFunctionList");
-    if (getflist == NULL || (*getflist)(p11p) != CKR_OK) {
-        dlclose(handle);
-        pkiDebug("failed\n");
-        return NULL;
+
+    err = krb5int_get_plugin_func(handle, "C_GetFunctionList", &sym, &einfo);
+    if (err) {
+        errmsg = k5_get_error(&einfo, err);
+        TRACE_PKINIT_PKCS11_GETSYM_FAILED(context, errmsg);
+        goto error;
     }
-    pkiDebug("ok\n");
+
+    getflist = (CK_RV (*)())sym;
+    rv = (*getflist)(p11p);
+    if (rv != CKR_OK) {
+        TRACE_PKINIT_PKCS11_GETFLIST_FAILED(context, pkcs11err(rv));
+        goto error;
+    }
+
     return handle;
-}
 
-static CK_RV
-pkinit_C_UnloadModule(void *handle)
-{
-    dlclose(handle);
-    return CKR_OK;
+error:
+    k5_free_error(&einfo, errmsg);
+    k5_clear_error(&einfo);
+    if (handle != NULL)
+        krb5int_close_plugin(handle);
+    return NULL;
 }
 
 static krb5_error_code
@@ -3631,7 +3585,7 @@
                                        (u_char *) rdat.data, rdat.length);
 
         if (r != CKR_OK) {
-            pkiDebug("C_Login: %s\n", pkinit_pkcs11_code_to_text(r));
+            TRACE_PKINIT_PKCS11_LOGIN_FAILED(context, pkcs11err(r));
             r = KRB5KDC_ERR_PREAUTH_FAILED;
         }
     }
@@ -3644,40 +3598,46 @@
 pkinit_open_session(krb5_context context,
                     pkinit_identity_crypto_context cctx)
 {
-    CK_ULONG i, r;
+    CK_ULONG i, pret;
     unsigned char *cp;
     size_t label_len;
     CK_ULONG count = 0;
-    CK_SLOT_ID_PTR slotlist;
+    CK_SLOT_ID_PTR slotlist = NULL;
     CK_TOKEN_INFO tinfo;
-    char *p11name;
+    char *p11name = NULL;
     const char *password;
+    krb5_error_code ret;
 
     if (cctx->p11_module != NULL)
         return 0; /* session already open */
 
     /* Load module */
-    cctx->p11_module =
-        pkinit_C_LoadModule(cctx->p11_module_name, &cctx->p11);
+    cctx->p11_module = load_pkcs11_module(context, cctx->p11_module_name,
+                                          &cctx->p11);
     if (cctx->p11_module == NULL)
         return KRB5KDC_ERR_PREAUTH_FAILED;
 
     /* Init */
-    if ((r = cctx->p11->C_Initialize(NULL)) != CKR_OK) {
-        pkiDebug("C_Initialize: %s\n", pkinit_pkcs11_code_to_text(r));
+    pret = cctx->p11->C_Initialize(NULL);
+    if (pret != CKR_OK) {
+        pkiDebug("C_Initialize: %s\n", pkcs11err(pret));
         return KRB5KDC_ERR_PREAUTH_FAILED;
     }
 
     /* Get the list of available slots */
     if (cctx->p11->C_GetSlotList(TRUE, NULL, &count) != CKR_OK)
         return KRB5KDC_ERR_PREAUTH_FAILED;
-    if (count == 0)
+    if (count == 0) {
+        TRACE_PKINIT_PKCS11_NO_TOKEN(context);
         return KRB5KDC_ERR_PREAUTH_FAILED;
+    }
     slotlist = calloc(count, sizeof(CK_SLOT_ID));
     if (slotlist == NULL)
         return ENOMEM;
-    if (cctx->p11->C_GetSlotList(TRUE, slotlist, &count) != CKR_OK)
-        return KRB5KDC_ERR_PREAUTH_FAILED;
+    if (cctx->p11->C_GetSlotList(TRUE, slotlist, &count) != CKR_OK) {
+        ret = KRB5KDC_ERR_PREAUTH_FAILED;
+        goto cleanup;
+    }
 
     /* Look for the given token label, or if none given take the first one */
     for (i = 0; i < count; i++) {
@@ -3686,16 +3646,20 @@
             continue;
 
         /* Open session */
-        if ((r = cctx->p11->C_OpenSession(slotlisti, CKF_SERIAL_SESSION,
-                                          NULL, NULL, &cctx->session)) != CKR_OK) {
-            pkiDebug("C_OpenSession: %s\n", pkinit_pkcs11_code_to_text(r));
-            return KRB5KDC_ERR_PREAUTH_FAILED;
+        pret = cctx->p11->C_OpenSession(slotlisti, CKF_SERIAL_SESSION,
+                                        NULL, NULL, &cctx->session);
+        if (pret != CKR_OK) {
+            pkiDebug("C_OpenSession: %s\n", pkcs11err(pret));
+            ret = KRB5KDC_ERR_PREAUTH_FAILED;
+            goto cleanup;
         }
 
         /* Get token info */
-        if ((r = cctx->p11->C_GetTokenInfo(slotlisti, &tinfo)) != CKR_OK) {
-            pkiDebug("C_GetTokenInfo: %s\n", pkinit_pkcs11_code_to_text(r));
-            return KRB5KDC_ERR_PREAUTH_FAILED;
+        pret = cctx->p11->C_GetTokenInfo(slotlisti, &tinfo);
+        if (pret != CKR_OK) {
+            pkiDebug("C_GetTokenInfo: %s\n", pkcs11err(pret));
+            ret = KRB5KDC_ERR_PREAUTH_FAILED;
+            goto cleanup;
         }
 
         /* tinfo.label is zero-filled but not necessarily zero-terminated.
@@ -3706,8 +3670,8 @@
         }
         label_len = cp - tinfo.label;
 
-        pkiDebug("open_session: slotid %d token \"%.*s\"\n",
-                 (int)slotlisti, (int)label_len, tinfo.label);
+        TRACE_PKINIT_PKCS11_SLOT(context, (int)slotlisti, (int)label_len,
+                                 tinfo.label);
         if (cctx->token_label == NULL ||
             (strlen(cctx->token_label) == label_len &&
              memcmp(cctx->token_label, tinfo.label, label_len) == 0))
@@ -3715,12 +3679,11 @@
         cctx->p11->C_CloseSession(cctx->session);
     }
     if (i >= count) {
-        free(slotlist);
-        pkiDebug("open_session: no matching token found\n");
-        return KRB5KDC_ERR_PREAUTH_FAILED;
+        TRACE_PKINIT_PKCS11_NO_MATCH_TOKEN(context);
+        ret = KRB5KDC_ERR_PREAUTH_FAILED;
+        goto cleanup;
     }
     cctx->slotid = slotlisti;
-    free(slotlist);
     pkiDebug("open_session: slotid %d (%lu of %d)\n", (int)cctx->slotid,
              i + 1, (int) count);
 
@@ -3740,23 +3703,26 @@
                              (int)label_len, tinfo.label) < 0)
                     p11name = NULL;
             }
-        } else {
-            p11name = NULL;
         }
         if (cctx->defer_id_prompt) {
             /* Supply the identity name to be passed to the responder. */
             pkinit_set_deferred_id(&cctx->deferred_ids,
                                    p11name, tinfo.flags, NULL);
-            free(p11name);
-            return 0;
+            ret = 0;
+            goto cleanup;
         }
         /* Look up a responder-supplied password for the token. */
         password = pkinit_find_deferred_id(cctx->deferred_ids, p11name);
-        free(p11name);
-        r = pkinit_login(context, cctx, &tinfo, password);
+        ret = pkinit_login(context, cctx, &tinfo, password);
+        if (ret)
+            goto cleanup;
     }
 
-    return r;
+    ret = 0;
+cleanup:
+    free(slotlist);
+    free(p11name);
+    return ret;
 }
 
 /*
@@ -3825,13 +3791,13 @@
     r = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, nattrs);
     if (r != CKR_OK) {
         pkiDebug("krb5_pkinit_sign_data: C_FindObjectsInit: %s\n",
-                 pkinit_pkcs11_code_to_text(r));
+                 pkcs11err(r));
         return KRB5KDC_ERR_PREAUTH_FAILED;
     }
 
     r = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session, objp, 1, &count);
     id_cryptoctx->p11->C_FindObjectsFinal(id_cryptoctx->session);
-    pkiDebug("found %d private keys (%s)\n", (int) count, pkinit_pkcs11_code_to_text(r));
+    pkiDebug("found %d private keys (%s)\n", (int)count, pkcs11err(r));
     if (r != CKR_OK || count < 1)
         return KRB5KDC_ERR_PREAUTH_FAILED;
     return 0;
@@ -3847,8 +3813,10 @@
     X509 *cert = sk_X509_value(id_cryptoctx->my_certs,
                                id_cryptoctx->cert_index);
     EVP_PKEY *pkey = id_cryptoctx->my_key;
-    uint8_t *buf;
-    int buf_len, decrypt_len;
+    EVP_PKEY_CTX *ctx = NULL;
+    uint8_t *buf = NULL;
+    size_t buf_len = 0;
+    int ok;
 
     *decoded_data = NULL;
     *decoded_data_len = 0;
@@ -3858,21 +3826,40 @@
         return KRB5KDC_ERR_PREAUTH_FAILED;
     }
 
-    buf_len = EVP_PKEY_size(pkey);
-    buf = malloc(buf_len + 10);
-    if (buf == NULL)
+    ctx = EVP_PKEY_CTX_new(pkey, NULL);
+    if (ctx == NULL)
         return KRB5KDC_ERR_PREAUTH_FAILED;
 
-    decrypt_len = EVP_PKEY_decrypt_old(buf, data, data_len, pkey);
-    if (decrypt_len <= 0) {
-        pkiDebug("unable to decrypt received data (len=%d)\n", data_len);
-        free(buf);
-        return KRB5KDC_ERR_PREAUTH_FAILED;
+    ok = EVP_PKEY_decrypt_init(ctx);
+    if (!ok)
+        goto cleanup;
+
+    /* Get the length of the eventual output. */
+    ok = EVP_PKEY_decrypt(ctx, NULL, &buf_len, data, data_len);
+    if (!ok) {
+        pkiDebug("unable to decrypt received data\n");
+        goto cleanup;
+    }
+
+    buf = malloc(buf_len);
+    if (buf == NULL) {
+        ok = 0;
+        goto cleanup;
+    }
+
+    ok = EVP_PKEY_decrypt(ctx, buf, &buf_len, data, data_len);
+    if (!ok) {
+        pkiDebug("unable to decrypt received data\n");
+        goto cleanup;
     }
 
     *decoded_data = buf;
-    *decoded_data_len = decrypt_len;
-    return 0;
+    *decoded_data_len = buf_len;
+    buf = NULL;
+cleanup:
+    zapfree(buf, buf_len);
+    EVP_PKEY_CTX_free(ctx);
+    return ok ? 0 : KRB5KDC_ERR_PREAUTH_FAILED;
 }
 
 #ifndef WITHOUT_PKCS11
@@ -3944,7 +3931,7 @@
     r = pkinit_C_Decrypt(id_cryptoctx, (CK_BYTE_PTR) data, (CK_ULONG) data_len,
                          cp, &len);
     if (r != CKR_OK) {
-        pkiDebug("C_Decrypt: %s\n", pkinit_pkcs11_code_to_text(r));
+        pkiDebug("C_Decrypt: %s\n", pkcs11err(r));
         if (r == CKR_BUFFER_TOO_SMALL)
             pkiDebug("decrypt %d needs %d\n", (int) data_len, (int) len);
         return KRB5KDC_ERR_PREAUTH_FAILED;
@@ -4024,7 +4011,7 @@
 
     if ((r = id_cryptoctx->p11->C_SignInit(id_cryptoctx->session, &mech,
                                            obj)) != CKR_OK) {
-        pkiDebug("C_SignInit: %s\n", pkinit_pkcs11_code_to_text(r));
+        pkiDebug("C_SignInit: %s\n", pkcs11err(r));
         return KRB5KDC_ERR_PREAUTH_FAILED;
     }
 
@@ -4047,7 +4034,7 @@
                                       (CK_ULONG) data_len, cp, &len);
     }
     if (r != CKR_OK) {
-        pkiDebug("C_Sign: %s\n", pkinit_pkcs11_code_to_text(r));
+        pkiDebug("C_Sign: %s\n", pkcs11err(r));
         return KRB5KDC_ERR_PREAUTH_FAILED;
     }
     pkiDebug("sign %d -> %d\n", (int) data_len, (int) len);
@@ -4094,7 +4081,7 @@
     ctx = EVP_MD_CTX_new();
     if (ctx == NULL)
         return ENOMEM;
-    EVP_SignInit(ctx, EVP_sha1());
+    EVP_SignInit(ctx, EVP_sha256());
     EVP_SignUpdate(ctx, data, data_len);
     *sig_len = EVP_PKEY_size(pkey);
     if ((*sig = malloc(*sig_len)) == NULL)
@@ -4500,6 +4487,89 @@
 }
 
 static krb5_error_code
+load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+              pkinit_identity_opts *idopts, pkinit_cred_info *cred_out)
+{
+    krb5_error_code ret;
+    CK_ATTRIBUTE attrs2;
+    CK_BYTE_PTR cert = NULL, cert_id = NULL;
+    CK_RV pret;
+    const unsigned char *cp;
+    CK_OBJECT_HANDLE obj;
+    CK_ULONG count;
+    X509 *x = NULL;
+    pkinit_cred_info cred;
+
+    *cred_out = NULL;
+
+    /* Look for X.509 cert. */
+    pret = p11->C_FindObjects(session, &obj, 1, &count);
+    if (pret != CKR_OK || count <= 0)
+        return 0;
+
+    /* Get cert and id len. */
+    attrs0.type = CKA_VALUE;
+    attrs0.pValue = NULL;
+    attrs0.ulValueLen = 0;
+    attrs1.type = CKA_ID;
+    attrs1.pValue = NULL;
+    attrs1.ulValueLen = 0;
+    pret = p11->C_GetAttributeValue(session, obj, attrs, 2);
+    if (pret != CKR_OK && pret != CKR_BUFFER_TOO_SMALL) {
+        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret));
+        ret = KRB5KDC_ERR_PREAUTH_FAILED;
+        goto cleanup;
+    }
+
+    /* Allocate buffers and read the cert and id. */
+    cert = k5alloc(attrs0.ulValueLen + 1, &ret);
+    if (cert == NULL)
+        goto cleanup;
+    cert_id = k5alloc(attrs1.ulValueLen + 1, &ret);
+    if (cert_id == NULL)
+        goto cleanup;
+    attrs0.type = CKA_VALUE;
+    attrs0.pValue = cert;
+    attrs1.type = CKA_ID;
+    attrs1.pValue = cert_id;
+    pret = p11->C_GetAttributeValue(session, obj, attrs, 2);
+    if (pret != CKR_OK) {
+        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret));
+        ret = KRB5KDC_ERR_PREAUTH_FAILED;
+        goto cleanup;
+    }
+
+    pkiDebug("cert: size %d, id %d, idlen %d\n", (int)attrs0.ulValueLen,
+             (int)cert_id0, (int)attrs1.ulValueLen);
+
+    cp = (unsigned char *)cert;
+    x = d2i_X509(NULL, &cp, (int)attrs0.ulValueLen);
+    if (x == NULL) {
+        ret = KRB5KDC_ERR_PREAUTH_FAILED;
+        goto cleanup;
+    }
+
+    cred = k5alloc(sizeof(struct _pkinit_cred_info), &ret);
+    if (cred == NULL)
+        goto cleanup;
+
+    cred->name = reassemble_pkcs11_name(idopts);
+    cred->cert = x;
+    cred->key = NULL;
+    cred->cert_id = cert_id;
+    cred->cert_id_len = attrs1.ulValueLen;
+
+    *cred_out = cred;
+    cert_id = NULL;
+    ret = 0;
+
+cleanup:
+    free(cert);
+    free(cert_id);
+    return ret;
+}
+
+static krb5_error_code
 pkinit_get_certs_pkcs11(krb5_context context,
                         pkinit_plg_crypto_context plg_cryptoctx,
                         pkinit_req_crypto_context req_cryptoctx,
@@ -4507,20 +4577,13 @@
                         pkinit_identity_crypto_context id_cryptoctx,
                         krb5_principal princ)
 {
-#ifdef PKINIT_USE_MECH_LIST
-    CK_MECHANISM_TYPE_PTR mechp;
-    CK_MECHANISM_INFO info;
-#endif
     CK_OBJECT_CLASS cls;
-    CK_OBJECT_HANDLE obj;
     CK_ATTRIBUTE attrs4;
-    CK_ULONG count;
     CK_CERTIFICATE_TYPE certtype;
-    CK_BYTE_PTR cert = NULL, cert_id;
-    const unsigned char *cp;
-    int i, r;
+    int i;
     unsigned int nattrs;
-    X509 *x = NULL;
+    krb5_error_code ret;
+    CK_RV pret;
 
     /* Copy stuff from idopts -> id_cryptoctx */
     if (idopts->p11_module_name != NULL) {
@@ -4541,20 +4604,20 @@
     }
     /* Convert the ascii cert_id string into a binary blob */
     if (idopts->cert_id_string != NULL) {
-        r = k5_hex_decode(idopts->cert_id_string,
-                          &id_cryptoctx->cert_id, &id_cryptoctx->cert_id_len);
-        if (r != 0) {
+        ret = k5_hex_decode(idopts->cert_id_string, &id_cryptoctx->cert_id,
+                            &id_cryptoctx->cert_id_len);
+        if (ret) {
             pkiDebug("Failed to convert certid string %s\n",
                      idopts->cert_id_string);
-            return r;
+            return ret;
         }
     }
     id_cryptoctx->slotid = idopts->slotid;
     id_cryptoctx->pkcs11_method = 1;
 
-    r = pkinit_open_session(context, id_cryptoctx);
-    if (r != 0)
-        return r;
+    ret = pkinit_open_session(context, id_cryptoctx);
+    if (ret)
+        return ret;
     if (id_cryptoctx->defer_id_prompt) {
         /*
          * We need to reset all of the PKCS#11 state, so that the next time we
@@ -4566,56 +4629,24 @@
         return 0;
     }
 
-#ifndef PKINIT_USE_MECH_LIST
     /*
-     * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but
-     * many cards seems to be confused about whether they are capable of
-     * this or not. The safe thing seems to be to ignore the mechanism list,
-     * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves.
+     * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but
+     * historically many cards seem to be confused about whether they are
+     * capable of mechanisms or not. The safe thing seems to be to ignore the
+     * mechanism list, always use CKM_RSA_PKCS and calculate the sha256 digest
+     * ourselves.
      */
-
     id_cryptoctx->mech = CKM_RSA_PKCS;
-#else
-    if ((r = id_cryptoctx->p11->C_GetMechanismList(id_cryptoctx->slotid, NULL,
-                                                   &count)) != CKR_OK || count <= 0) {
-        pkiDebug("C_GetMechanismList: %s\n", pkinit_pkcs11_code_to_text(r));
-        return KRB5KDC_ERR_PREAUTH_FAILED;
-    }
-    mechp = malloc(count * sizeof (CK_MECHANISM_TYPE));
-    if (mechp == NULL)
-        return ENOMEM;
-    if ((r = id_cryptoctx->p11->C_GetMechanismList(id_cryptoctx->slotid,
-                                                   mechp, &count)) != CKR_OK)
-        return KRB5KDC_ERR_PREAUTH_FAILED;
-    for (i = 0; i < count; i++) {
-        if ((r = id_cryptoctx->p11->C_GetMechanismInfo(id_cryptoctx->slotid,
-                                                       mechpi, &info)) != CKR_OK)
-            return KRB5KDC_ERR_PREAUTH_FAILED;
-#ifdef DEBUG_MECHINFO
-        pkiDebug("mech %x flags %x\n", (int) mechpi, (int) info.flags);
-        if ((info.flags & (CKF_SIGN|CKF_DECRYPT)) == (CKF_SIGN|CKF_DECRYPT))
-            pkiDebug("  this mech is good for sign & decrypt\n");
-#endif
-        if (mechpi == CKM_RSA_PKCS) {
-            /* This seems backwards... */
-            id_cryptoctx->mech =
-                (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS;
-        }
-    }
-    free(mechp);
-
-    pkiDebug("got %d mechs from card\n", (int) count);
-#endif
 
     cls = CKO_CERTIFICATE;
     attrs0.type = CKA_CLASS;
     attrs0.pValue = &cls;
-    attrs0.ulValueLen = sizeof cls;
+    attrs0.ulValueLen = sizeof(cls);
 
     certtype = CKC_X_509;
     attrs1.type = CKA_CERTIFICATE_TYPE;
     attrs1.pValue = &certtype;
-    attrs1.ulValueLen = sizeof certtype;
+    attrs1.ulValueLen = sizeof(certtype);
 
     nattrs = 2;
 
@@ -4633,80 +4664,33 @@
         nattrs++;
     }
 
-    r = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, nattrs);
-    if (r != CKR_OK) {
-        pkiDebug("C_FindObjectsInit: %s\n", pkinit_pkcs11_code_to_text(r));
+    pret = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs,
+                                                nattrs);
+    if (pret != CKR_OK) {
+        pkiDebug("C_FindObjectsInit: %s\n", pkcs11err(pret));
         return KRB5KDC_ERR_PREAUTH_FAILED;
     }
 
-    for (i = 0; ; i++) {
-        if (i >= MAX_CREDS_ALLOWED)
-            return KRB5KDC_ERR_PREAUTH_FAILED;
-
-        /* Look for x.509 cert */
-        if ((r = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session,
-                                                  &obj, 1, &count)) != CKR_OK || count <= 0) {
-            id_cryptoctx->credsi = NULL;
-            break;
-        }
-
-        /* Get cert and id len */
-        attrs0.type = CKA_VALUE;
-        attrs0.pValue = NULL;
-        attrs0.ulValueLen = 0;
-
-        attrs1.type = CKA_ID;
-        attrs1.pValue = NULL;
-        attrs1.ulValueLen = 0;
-
-        if ((r = id_cryptoctx->p11->C_GetAttributeValue(id_cryptoctx->session,
-                                                        obj, attrs, 2)) != CKR_OK && r != CKR_BUFFER_TOO_SMALL) {
-            pkiDebug("C_GetAttributeValue: %s\n", pkinit_pkcs11_code_to_text(r));
-            return KRB5KDC_ERR_PREAUTH_FAILED;
-        }
-        cert = (CK_BYTE_PTR) malloc((size_t) attrs0.ulValueLen + 1);
-        cert_id = (CK_BYTE_PTR) malloc((size_t) attrs1.ulValueLen + 1);
-        if (cert == NULL || cert_id == NULL)
-            return ENOMEM;
-
-        /* Read the cert and id off the card */
-
-        attrs0.type = CKA_VALUE;
-        attrs0.pValue = cert;
-
-        attrs1.type = CKA_ID;
-        attrs1.pValue = cert_id;
-
-        if ((r = id_cryptoctx->p11->C_GetAttributeValue(id_cryptoctx->session,
-                                                        obj, attrs, 2)) != CKR_OK) {
-            pkiDebug("C_GetAttributeValue: %s\n", pkinit_pkcs11_code_to_text(r));
-            return KRB5KDC_ERR_PREAUTH_FAILED;
-        }
-
-        pkiDebug("cert %d size %d id %d idlen %d\n", i,
-                 (int) attrs0.ulValueLen, (int) cert_id0,
-                 (int) attrs1.ulValueLen);
-
-        cp = (unsigned char *) cert;
-        x = d2i_X509(NULL, &cp, (int) attrs0.ulValueLen);
-        if (x == NULL)
-            return KRB5KDC_ERR_PREAUTH_FAILED;
-        id_cryptoctx->credsi = malloc(sizeof(struct _pkinit_cred_info));
+    for (i = 0; i < MAX_CREDS_ALLOWED; i++) {
+        ret = load_one_cert(id_cryptoctx->p11, id_cryptoctx->session, idopts,
+                            &id_cryptoctx->credsi);
+        if (ret)
+            return ret;
         if (id_cryptoctx->credsi == NULL)
-            return KRB5KDC_ERR_PREAUTH_FAILED;
-        id_cryptoctx->credsi->name = reassemble_pkcs11_name(idopts);
-        id_cryptoctx->credsi->cert = x;
-        id_cryptoctx->credsi->key = NULL;
-        id_cryptoctx->credsi->cert_id = cert_id;
-        id_cryptoctx->credsi->cert_id_len = attrs1.ulValueLen;
-        free(cert);
+            break;
     }
+    if (i == MAX_CREDS_ALLOWED)
+        return KRB5KDC_ERR_PREAUTH_FAILED;
+
     id_cryptoctx->p11->C_FindObjectsFinal(id_cryptoctx->session);
-    if (cert == NULL)
+
+    /* Check if we found no certs. */
+    if (id_cryptoctx->creds0 == NULL)
         return KRB5KDC_ERR_PREAUTH_FAILED;
     return 0;
 }
-#endif
+
+#endif /* !WITHOUT_PKCS11 */
 
 
 static void
@@ -5348,12 +5332,12 @@
 {
     switch (idtype) {
     case IDTYPE_FILE:
-        TRACE_PKINIT_LOAD_FROM_FILE(context);
+        TRACE_PKINIT_LOAD_FROM_FILE(context, id);
         return load_cas_and_crls(context, plg_cryptoctx, req_cryptoctx,
                                  id_cryptoctx, catype, id);
         break;
     case IDTYPE_DIR:
-        TRACE_PKINIT_LOAD_FROM_DIR(context);
+        TRACE_PKINIT_LOAD_FROM_DIR(context, id);
         return load_cas_and_crls_dir(context, plg_cryptoctx, req_cryptoctx,
                                      id_cryptoctx, catype, id);
         break;
@@ -5784,19 +5768,18 @@
 }
 #endif
 
-static char *
-pkinit_pkcs11_code_to_text(int err)
+static const char *
+pkcs11err(int err)
 {
     int i;
-    static char uc32;
 
     for (i = 0; pkcs11_errstringsi.text != NULL; i++)
         if (pkcs11_errstringsi.code == err)
             break;
     if (pkcs11_errstringsi.text != NULL)
         return (pkcs11_errstringsi.text);
-    snprintf(uc, sizeof(uc), _("unknown code 0x%x"), err);
-    return (uc);
+
+    return "unknown PKCS11 error";
 }
 
 /*

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h Changed

@@ -45,11 +45,10 @@
 #include <openssl/sha.h>
 #include <openssl/asn1.h>
 #include <openssl/pem.h>
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
 #include <openssl/asn1t.h>
-#else
-#include <openssl/asn1_mac.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#include <openssl/decoder.h>
 #endif
 
 #define DN_BUF_LEN  256
@@ -84,7 +83,7 @@
     char *token_label;
     char *cert_label;
     /* These are crypto-specific */
-    void *p11_module;
+    struct plugin_file_handle *p11_module;
     CK_SESSION_HANDLE session;
     CK_FUNCTION_LIST_PTR p11;
     uint8_t *cert_id;
@@ -96,9 +95,9 @@
 };
 
 struct _pkinit_plg_crypto_context {
-    DH *dh_1024;
-    DH *dh_2048;
-    DH *dh_4096;
+    EVP_PKEY *dh_1024;
+    EVP_PKEY *dh_2048;
+    EVP_PKEY *dh_4096;
     ASN1_OBJECT *id_pkinit_authData;
     ASN1_OBJECT *id_pkinit_DHKeyData;
     ASN1_OBJECT *id_pkinit_rkeyData;
@@ -112,7 +111,8 @@
 
 struct _pkinit_req_crypto_context {
     X509 *received_cert;
-    DH *dh;
+    EVP_PKEY *client_pkey;
+    EVP_PKEY *received_params;
 };
 
 #endif	/* _PKINIT_CRYPTO_OPENSSL_H */

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_identity.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_identity.c Changed

@@ -30,7 +30,6 @@
  */
 
 #include "pkinit.h"
-#include <dlfcn.h>
 #include <dirent.h>
 
 static void
@@ -311,17 +310,17 @@
                  const char *residual)
 {
     char *certname, *keyname, *save;
-    char *cert_filename = NULL, *key_filename = NULL;
+    char *copy = NULL, *cert_filename = NULL, *key_filename = NULL;
     krb5_error_code retval = ENOMEM;
 
     if (residual == NULL || residual0 == '\0' || residual0 == ',')
         return EINVAL;
 
-    certname = strdup(residual);
-    if (certname == NULL)
+    copy = strdup(residual);
+    if (copy == NULL)
         goto cleanup;
 
-    certname = strtok_r(certname, ",", &save);
+    certname = strtok_r(copy, ",", &save);
     if (certname == NULL)
         goto cleanup;
     keyname = strtok_r(NULL, ",", &save);
@@ -334,13 +333,15 @@
     if (key_filename == NULL)
         goto cleanup;
 
+    free(idopts->cert_filename);
+    free(idopts->key_filename);
     idopts->cert_filename = cert_filename;
     idopts->key_filename = key_filename;
     cert_filename = key_filename = NULL;
     retval = 0;
 
 cleanup:
-    free(certname);
+    free(copy);
     free(cert_filename);
     free(key_filename);
     return retval;
@@ -356,10 +357,12 @@
     if (residual == NULL || residual0 == '\0')
         return 0;
 
+    free(idopts->cert_filename);
     idopts->cert_filename = strdup(residual);
     if (idopts->cert_filename == NULL)
         goto cleanup;
 
+    free(idopts->key_filename);
     idopts->key_filename = strdup(residual);
     if (idopts->key_filename == NULL)
         goto cleanup;
@@ -384,8 +387,7 @@
     int idtype;
     krb5_error_code retval = 0;
 
-    pkiDebug("%s: processing value '%s'\n",
-             __FUNCTION__, value ? value : "NULL");
+    TRACE_PKINIT_IDENTITY_OPTION(context, value);
     if (value == NULL)
         return EINVAL;
 
@@ -439,6 +441,7 @@
         break;
 #endif
     case IDTYPE_DIR:
+        free(idopts->cert_filename);
         idopts->cert_filename = strdup(residual);
         if (idopts->cert_filename == NULL)
             retval = ENOMEM;
@@ -576,8 +579,9 @@
                        int do_matching,
                        krb5_principal princ)
 {
-    krb5_error_code retval = EINVAL;
+    krb5_error_code retval = 0;
     const char *signer_identity;
+    krb5_boolean valid;
     int i;
 
     pkiDebug("%s: %p %p %p\n", __FUNCTION__, context, idopts, id_cryptoctx);
@@ -630,22 +634,36 @@
             goto errout;
     } /* Not anonymous principal */
 
+    /* Require at least one successful anchor if any are specified. */
+    valid = FALSE;
     for (i = 0; idopts->anchors != NULL && idopts->anchorsi != NULL; i++) {
         retval = process_option_ca_crl(context, plg_cryptoctx, req_cryptoctx,
                                        idopts, id_cryptoctx,
                                        idopts->anchorsi, CATYPE_ANCHORS);
-        if (retval)
-            goto errout;
+        if (!retval)
+            valid = TRUE;
     }
+    if (retval && !valid)
+        goto errout;
+    krb5_clear_error_message(context);
+    retval = 0;
+
+    /* Require at least one successful intermediate if any are specified. */
+    valid = FALSE;
     for (i = 0; idopts->intermediates != NULL
              && idopts->intermediatesi != NULL; i++) {
         retval = process_option_ca_crl(context, plg_cryptoctx, req_cryptoctx,
                                        idopts, id_cryptoctx,
                                        idopts->intermediatesi,
                                        CATYPE_INTERMEDIATES);
-        if (retval)
-            goto errout;
+        if (!retval)
+            valid = TRUE;
     }
+    if (retval && !valid)
+        goto errout;
+    krb5_clear_error_message(context);
+    retval = 0;
+
     for (i = 0; idopts->crls != NULL && idopts->crlsi != NULL; i++) {
         retval = process_option_ca_crl(context, plg_cryptoctx, req_cryptoctx,
                                        idopts, id_cryptoctx, idopts->crlsi,

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_kdf_test.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_kdf_test.c Changed

@@ -112,6 +112,10 @@
         goto cleanup;
     }
 
+    /* The test vectors in RFC 8636 implicitly use NT-PRINCIPAL names. */
+    u_principal->type = KRB5_NT_PRINCIPAL;
+    v_principal->type = KRB5_NT_PRINCIPAL;
+
     /* set-up the as_req and and pk_as_rep data */
     memset(twenty_as, 0xaa, sizeof(twenty_as));
     memset(eighteen_bs, 0xbb, sizeof(eighteen_bs));
@@ -123,8 +127,7 @@
 
     /* TEST 1:  SHA-1/AES */
     /* set up algorithm id */
-    alg_id.algorithm.data = (char *)krb5_pkinit_sha1_oid;
-    alg_id.algorithm.length = krb5_pkinit_sha1_oid_len;
+    alg_id.algorithm = sha1_id;
 
     enctype = enctype_aes;
 
@@ -134,7 +137,7 @@
                                               u_principal, v_principal,
                                               enctype, &as_req, &pk_as_rep,
                                               &key_block))) {
-        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d",
+        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d\n",
                retval);
         goto cleanup;
     }
@@ -155,8 +158,7 @@
 
     /* TEST 2: SHA-256/AES */
     /* set up algorithm id */
-    alg_id.algorithm.data = (char *)krb5_pkinit_sha256_oid;
-    alg_id.algorithm.length = krb5_pkinit_sha256_oid_len;
+    alg_id.algorithm = sha256_id;
 
     enctype = enctype_aes;
 
@@ -166,7 +168,7 @@
                                               u_principal, v_principal,
                                               enctype, &as_req, &pk_as_rep,
                                               &key_block))) {
-        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d",
+        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d\n",
                retval);
         goto cleanup;
     }
@@ -187,8 +189,7 @@
 
     /* TEST 3: SHA-512/DES3 */
     /* set up algorithm id */
-    alg_id.algorithm.data = (char *)krb5_pkinit_sha512_oid;
-    alg_id.algorithm.length = krb5_pkinit_sha512_oid_len;
+    alg_id.algorithm = sha512_id;
 
     enctype = enctype_des3;
 
@@ -198,7 +199,7 @@
                                               u_principal, v_principal,
                                               enctype, &as_req, &pk_as_rep,
                                               &key_block))) {
-        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d",
+        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d\n",
                retval);
         goto cleanup;
     }
@@ -221,5 +222,6 @@
     krb5_free_principal(context, u_principal);
     krb5_free_principal(context, v_principal);
     krb5_free_keyblock_contents(context, &key_block);
-    exit(retval);
+    krb5_free_context(context);
+    return retval ? 1 : 0;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_lib.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_lib.c Changed

@@ -123,12 +123,7 @@
 free_krb5_auth_pack(krb5_auth_pack **in)
 {
     if ((*in) == NULL) return;
-    if ((*in)->clientPublicValue != NULL) {
-        free((*in)->clientPublicValue->algorithm.algorithm.data);
-        free((*in)->clientPublicValue->algorithm.parameters.data);
-        free((*in)->clientPublicValue->subjectPublicKey.data);
-        free((*in)->clientPublicValue);
-    }
+    krb5_free_data_contents(NULL, &(*in)->clientPublicValue);
     free((*in)->pkAuthenticator.paChecksum.contents);
     krb5_free_data(NULL, (*in)->pkAuthenticator.freshnessToken);
     if ((*in)->supportedCMSTypes != NULL)
@@ -199,15 +194,6 @@
 }
 
 void
-free_krb5_subject_pk_info(krb5_subject_pk_info **in)
-{
-    if ((*in) == NULL) return;
-    free((*in)->algorithm.parameters.data);
-    free((*in)->subjectPublicKey.data);
-    free(*in);
-}
-
-void
 free_krb5_kdc_dh_key_info(krb5_kdc_dh_key_info **in)
 {
     if (*in == NULL) return;
@@ -252,17 +238,6 @@
     (*in)->u.dh_Info.kdfID = NULL;
 }
 
-void
-init_krb5_subject_pk_info(krb5_subject_pk_info **in)
-{
-    (*in) = malloc(sizeof(krb5_subject_pk_info));
-    if ((*in) == NULL) return;
-    (*in)->algorithm.parameters.data = NULL;
-    (*in)->algorithm.parameters.length = 0;
-    (*in)->subjectPublicKey.data = NULL;
-    (*in)->subjectPublicKey.length = 0;
-}
-
 krb5_error_code
 pkinit_copy_krb5_data(krb5_data *dst, const krb5_data *src)
 {

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_matching.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_matching.c Changed

@@ -448,25 +448,26 @@
 }
 
 static int
-regexp_match(krb5_context context, rule_component *rc, char *value)
+regexp_match(krb5_context context, rule_component *rc, char *value, int idx)
 {
     int code;
 
-    pkiDebug("%s: checking %s rule '%s' with value '%s'\n",
-             __FUNCTION__, keyword2string(rc->kw_type), rc->regsrc, value);
-
     code = regexec(&rc->regexp, value, 0, NULL, 0);
 
-    pkiDebug("%s: the result is%s a match\n", __FUNCTION__,
-             code == REG_NOMATCH ? " NOT" : "");
+    if (code == 0) {
+        TRACE_PKINIT_REGEXP_MATCH(context, keyword2string(rc->kw_type),
+                                  rc->regsrc, value, idx);
+    } else {
+        TRACE_PKINIT_REGEXP_NOMATCH(context, keyword2string(rc->kw_type),
+                                    rc->regsrc, value, idx);
+    }
 
     return (code == 0 ? 1: 0);
 }
 
 static int
-component_match(krb5_context context,
-                rule_component *rc,
-                pkinit_cert_matching_data *md)
+component_match(krb5_context context, rule_component *rc,
+                pkinit_cert_matching_data *md, int idx)
 {
     int match = 0;
     int i;
@@ -476,21 +477,21 @@
     case kwvaltype_regexp:
         switch (rc->kw_type) {
         case kw_subject:
-            match = regexp_match(context, rc, md->subject_dn);
+            match = regexp_match(context, rc, md->subject_dn, idx);
             break;
         case kw_issuer:
-            match = regexp_match(context, rc, md->issuer_dn);
+            match = regexp_match(context, rc, md->issuer_dn, idx);
             break;
         case kw_san:
             for (i = 0; md->sans != NULL && md->sansi != NULL; i++) {
                 krb5_unparse_name(context, md->sansi, &princ_string);
-                match = regexp_match(context, rc, princ_string);
+                match = regexp_match(context, rc, princ_string, idx);
                 krb5_free_unparsed_name(context, princ_string);
                 if (match)
                     break;
             }
             for (i = 0; md->upns != NULL && md->upnsi != NULL; i++) {
-                match = regexp_match(context, rc, md->upnsi);
+                match = regexp_match(context, rc, md->upnsi, idx);
                 if (match)
                     break;
             }
@@ -574,7 +575,7 @@
         pkiDebug("%s: subject: '%s'\n", __FUNCTION__, md->subject_dn);
         certs_checked++;
         for (rc = rs->crs; rc != NULL; rc = rc->next) {
-            comp_match = component_match(context, rc, md);
+            comp_match = component_match(context, rc, md, i);
             if (comp_match) {
                 pkiDebug("%s: match for keyword type %s\n",
                          __FUNCTION__, keyword2string(rc->kw_type));
@@ -600,8 +601,7 @@
     nextcert:
         continue;
     }
-    pkiDebug("%s: After checking %d certs, we found %d matches\n",
-             __FUNCTION__, certs_checked, total_cert_matches);
+    TRACE_PKINIT_CERT_NUM_MATCHING(context, certs_checked, total_cert_matches);
     if (total_cert_matches == 1) {
         *match_found = 1;
         *match_index = save_index;
@@ -642,7 +642,7 @@
 
     /* parse each rule line one at a time and check all the certs against it */
     for (x = 0; rulesx != NULL; x++) {
-        pkiDebug("%s: Processing rule '%s'\n", __FUNCTION__, rulesx);
+        TRACE_PKINIT_CERT_RULE(context, rulesx);
 
         /* Free rules from previous time through... */
         if (rs != NULL) {
@@ -652,8 +652,7 @@
         retval = parse_rule_set(context, rulesx, &rs);
         if (retval) {
             if (retval == EINVAL) {
-                pkiDebug("%s: Ignoring invalid rule pkinit_cert_match = '%s'\n",
-                         __FUNCTION__, rulesx);
+                TRACE_PKINIT_CERT_RULE_INVALID(context, rulesx);
                 continue;
             }
             goto cleanup;
@@ -737,7 +736,7 @@
         goto cleanup;
 
     for (rc = rs->crs; rc != NULL; rc = rc->next) {
-        comp_match = component_match(context, rc, md);
+        comp_match = component_match(context, rc, md, 0);
         if ((comp_match && rs->relation == relation_or) ||
             (!comp_match && rs->relation == relation_and)) {
             break;

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_srv.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_srv.c Changed

@@ -349,8 +349,8 @@
      * Check the certificate against each certauth module.  For the certificate
      * to be authorized at least one module must return 0 or
      * KRB5_CERTAUTH_HWAUTH, and no module can return an error code other than
-     * KRB5_PLUGIN_NO_HANDLE (pass).  Add indicators from modules that return 0
-     * or pass.
+     * KRB5_PLUGIN_NO_HANDLE (pass) or KRB5_CERTAUTH_HWAUTH_PASS (pass but
+     * set hw-authent).  Add indicators from all modules.
      */
     ret = KRB5_PLUGIN_NO_HANDLE;
     for (i = 0; certauth_modules != NULL && certauth_modulesi != NULL; i++) {
@@ -362,6 +362,8 @@
             accepted = TRUE;
         else if (ret == KRB5_CERTAUTH_HWAUTH)
             accepted = hwauth = TRUE;
+        else if (ret == KRB5_CERTAUTH_HWAUTH_PASS)
+            hwauth = TRUE;
         else if (ret != KRB5_PLUGIN_NO_HANDLE)
             goto cleanup;
 
@@ -528,10 +530,10 @@
         goto cleanup;
 
     /* check dh parameters */
-    if (auth_pack->clientPublicValue != NULL) {
+    if (auth_pack->clientPublicValue.length > 0) {
         retval = server_check_dh(context, plgctx->cryptoctx,
                                  reqctx->cryptoctx, plgctx->idctx,
-                                 &auth_pack->clientPublicValue->algorithm.parameters,
+                                 &auth_pack->clientPublicValue,
                                  plgctx->opts->dh_min_bits);
         if (retval) {
             pkiDebug("bad dh parameters\n");
@@ -546,8 +548,8 @@
         goto cleanup;
     }
     der_req = cb->request_body(context, rock);
-    retval = krb5_c_make_checksum(context, CKSUMTYPE_NIST_SHA, NULL, 0,
-                                  der_req, &cksum);
+    retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req,
+                                  &cksum);
     if (retval) {
         pkiDebug("unable to calculate AS REQ checksum\n");
         goto cleanup;
@@ -759,10 +761,9 @@
     krb5_pa_pk_as_req *reqp = NULL;
     int i = 0;
 
-    unsigned char *subjectPublicKey = NULL;
     unsigned char *dh_pubkey = NULL, *server_key = NULL;
-    unsigned int subjectPublicKey_len = 0;
     unsigned int server_key_len = 0, dh_pubkey_len = 0;
+    krb5_keyblock reply_key = { 0 };
 
     krb5_kdc_dh_key_info dhkey_info;
     krb5_data *encoded_dhkey_info = NULL;
@@ -800,12 +801,6 @@
     TRACE_PKINIT_SERVER_RETURN_PADATA(context);
     reqctx = (pkinit_kdc_req_context)modreq;
 
-    if (encrypting_key->contents) {
-        free(encrypting_key->contents);
-        encrypting_key->length = 0;
-        encrypting_key->contents = NULL;
-    }
-
     for(i = 0; i < request->nktypes; i++) {
         enctype = request->ktypei;
         if (!krb5_c_valid_enctype(enctype))
@@ -830,17 +825,13 @@
     rep->choice = choice_pa_pk_as_rep_encKeyPack;
 
     if (reqctx->rcv_auth_pack != NULL &&
-        reqctx->rcv_auth_pack->clientPublicValue != NULL) {
-        subjectPublicKey = (unsigned char *)
-            reqctx->rcv_auth_pack->clientPublicValue->subjectPublicKey.data;
-        subjectPublicKey_len =
-            reqctx->rcv_auth_pack->clientPublicValue->subjectPublicKey.length;
+        reqctx->rcv_auth_pack->clientPublicValue.length > 0) {
         rep->choice = choice_pa_pk_as_rep_dhInfo;
 
         pkiDebug("received DH key delivery AS REQ\n");
         retval = server_process_dh(context, plgctx->cryptoctx,
-                                   reqctx->cryptoctx, plgctx->idctx, subjectPublicKey,
-                                   subjectPublicKey_len, &dh_pubkey, &dh_pubkey_len,
+                                   reqctx->cryptoctx, plgctx->idctx,
+                                   &dh_pubkey, &dh_pubkey_len,
                                    &server_key, &server_key_len);
         if (retval) {
             pkiDebug("failed to process/create dh parameters\n");
@@ -887,19 +878,19 @@
     } else {
         pkiDebug("received RSA key delivery AS REQ\n");
 
-        retval = krb5_c_make_random_key(context, enctype, encrypting_key);
-        if (retval) {
-            pkiDebug("unable to make a session key\n");
-            goto cleanup;
-        }
-
         init_krb5_reply_key_pack(&key_pack);
         if (key_pack == NULL) {
             retval = ENOMEM;
             goto cleanup;
         }
 
-        retval = krb5_c_make_checksum(context, 0, encrypting_key,
+        retval = krb5_c_make_random_key(context, enctype, &key_pack->replyKey);
+        if (retval) {
+            pkiDebug("unable to make a session key\n");
+            goto cleanup;
+        }
+
+        retval = krb5_c_make_checksum(context, 0, &key_pack->replyKey,
                                       KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM,
                                       req_pkt, &key_pack->asChecksum);
         if (retval) {
@@ -912,13 +903,10 @@
         pkiDebug("checksum size = %d\n", key_pack->asChecksum.length);
         print_buffer(key_pack->asChecksum.contents,
                      key_pack->asChecksum.length);
-        pkiDebug("encrypting key (%d)\n", encrypting_key->length);
-        print_buffer(encrypting_key->contents, encrypting_key->length);
+        pkiDebug("encrypting key (%d)\n", key_pack->replyKey.length);
+        print_buffer(key_pack->replyKey.contents, key_pack->replyKey.length);
 #endif
 
-        krb5_copy_keyblock_contents(context, encrypting_key,
-                                    &key_pack->replyKey);
-
         retval = k5int_encode_krb5_reply_key_pack(key_pack,
                                                   &encoded_key_pack);
         if (retval) {
@@ -948,6 +936,11 @@
         print_buffer_bin(rep->u.encKeyPack.data, rep->u.encKeyPack.length,
                          "/tmp/kdc_enc_key_pack");
 #endif
+
+        retval = cb->replace_reply_key(context, rock, &key_pack->replyKey,
+                                       FALSE);
+        if (retval)
+            goto cleanup;
     }
 
     if (rep->choice == choice_pa_pk_as_rep_dhInfo &&
@@ -993,7 +986,7 @@
                                             rep->u.dh_Info.kdfID,
                                             request->client, request->server,
                                             enctype, req_pkt, out_data,
-                                            encrypting_key);
+                                            &reply_key);
             if (retval) {
                 pkiDebug("pkinit_alg_agility_kdf failed: %s\n",
                          error_message(retval));
@@ -1003,13 +996,16 @@
             /* Otherwise, use the older octetstring2key() function */
         } else {
             retval = pkinit_octetstring2key(context, enctype, server_key,
-                                            server_key_len, encrypting_key);
+                                            server_key_len, &reply_key);
             if (retval) {
                 pkiDebug("pkinit_octetstring2key failed: %s\n",
                          error_message(retval));
                 goto cleanup;
             }
         }
+        retval = cb->replace_reply_key(context, rock, &reply_key, FALSE);
+        if (retval)
+            goto cleanup;
     }
 
     *send_pa = malloc(sizeof(krb5_pa_data));
@@ -1026,7 +1022,6 @@
     (*send_pa)->contents = (krb5_octet *) out_data->data;
 
 cleanup:
-    pkinit_fini_kdc_req_context(context, reqctx);
     free(scratch.data);
     free(out_data);
     if (encoded_dhkey_info != NULL)
@@ -1038,6 +1033,7 @@
     free_krb5_pa_pk_as_req(&reqp);
     free_krb5_pa_pk_as_rep(&rep);
     free_krb5_reply_key_pack(&key_pack);
+    krb5_free_keyblock_contents(context, &reply_key);
 
     if (retval)
         pkiDebug("pkinit_verify_padata failure");
@@ -1615,6 +1611,13 @@
     free(reqctx);
 }
 
+static void
+pkinit_free_modreq(krb5_context context, krb5_kdcpreauth_moddata moddata,
+                   krb5_kdcpreauth_modreq modreq)
+{
+    pkinit_fini_kdc_req_context(context, modreq);
+}
+
 krb5_error_code
 kdcpreauth_pkinit_initvt(krb5_context context, int maj_ver, int min_ver,
                          krb5_plugin_vtable vtable);
@@ -1636,5 +1639,6 @@
     vt->edata = pkinit_server_get_edata;
     vt->verify = pkinit_server_verify_padata;
     vt->return_padata = pkinit_server_return_padata;
+    vt->free_modreq = pkinit_free_modreq;
     return 0;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/pkinit/pkinit_trace.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/pkinit/pkinit_trace.h Changed

@@ -93,6 +93,25 @@
 #define TRACE_PKINIT_OPENSSL_ERROR(c, msg)              \
     TRACE(c, "PKINIT OpenSSL error: {str}", msg)
 
+#define TRACE_PKINIT_PKCS11_GETFLIST_FAILED(c, errstr)                  \
+    TRACE(c, "PKINIT PKCS11 C_GetFunctionList failed: {str}", errstr)
+#define TRACE_PKINIT_PKCS11_GETSYM_FAILED(c, errstr)                    \
+    TRACE(c, "PKINIT unable to find PKCS11 plugin symbol "              \
+          "C_GetFunctionList: {str}", errstr)
+#define TRACE_PKINIT_PKCS11_LOGIN_FAILED(c, errstr)             \
+    TRACE(c, "PKINIT PKCS11 C_Login failed: {str}", errstr)
+#define TRACE_PKINIT_PKCS11_NO_MATCH_TOKEN(c)                   \
+    TRACE(c, "PKINIT PKCS#11 module has no matching tokens")
+#define TRACE_PKINIT_PKCS11_NO_TOKEN(c)                                 \
+    TRACE(c, "PKINIT PKCS#11 module shows no slots with tokens")
+#define TRACE_PKINIT_PKCS11_OPEN(c, name)                       \
+    TRACE(c, "PKINIT opening PKCS#11 module \"{str}\"", name)
+#define TRACE_PKINIT_PKCS11_OPEN_FAILED(c, errstr)                      \
+    TRACE(c, "PKINIT PKCS#11 module open failed: {str}", errstr)
+#define TRACE_PKINIT_PKCS11_SLOT(c, slot, len, label)            \
+    TRACE(c, "PKINIT PKCS#11 slotid {int} token {lenstr}",       \
+          slot, len, label)
+
 #define TRACE_PKINIT_SERVER_CERT_AUTH(c, modname)                       \
     TRACE(c, "PKINIT server authorizing cert with module {str}",        \
           modname)
@@ -123,16 +142,28 @@
     TRACE(c, "PKINIT server could not parse UPN \"{str}\": {kerr}",     \
           upn, ret)
 
+#define TRACE_PKINIT_CERT_CHAIN_NAME(c, index, name)    \
+    TRACE(c, "PKINIT chain cert #{int}: {str}", index, name)
+#define TRACE_PKINIT_CERT_NUM_MATCHING(c, total, nummatch)              \
+    TRACE(c, "PKINIT client checked {int} certs, found {int} matches",  \
+          total, nummatch)
+#define TRACE_PKINIT_CERT_RULE(c, rule)                                 \
+    TRACE(c, "PKINIT client matching rule '{str}' against certificates", rule)
+#define TRACE_PKINIT_CERT_RULE_INVALID(c, rule)                         \
+    TRACE(c, "PKINIT client ignoring invalid rule '{str}'", rule)
+
 #define TRACE_PKINIT_EKU(c)                                             \
     TRACE(c, "PKINIT found acceptable EKU and digitalSignature KU")
 #define TRACE_PKINIT_EKU_NO_KU(c)                                       \
     TRACE(c, "PKINIT found acceptable EKU but no digitalSignature KU")
+#define TRACE_PKINIT_IDENTITY_OPTION(c, name)           \
+    TRACE(c, "PKINIT loading identity {str}", name)
 #define TRACE_PKINIT_LOADED_CERT(c, name)                       \
     TRACE(c, "PKINIT loaded cert and key for {str}", name)
-#define TRACE_PKINIT_LOAD_FROM_FILE(c)                          \
-    TRACE(c, "PKINIT loading CA certs and CRLs from FILE")
-#define TRACE_PKINIT_LOAD_FROM_DIR(c)                           \
-    TRACE(c, "PKINIT loading CA certs and CRLs from DIR")
+#define TRACE_PKINIT_LOAD_FROM_FILE(c, name)                            \
+    TRACE(c, "PKINIT loading CA certs and CRLs from FILE {str}", name)
+#define TRACE_PKINIT_LOAD_FROM_DIR(c, name)                             \
+    TRACE(c, "PKINIT loading CA certs and CRLs from DIR {str}", name)
 #define TRACE_PKINIT_NO_CA_ANCHOR(c, file)              \
     TRACE(c, "PKINIT no anchor CA in file {str}", file)
 #define TRACE_PKINIT_NO_CA_INTERMEDIATE(c, file)                \
@@ -162,6 +193,18 @@
     TRACE(c, "PKINIT second PKCS12_parse with password failed")
 #define TRACE_PKINIT_PKCS_PROMPT_FAIL(c)                        \
     TRACE(c, "PKINIT failed to prompt for PKCS12 password")
+#define TRACE_PKINIT_REGEXP_MATCH(c, keyword, comp, value, idx)         \
+    TRACE(c, "PKINIT matched {str} rule '{str}' with "                  \
+          "value '{str}' in cert #{int}", keyword, comp, value, (idx) + 1)
+#define TRACE_PKINIT_REGEXP_NOMATCH(c, keyword, comp, value, idx)       \
+    TRACE(c, "PKINIT didn't match {str} rule '{str}' with "             \
+          "value '{str}' in cert #{int}", keyword, comp, value, (idx) + 1)
+#define TRACE_PKINIT_SAN_CERT_COUNT(c, count, princ, upns, dns, cert)   \
+    TRACE(c, "PKINIT client found {int} SANs ({int} princs, {int} "     \
+          "UPNs, {int} DNS names) in certificate {str}", count, princ,   \
+          upns, dns, cert)
+#define TRACE_PKINIT_SAN_CERT_NONE(c, cert)                             \
+    TRACE(c, "PKINIT client found no SANs in certificate {str}", cert)
 
 #define TRACE_CERTAUTH_VTINIT_FAIL(c, ret)                              \
     TRACE(c, "certauth module failed to init vtable: {kerr}", ret)

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/preauth/spake/spake_kdc.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/preauth/spake/spake_kdc.c Changed

@@ -458,6 +458,10 @@
 
     ret = derive_key(context, gstate, group, ikey, &wbytes, &spakeresult,
                      &thash, der_req, 0, &reply_key);
+    if (ret)
+        goto cleanup;
+
+    ret = cb->replace_reply_key(context, rock, reply_key, TRUE);
 
 cleanup:
     zapfree(wbytes.data, wbytes.length);
@@ -465,8 +469,9 @@
     zapfree(spakeresult.data, spakeresult.length);
     krb5_free_data_contents(context, &thash);
     krb5_free_keyblock(context, k1);
+    krb5_free_keyblock(context, reply_key);
     k5_free_spake_factor(context, factor);
-    (*respond)(arg, ret, (krb5_kdcpreauth_modreq)reply_key, NULL, NULL);
+    (*respond)(arg, ret, NULL, NULL, NULL);
 }
 
 /*
@@ -533,31 +538,6 @@
     k5_free_pa_spake(context, pa_spake);
 }
 
-/* If a key was set in the per-request module data, replace the reply key.  Do
- * not generate any pa-data to include with the KDC reply. */
-static krb5_error_code
-spake_return(krb5_context context, krb5_pa_data *padata, krb5_data *req_pkt,
-             krb5_kdc_req *request, krb5_kdc_rep *reply,
-             krb5_keyblock *encrypting_key, krb5_pa_data **send_pa_out,
-             krb5_kdcpreauth_callbacks cb, krb5_kdcpreauth_rock rock,
-             krb5_kdcpreauth_moddata moddata, krb5_kdcpreauth_modreq modreq)
-{
-    krb5_keyblock *reply_key = (krb5_keyblock *)modreq;
-
-    if (reply_key == NULL)
-        return 0;
-    krb5_free_keyblock_contents(context, encrypting_key);
-    return krb5_copy_keyblock_contents(context, reply_key, encrypting_key);
-}
-
-/* Release a per-request module data object. */
-static void
-spake_free_modreq(krb5_context context, krb5_kdcpreauth_moddata moddata,
-                  krb5_kdcpreauth_modreq modreq)
-{
-    krb5_free_keyblock(context, (krb5_keyblock *)modreq);
-}
-
 krb5_error_code
 kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
                         krb5_plugin_vtable vtable);
@@ -578,7 +558,5 @@
     vt->fini = spake_fini;
     vt->edata = spake_edata;
     vt->verify = spake_verify;
-    vt->return_padata = spake_return;
-    vt->free_modreq = spake_free_modreq;
     return 0;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/plugins/tls/k5tls/openssl.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/plugins/tls/k5tls/openssl.c Changed

@@ -433,7 +433,7 @@
       char **anchors, k5_tls_handle *handle_out)
 {
     int e;
-    long options;
+    long options = SSL_OP_NO_SSLv2;
     SSL_CTX *ctx = NULL;
     SSL *ssl = NULL;
     k5_tls_handle handle = NULL;
@@ -448,8 +448,19 @@
     ctx = SSL_CTX_new(SSLv23_client_method());
     if (ctx == NULL)
         goto error;
-    options = SSL_CTX_get_options(ctx);
-    SSL_CTX_set_options(ctx, options | SSL_OP_NO_SSLv2);
+
+#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
+    /*
+     * For OpenSSL 3 and later, mark close_notify alerts as optional.  We don't
+     * need to worry about truncation attacks because the protocols this module
+     * is used with (Kerberos and change-password) receive a single
+     * length-delimited message from the server.  For prior versions of OpenSSL
+     * we check for SSL_ERROR_SYSCALL when reading instead (this error changes
+     * to SSL_ERROR_SSL in OpenSSL 3).
+     */
+    options |= SSL_OP_IGNORE_UNEXPECTED_EOF;
+#endif
+    SSL_CTX_set_options(ctx, options);
 
     SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback);
     X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), 0);

_service:tar_scm:krb5-1.19.2.tar.gz/src/po/mit-krb5.pot -> _service:tar_scm:krb5-1.20.1.tar.gz/src/po/mit-krb5.pot Changed

@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: mit-krb5 1.19.2\n"
+"Project-Id-Version: mit-krb5 1.20.1\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2021-07-22 00:36-0400\n"
+"POT-Creation-Date: 2022-11-11 18:04-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -55,7 +55,7 @@
 msgstr ""
 
 #: ../../src/clients/kdestroy/kdestroy.c:110
-#: ../../src/clients/kinit/kinit.c:337 ../../src/clients/ksu/main.c:296
+#: ../../src/clients/kinit/kinit.c:332 ../../src/clients/ksu/main.c:296
 #, c-format
 msgid "Only one -c option allowed\n"
 msgstr ""
@@ -66,7 +66,7 @@
 msgstr ""
 
 #: ../../src/clients/kdestroy/kdestroy.c:125
-#: ../../src/clients/kinit/kinit.c:365 ../../src/clients/klist/klist.c:178
+#: ../../src/clients/kinit/kinit.c:360 ../../src/clients/klist/klist.c:178
 #, c-format
 msgid "Kerberos 4 is no longer supported\n"
 msgstr ""
@@ -79,8 +79,8 @@
 #: ../../src/clients/kdestroy/kdestroy.c:150
 #: ../../src/clients/klist/klist.c:241 ../../src/clients/ksu/main.c:135
 #: ../../src/clients/ksu/main.c:141 ../../src/clients/kswitch/kswitch.c:94
-#: ../../src/kadmin/ktutil/ktutil.c:52 ../../src/kdc/main.c:953
-#: ../../src/kprop/kprop.c:102 ../../src/kprop/kpropd.c:1061
+#: ../../src/kadmin/ktutil/ktutil.c:52 ../../src/kdc/main.c:929
+#: ../../src/kprop/kprop.c:103 ../../src/kprop/kpropd.c:1058
 msgid "while initializing krb5"
 msgstr ""
 
@@ -99,8 +99,8 @@
 msgstr ""
 
 #: ../../src/clients/kdestroy/kdestroy.c:190
-#: ../../src/clients/kswitch/kswitch.c:107 ../../src/clients/kvno/kvno.c:313
-#: ../../src/clients/kvno/kvno.c:519 ../../src/kadmin/cli/keytab.c:373
+#: ../../src/clients/kswitch/kswitch.c:107 ../../src/clients/kvno/kvno.c:311
+#: ../../src/clients/kvno/kvno.c:517 ../../src/kadmin/cli/keytab.c:373
 #: ../../src/kadmin/dbutil/kdb5_util.c:544
 #, c-format
 msgid "while parsing principal name %s"
@@ -132,370 +132,372 @@
 
 #: ../../src/clients/kinit/kinit.c:143
 #, c-format
-msgid "Usage: %s -V -l lifetime -s start_time -r renewable_life"
+msgid ""
+"Usage: %s -V -l lifetime -s start_time -r renewable_life\n"
+"\t-f | -F -p | -P -n -a | -A -C -E\n"
+"\t--request-pac | --no-request-pac\n"
+"\t-v -R -k -i|-t keytab_file -c cachename\n"
+"\t-S service_name -I input_ccache -T ticket_armor_cache\n"
+"\t-X <attribute>=<value> principal\n"
+"\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:158
+#: ../../src/clients/kinit/kinit.c:153
 #, c-format
 msgid "\t-V verbose\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:159
+#: ../../src/clients/kinit/kinit.c:154
 #, c-format
 msgid "\t-l lifetime\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:160
+#: ../../src/clients/kinit/kinit.c:155
 #, c-format
 msgid "\t-s start time\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:161
+#: ../../src/clients/kinit/kinit.c:156
 #, c-format
 msgid "\t-r renewable lifetime\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:162
+#: ../../src/clients/kinit/kinit.c:157
 #, c-format
 msgid "\t-f forwardable\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:163
+#: ../../src/clients/kinit/kinit.c:158
 #, c-format
 msgid "\t-F not forwardable\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:164
+#: ../../src/clients/kinit/kinit.c:159
 #, c-format
 msgid "\t-p proxiable\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:165
+#: ../../src/clients/kinit/kinit.c:160
 #, c-format
 msgid "\t-P not proxiable\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:166
+#: ../../src/clients/kinit/kinit.c:161
 #, c-format
 msgid "\t-n anonymous\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:167
+#: ../../src/clients/kinit/kinit.c:162
 #, c-format
 msgid "\t-a include addresses\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:168
+#: ../../src/clients/kinit/kinit.c:163
 #, c-format
 msgid "\t-A do not include addresses\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:169
+#: ../../src/clients/kinit/kinit.c:164
 #, c-format
 msgid "\t-v validate\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:170
+#: ../../src/clients/kinit/kinit.c:165
 #, c-format
 msgid "\t-R renew\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:171
+#: ../../src/clients/kinit/kinit.c:166
 #, c-format
 msgid "\t-C canonicalize\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:172
+#: ../../src/clients/kinit/kinit.c:167
 #, c-format
 msgid "\t-E client is enterprise principal name\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:173
+#: ../../src/clients/kinit/kinit.c:168
 #, c-format
 msgid "\t-k use keytab\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:174
+#: ../../src/clients/kinit/kinit.c:169
 #, c-format
 msgid "\t-i use default client keytab (with -k)\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:175
+#: ../../src/clients/kinit/kinit.c:170
 #, c-format
 msgid "\t-t filename of keytab to use\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:176
+#: ../../src/clients/kinit/kinit.c:171
 #, c-format
 msgid "\t-c Kerberos 5 cache name\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:177
+#: ../../src/clients/kinit/kinit.c:172
 #, c-format
 msgid "\t-S service\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:178
+#: ../../src/clients/kinit/kinit.c:173
 #, c-format
 msgid "\t-I input credential cache\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:179
+#: ../../src/clients/kinit/kinit.c:174
 #, c-format
 msgid "\t-T armor credential cache\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:180
+#: ../../src/clients/kinit/kinit.c:175
 #, c-format
 msgid "\t-X <attribute>=<value>\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:182
+#: ../../src/clients/kinit/kinit.c:177
 #, c-format
 msgid "\t--{,no}-request-pac request KDC include/exclude a PAC\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:255 ../../src/clients/kinit/kinit.c:263
+#: ../../src/clients/kinit/kinit.c:250 ../../src/clients/kinit/kinit.c:258
 #, c-format
 msgid "Bad lifetime value %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:297
+#: ../../src/clients/kinit/kinit.c:292
 #, c-format
 msgid "Bad start time value %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:315
+#: ../../src/clients/kinit/kinit.c:310
 #, c-format
 msgid "Only one -t option allowed.\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:323
+#: ../../src/clients/kinit/kinit.c:318
 #, c-format
 msgid "Only one armor_ccache\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:345
+#: ../../src/clients/kinit/kinit.c:340
 #, c-format
 msgid "Only one -I option allowed\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:354
+#: ../../src/clients/kinit/kinit.c:349
 msgid "while adding preauth option"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:380
+#: ../../src/clients/kinit/kinit.c:375
 #, c-format
 msgid "Only one of -f and -F allowed\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:384
+#: ../../src/clients/kinit/kinit.c:379
 #, c-format
 msgid "Only one of -p and -P allowed\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:388
+#: ../../src/clients/kinit/kinit.c:383
 #, c-format
 msgid "Only one of --request-pac and --no-request-pac allowed\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:393
+#: ../../src/clients/kinit/kinit.c:388
 #, c-format
 msgid "Only one of -a and -A allowed\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:397
+#: ../../src/clients/kinit/kinit.c:392
 #, c-format
 msgid "Only one of -t and -i allowed\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:403
+#: ../../src/clients/kinit/kinit.c:398
 #, c-format
 msgid "keytab specified, forcing -k\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:406 ../../src/clients/klist/klist.c:216
+#: ../../src/clients/kinit/kinit.c:401 ../../src/clients/klist/klist.c:216
 #, c-format
 msgid "Extra arguments (starting with \"%s\").\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:432
+#: ../../src/clients/kinit/kinit.c:427
 msgid "while initializing Kerberos 5 library"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:440 ../../src/clients/kinit/kinit.c:594
+#: ../../src/clients/kinit/kinit.c:435 ../../src/clients/kinit/kinit.c:578
 #, c-format
 msgid "resolving ccache %s"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:445
+#: ../../src/clients/kinit/kinit.c:440
 #, c-format
 msgid "Using specified cache: %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:453
+#: ../../src/clients/kinit/kinit.c:448
 msgid "while getting default ccache"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:467 ../../src/clients/kinit/kinit.c:546
+#: ../../src/clients/kinit/kinit.c:462 ../../src/clients/kinit/kinit.c:530
 #: ../../src/clients/kpasswd/kpasswd.c:30 ../../src/clients/ksu/main.c:249
 #, c-format
 msgid "when parsing name %s"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:475 ../../src/kadmin/dbutil/kdb5_util.c:309
-#: ../../src/kprop/kprop.c:156
+#: ../../src/clients/kinit/kinit.c:470 ../../src/kadmin/dbutil/kdb5_util.c:309
+#: ../../src/kprop/kprop.c:157
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c:395
 msgid "while getting default realm"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:486
+#: ../../src/clients/kinit/kinit.c:481
 msgid "while building principal"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:494
+#: ../../src/clients/kinit/kinit.c:489
 msgid "When resolving the default client keytab"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:501
+#: ../../src/clients/kinit/kinit.c:496
 msgid "When determining client principal name from keytab"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:510
+#: ../../src/clients/kinit/kinit.c:505
 msgid "when creating default server principal name"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:517
-#, c-format
-msgid "(principal %s)"
-msgstr ""
-
-#: ../../src/clients/kinit/kinit.c:520
-msgid "for local services"
-msgstr ""
-
-#: ../../src/clients/kinit/kinit.c:541 ../../src/clients/kpasswd/kpasswd.c:43
+#: ../../src/clients/kinit/kinit.c:525 ../../src/clients/kpasswd/kpasswd.c:43
 #, c-format
 msgid "Unable to identify user\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:555 ../../src/clients/kswitch/kswitch.c:113
+#: ../../src/clients/kinit/kinit.c:539 ../../src/clients/kswitch/kswitch.c:113
 #, c-format
 msgid "while searching for ccache for %s"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:561
+#: ../../src/clients/kinit/kinit.c:545
 #, c-format
 msgid "Using existing cache: %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:570
+#: ../../src/clients/kinit/kinit.c:554
 msgid "while generating new ccache"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:574
+#: ../../src/clients/kinit/kinit.c:558
 #, c-format
 msgid "Using new cache: %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:586
+#: ../../src/clients/kinit/kinit.c:570
 #, c-format
 msgid "Using default cache: %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:599
+#: ../../src/clients/kinit/kinit.c:583
 #, c-format
 msgid "Using specified input cache: %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:606 ../../src/clients/ksu/krb_auth_su.c:160
+#: ../../src/clients/kinit/kinit.c:590 ../../src/clients/ksu/krb_auth_su.c:160
 msgid "when unparsing name"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:610
+#: ../../src/clients/kinit/kinit.c:594
 #, c-format
 msgid "Using principal: %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:691
+#: ../../src/clients/kinit/kinit.c:677
 msgid "getting local addresses"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:715
+#: ../../src/clients/kinit/kinit.c:701
 #, c-format
 msgid "while setting up KDB keytab for realm %s"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:724 ../../src/clients/kvno/kvno.c:510
+#: ../../src/clients/kinit/kinit.c:710 ../../src/clients/kvno/kvno.c:508
 #, c-format
 msgid "resolving keytab %s"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:729
+#: ../../src/clients/kinit/kinit.c:715
 #, c-format
 msgid "Using keytab: %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:733
+#: ../../src/clients/kinit/kinit.c:719
 msgid "resolving default client keytab"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:743
+#: ../../src/clients/kinit/kinit.c:729
 #, c-format
 msgid "while setting '%s'='%s'"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:748
+#: ../../src/clients/kinit/kinit.c:734
 #, c-format
 msgid "PA Option %s = %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:789
+#: ../../src/clients/kinit/kinit.c:775
 msgid "getting initial credentials"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:792
+#: ../../src/clients/kinit/kinit.c:778
 msgid "validating credentials"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:795
+#: ../../src/clients/kinit/kinit.c:781
 msgid "renewing credentials"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:803
+#: ../../src/clients/kinit/kinit.c:789
 #, c-format
 msgid "%s: Password incorrect while %s\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:806
+#: ../../src/clients/kinit/kinit.c:792
 #, c-format
 msgid "while %s"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:815
-#, c-format
-msgid "when initializing cache %s"
+#: ../../src/clients/kinit/kinit.c:803
+msgid "when creating temporary cache"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:820
+#: ../../src/clients/kinit/kinit.c:807
 #, c-format
 msgid "Initialized cache\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:824
+#: ../../src/clients/kinit/kinit.c:811
 msgid "while storing credentials"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:828
+#: ../../src/clients/kinit/kinit.c:816
+#, c-format
+msgid "while saving to cache %s"
+msgstr ""
+
+#: ../../src/clients/kinit/kinit.c:822
 #, c-format
 msgid "Stored credentials\n"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:834
+#: ../../src/clients/kinit/kinit.c:828
 msgid "while switching to new ccache"
 msgstr ""
 
-#: ../../src/clients/kinit/kinit.c:889
+#: ../../src/clients/kinit/kinit.c:885
 #, c-format
 msgid "Authenticated to Kerberos v5\n"
 msgstr ""
@@ -666,12 +668,12 @@
 msgstr ""
 
 #: ../../src/clients/klist/klist.c:674 ../../src/clients/ksu/ccache.c:440
-#: ../../src/kprop/kpropd.c:1208 ../../src/kprop/kpropd.c:1273
+#: ../../src/kprop/kpropd.c:1205 ../../src/kprop/kpropd.c:1270
 msgid "while unparsing client name"
 msgstr ""
 
 #: ../../src/clients/klist/klist.c:679 ../../src/clients/ksu/ccache.c:445
-#: ../../src/kprop/kprop.c:190
+#: ../../src/kprop/kprop.c:191
 msgid "while unparsing server name"
 msgstr ""
 
@@ -1231,121 +1233,132 @@
 msgid "while switching to credential cache"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:46
+#: ../../src/clients/kvno/kvno.c:44
 #, c-format
-msgid "usage: %s -c ccache -e etype -k keytab -q -u | -S sname"
+msgid ""
+"usage: %s -c ccache -e etype -k keytab -q -u | -S sname\n"
+"\t{-F cert_file | {-I | -U} for_user} -P | --u2u ccache\n"
+"\t--cached-only --no-store --out-cache service1 service2 ...\n"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:119 ../../src/clients/kvno/kvno.c:127
+#: ../../src/clients/kvno/kvno.c:117 ../../src/clients/kvno/kvno.c:125
 #, c-format
 msgid "Options -u and -S are mutually exclusive\n"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:161
+#: ../../src/clients/kvno/kvno.c:159
 #, c-format
 msgid "Options --u2u and -I|-U|-F are mutually exclusive\n"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:167
+#: ../../src/clients/kvno/kvno.c:165
 #, c-format
 msgid ""
 "Option -P (constrained delegation) requires option -I|-U|-F (protocol "
 "transition)\n"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:242
+#: ../../src/clients/kvno/kvno.c:240
 msgid "No begin line not found"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:254
+#: ../../src/clients/kvno/kvno.c:252
 msgid "No end line found"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:265
+#: ../../src/clients/kvno/kvno.c:263
 msgid "Unexpected header line"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:275
+#: ../../src/clients/kvno/kvno.c:273
 msgid "Invalid base64"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:321
+#: ../../src/clients/kvno/kvno.c:319
 #, c-format
 msgid "while formatting parsed principal name for '%s'"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:335
+#: ../../src/clients/kvno/kvno.c:333
 msgid "client and server principal names must match"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:351
+#: ../../src/clients/kvno/kvno.c:349
 #, c-format
 msgid "while getting credentials for %s"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:358
+#: ../../src/clients/kvno/kvno.c:356
 #, c-format
 msgid "while decoding ticket for %s"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:369
+#: ../../src/clients/kvno/kvno.c:367
 #, c-format
 msgid "while decrypting ticket for %s"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:373
+#: ../../src/clients/kvno/kvno.c:371
 #, c-format
 msgid "%s: kvno = %d, keytab entry valid\n"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:378
+#: ../../src/clients/kvno/kvno.c:376
 #, c-format
 msgid "%s: kvno = %d\n"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:393
+#: ../../src/clients/kvno/kvno.c:391
 #, c-format
 msgid "%s: constrained delegation failed"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:476 ../../src/kadmin/cli/kadmin.c:311
+#: ../../src/clients/kvno/kvno.c:474 ../../src/kadmin/cli/kadmin.c:311
 msgid "while initializing krb5 library"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:483
+#: ../../src/clients/kvno/kvno.c:481
 msgid "while converting etype"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:495
+#: ../../src/clients/kvno/kvno.c:493
 msgid "while opening ccache"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:502
+#: ../../src/clients/kvno/kvno.c:500
 msgid "while resolving output ccache"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:527
+#: ../../src/clients/kvno/kvno.c:525
 #, c-format
 msgid "while reading certificate file %s"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:537
+#: ../../src/clients/kvno/kvno.c:535
 #, c-format
 msgid "while getting user-to-user ticket from %s"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:546
+#: ../../src/clients/kvno/kvno.c:544
 msgid "while getting client principal name"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:559
+#: ../../src/clients/kvno/kvno.c:551
+msgid "while creating temporary output ccache"
+msgstr ""
+
+#: ../../src/clients/kvno/kvno.c:565
 msgid "while initializing output ccache"
 msgstr ""
 
-#: ../../src/clients/kvno/kvno.c:569
+#: ../../src/clients/kvno/kvno.c:575
 msgid "while storing creds in output ccache"
 msgstr ""
 
+#: ../../src/clients/kvno/kvno.c:586
+msgid "while writing output ccache"
+msgstr ""
+
 #: ../../src/kadmin/cli/kadmin.c:103
 #, c-format
 msgid ""
@@ -1407,7 +1420,7 @@
 msgstr ""
 
 #: ../../src/kadmin/cli/kadmin.c:468 ../../src/kadmin/cli/kadmin.c:483
-#: ../../src/kprop/kpropd.c:679
+#: ../../src/kprop/kpropd.c:677
 msgid "while canonicalizing principal name"
 msgstr ""
 
@@ -1454,7 +1467,7 @@
 msgid "Authenticating as principal %s with password.\n"
 msgstr ""
 
-#: ../../src/kadmin/cli/kadmin.c:580 ../../src/kprop/kpropd.c:726
+#: ../../src/kadmin/cli/kadmin.c:580 ../../src/kprop/kpropd.c:722
 #, c-format
 msgid "while initializing %s interface"
 msgstr ""
@@ -2212,200 +2225,212 @@
 msgid "cannot match size tokens"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:677
+#: ../../src/kadmin/dbutil/dump.c:672
+msgid "cannot allocate principal (too large)"
+msgstr ""
+
+#: ../../src/kadmin/dbutil/dump.c:681
 msgid "cannot allocate tl_data (too large)"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:699
+#: ../../src/kadmin/dbutil/dump.c:690
+msgid "invalid key_data size"
+msgstr ""
+
+#: ../../src/kadmin/dbutil/dump.c:707
 msgid "cannot read name string"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:704
+#: ../../src/kadmin/dbutil/dump.c:712
 #, c-format
 msgid "while parsing name %s"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:712
+#: ../../src/kadmin/dbutil/dump.c:720
 msgid "cannot read principal attributes"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:765
+#: ../../src/kadmin/dbutil/dump.c:773
 msgid "cannot read key size and version"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:769
+#: ../../src/kadmin/dbutil/dump.c:777
 msgid "unsupported key_data_ver version"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:780
+#: ../../src/kadmin/dbutil/dump.c:781
+msgid "invalid kvno"
+msgstr ""
+
+#: ../../src/kadmin/dbutil/dump.c:792
 msgid "cannot read key type and length"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:786
+#: ../../src/kadmin/dbutil/dump.c:798
 msgid "cannot read key data"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:796
+#: ../../src/kadmin/dbutil/dump.c:808
 msgid "cannot read extra data"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:805
+#: ../../src/kadmin/dbutil/dump.c:817
 #, c-format
 msgid "while storing %s"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:844 ../../src/kadmin/dbutil/dump.c:883
-#: ../../src/kadmin/dbutil/dump.c:929 ../../src/kadmin/dbutil/dump.c:948
+#: ../../src/kadmin/dbutil/dump.c:856 ../../src/kadmin/dbutil/dump.c:895
+#: ../../src/kadmin/dbutil/dump.c:941 ../../src/kadmin/dbutil/dump.c:960
 #, c-format
 msgid "cannot parse policy (%d read)\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:852 ../../src/kadmin/dbutil/dump.c:891
-#: ../../src/kadmin/dbutil/dump.c:969
+#: ../../src/kadmin/dbutil/dump.c:864 ../../src/kadmin/dbutil/dump.c:903
+#: ../../src/kadmin/dbutil/dump.c:981
 msgid "while creating policy"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:856
+#: ../../src/kadmin/dbutil/dump.c:868
 #, c-format
 msgid "created policy %s\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1006
+#: ../../src/kadmin/dbutil/dump.c:1018
 #, c-format
 msgid "unknown record type \"%s\"\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1117
+#: ../../src/kadmin/dbutil/dump.c:1129
 #, c-format
 msgid "%s: Unknown iprop dump version %d\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1195 ../../src/kadmin/dbutil/dump.c:1431
+#: ../../src/kadmin/dbutil/dump.c:1207 ../../src/kadmin/dbutil/dump.c:1443
 #, c-format
 msgid "OV dump format not supported\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1217 ../../src/kadmin/dbutil/dump.c:1443
+#: ../../src/kadmin/dbutil/dump.c:1229 ../../src/kadmin/dbutil/dump.c:1455
 #, c-format
 msgid "Iprop not enabled\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1254
+#: ../../src/kadmin/dbutil/dump.c:1266
 msgid "Conditional dump is an undocumented option for use only for iprop dumps"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1267
+#: ../../src/kadmin/dbutil/dump.c:1279
 msgid "Database not currently opened!"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1281 ../../src/kadmin/dbutil/kdb5_stash.c:116
+#: ../../src/kadmin/dbutil/dump.c:1293 ../../src/kadmin/dbutil/kdb5_stash.c:116
 #: ../../src/kadmin/dbutil/kdb5_util.c:445
 msgid "while reading master key"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1287
+#: ../../src/kadmin/dbutil/dump.c:1299
 msgid "while verifying master key"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1306 ../../src/kadmin/dbutil/dump.c:1316
+#: ../../src/kadmin/dbutil/dump.c:1318 ../../src/kadmin/dbutil/dump.c:1328
 msgid "while reading new master key"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1310
+#: ../../src/kadmin/dbutil/dump.c:1322
 #, c-format
 msgid "Please enter new master key....\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1334
+#: ../../src/kadmin/dbutil/dump.c:1346
 #, c-format
 msgid "while opening %s for writing"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1349
+#: ../../src/kadmin/dbutil/dump.c:1361
 msgid "while reading update log header"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1364 ../../src/kadmin/dbutil/dump.c:1372
+#: ../../src/kadmin/dbutil/dump.c:1376 ../../src/kadmin/dbutil/dump.c:1384
 #, c-format
 msgid "performing %s dump"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1402
+#: ../../src/kadmin/dbutil/dump.c:1414
 #, c-format
 msgid "%s: error processing line %d of %s\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1452
+#: ../../src/kadmin/dbutil/dump.c:1464
 msgid "while parsing options"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1467
+#: ../../src/kadmin/dbutil/dump.c:1479
 #, c-format
 msgid "while opening %s"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1472 ../../src/kadmin/dbutil/dump.c:1568
+#: ../../src/kadmin/dbutil/dump.c:1484 ../../src/kadmin/dbutil/dump.c:1580
 msgid "standard input"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1477
+#: ../../src/kadmin/dbutil/dump.c:1489
 #, c-format
 msgid "%s: can't read dump header in %s\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1485 ../../src/kadmin/dbutil/dump.c:1499
+#: ../../src/kadmin/dbutil/dump.c:1497 ../../src/kadmin/dbutil/dump.c:1511
 #, c-format
 msgid "%s: dump header bad in %s\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1508
+#: ../../src/kadmin/dbutil/dump.c:1520
 #, c-format
 msgid "Could not open iprop ulog\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1513
+#: ../../src/kadmin/dbutil/dump.c:1525
 #, c-format
 msgid "%s: dump version %s can only be loaded with the -update flag\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1522 ../../src/kadmin/dbutil/dump.c:1527
+#: ../../src/kadmin/dbutil/dump.c:1534 ../../src/kadmin/dbutil/dump.c:1539
 msgid "computing parameters for database"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1533
+#: ../../src/kadmin/dbutil/dump.c:1545
 msgid "while creating database"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1542
+#: ../../src/kadmin/dbutil/dump.c:1554
 msgid "while opening database"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1552
+#: ../../src/kadmin/dbutil/dump.c:1564
 msgid "while permanently locking database"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1570
+#: ../../src/kadmin/dbutil/dump.c:1582
 #, c-format
 msgid "%s: %s restore failed\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1575
+#: ../../src/kadmin/dbutil/dump.c:1587
 msgid "while unlocking database"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1585 ../../src/kadmin/dbutil/dump.c:1604
+#: ../../src/kadmin/dbutil/dump.c:1597 ../../src/kadmin/dbutil/dump.c:1616
 msgid "while reinitializing update log"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1595
+#: ../../src/kadmin/dbutil/dump.c:1607
 msgid "while making newly loaded database live"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1611
+#: ../../src/kadmin/dbutil/dump.c:1623
 msgid "while writing update log header"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/dump.c:1625
+#: ../../src/kadmin/dbutil/dump.c:1637
 #, c-format
 msgid "while deleting bad database %s"
 msgstr ""
@@ -2418,107 +2443,98 @@
 msgid "while initializing the Kerberos admin interface"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kadm5_create.c:196
+#: ../../src/kadmin/dbutil/kadm5_create.c:197
 msgid "while appending realm to principal"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kadm5_create.c:201
+#: ../../src/kadmin/dbutil/kadm5_create.c:203
 msgid "while parsing admin principal name"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kadm5_create.c:212
+#: ../../src/kadmin/dbutil/kadm5_create.c:215
 #, c-format
 msgid "while creating principal %s"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:181
-#, c-format
-msgid "Loading random data\n"
-msgstr ""
-
-#: ../../src/kadmin/dbutil/kdb5_create.c:184
-msgid "Loading random data"
-msgstr ""
-
-#: ../../src/kadmin/dbutil/kdb5_create.c:194
+#: ../../src/kadmin/dbutil/kdb5_create.c:186
 #: ../../src/kadmin/dbutil/kdb5_util.c:389
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:574
 msgid "while setting up master key name"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:205
+#: ../../src/kadmin/dbutil/kdb5_create.c:197
 #, c-format
 msgid ""
 "Initializing database '%s' for realm '%s',\n"
 "master key name '%s'\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:210
+#: ../../src/kadmin/dbutil/kdb5_create.c:202
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:483
 #, c-format
 msgid "You will be prompted for the database Master Password.\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:211
+#: ../../src/kadmin/dbutil/kdb5_create.c:203
 #: ../../src/kadmin/dbutil/kdb5_mkey.c:255
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:484
 #, c-format
 msgid "It is important that you NOT FORGET this password.\n"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:217
+#: ../../src/kadmin/dbutil/kdb5_create.c:209
 #: ../../src/kadmin/dbutil/kdb5_mkey.c:261
 msgid "while creating new master key"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:225
+#: ../../src/kadmin/dbutil/kdb5_create.c:217
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:494
 msgid "while reading master key from keyboard"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:235
+#: ../../src/kadmin/dbutil/kdb5_create.c:227
 #: ../../src/kadmin/dbutil/kdb5_mkey.c:280
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:586
 msgid "while calculating master key salt"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:243
+#: ../../src/kadmin/dbutil/kdb5_create.c:235
 #: ../../src/kadmin/dbutil/kdb5_mkey.c:289
 #: ../../src/kadmin/dbutil/kdb5_util.c:431
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:598
 msgid "while transforming master key from password"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:253
+#: ../../src/kadmin/dbutil/kdb5_create.c:245
 msgid "while initializing random key generator"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:258
+#: ../../src/kadmin/dbutil/kdb5_create.c:250
 #, c-format
 msgid "while creating database '%s'"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:276
+#: ../../src/kadmin/dbutil/kdb5_create.c:268
 msgid "while creating update log"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:287
+#: ../../src/kadmin/dbutil/kdb5_create.c:279
 msgid "while initializing update log"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:302
+#: ../../src/kadmin/dbutil/kdb5_create.c:294
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:610
 msgid "while adding entries to the database"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:330
+#: ../../src/kadmin/dbutil/kdb5_create.c:322
 #: ../../src/kadmin/dbutil/kdb5_mkey.c:333
 #: ../../src/kadmin/dbutil/kdb5_stash.c:133
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:635
 msgid "while storing key"
 msgstr ""
 
-#: ../../src/kadmin/dbutil/kdb5_create.c:331
+#: ../../src/kadmin/dbutil/kdb5_create.c:323
 #: ../../src/kadmin/dbutil/kdb5_mkey.c:334
 #: ../../src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c:636
 #, c-format
@@ -3239,7 +3255,7 @@
 msgid "gss_to_krb5_name: failed display_name status %d"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:86
+#: ../../src/kadmin/server/ovsec_kadmd.c:82
 #, c-format
 msgid ""
 "Usage: kadmind -x db_args* -r realm -m -nofork -port port-number\n"
@@ -3251,149 +3267,141 @@
 "\t\t\tLook at each database documentation for supported arguments\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:110
+#: ../../src/kadmin/server/ovsec_kadmd.c:106
 #, c-format
 msgid "%s: %s while %s, aborting\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:112
+#: ../../src/kadmin/server/ovsec_kadmd.c:108
 #, c-format
 msgid "%s while %s, aborting\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:114
+#: ../../src/kadmin/server/ovsec_kadmd.c:110
 #, c-format
 msgid "%s: %s, aborting\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:115
+#: ../../src/kadmin/server/ovsec_kadmd.c:111
 #, c-format
 msgid "%s, aborting"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:282
+#: ../../src/kadmin/server/ovsec_kadmd.c:278
 #, c-format
 msgid ""
 "WARNING! Forged/garbled request: %s, claimed client = %.*s%s, server = %.*s"
 "%s, addr = %s"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:288
+#: ../../src/kadmin/server/ovsec_kadmd.c:284
 #, c-format
 msgid ""
 "WARNING! Forged/garbled request: %d, claimed client = %.*s%s, server = %.*s"
 "%s, addr = %s"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:302
+#: ../../src/kadmin/server/ovsec_kadmd.c:298
 #, c-format
 msgid "Miscellaneous RPC error: %s, %s"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:318
+#: ../../src/kadmin/server/ovsec_kadmd.c:314
 #, c-format
 msgid "%s Cannot decode status %d"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:336
+#: ../../src/kadmin/server/ovsec_kadmd.c:332
 #, c-format
 msgid "Authentication attempt failed: %s, GSS-API error strings are:"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:341
+#: ../../src/kadmin/server/ovsec_kadmd.c:337
 msgid "   GSS-API error strings complete."
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:379
+#: ../../src/kadmin/server/ovsec_kadmd.c:375
 #, c-format
 msgid "%s: cannot initialize. Not enough memory\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:451
+#: ../../src/kadmin/server/ovsec_kadmd.c:443
 #, c-format
 msgid "%s: %s while initializing context, aborting\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:462
-#: ../../src/kadmin/server/ovsec_kadmd.c:531
+#: ../../src/kadmin/server/ovsec_kadmd.c:454
+#: ../../src/kadmin/server/ovsec_kadmd.c:523
 msgid "initializing"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:466
+#: ../../src/kadmin/server/ovsec_kadmd.c:458
 msgid "getting config parameters"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:468
+#: ../../src/kadmin/server/ovsec_kadmd.c:460
 msgid "Missing required realm configuration"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:470
+#: ../../src/kadmin/server/ovsec_kadmd.c:462
 msgid "Missing required ACL file configuration"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:472
+#: ../../src/kadmin/server/ovsec_kadmd.c:464
 msgid "-proponly can only be used when iprop_enable is true"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:478
+#: ../../src/kadmin/server/ovsec_kadmd.c:470
 msgid "initializing network"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:483
+#: ../../src/kadmin/server/ovsec_kadmd.c:475
 msgid "Cannot build GSSAPI auth names"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:487
+#: ../../src/kadmin/server/ovsec_kadmd.c:479
 msgid "Cannot set up KDB keytab"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:490
+#: ../../src/kadmin/server/ovsec_kadmd.c:482
 msgid "Cannot set GSSAPI authentication names"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:507
+#: ../../src/kadmin/server/ovsec_kadmd.c:499
 msgid "Cannot initialize GSSAPI service name"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:512
+#: ../../src/kadmin/server/ovsec_kadmd.c:504
 msgid "initializing ACL file"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:520
+#: ../../src/kadmin/server/ovsec_kadmd.c:512
 msgid "spawning daemon process"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:524
+#: ../../src/kadmin/server/ovsec_kadmd.c:516
 msgid "creating PID file"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:533
-msgid "Seeding random number generator"
-msgstr ""
-
-#: ../../src/kadmin/server/ovsec_kadmd.c:536
-msgid "getting random seed"
-msgstr ""
-
-#: ../../src/kadmin/server/ovsec_kadmd.c:543
+#: ../../src/kadmin/server/ovsec_kadmd.c:530
 msgid "mapping update log"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:547
+#: ../../src/kadmin/server/ovsec_kadmd.c:534
 #, c-format
 msgid "%s: create IPROP svc (PROG=%d, VERS=%d)\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:555
+#: ../../src/kadmin/server/ovsec_kadmd.c:542
 msgid "starting"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:557 ../../src/kdc/main.c:1064
+#: ../../src/kadmin/server/ovsec_kadmd.c:544 ../../src/kdc/main.c:1040
 #, c-format
 msgid "%s: starting...\n"
 msgstr ""
 
-#: ../../src/kadmin/server/ovsec_kadmd.c:560
+#: ../../src/kadmin/server/ovsec_kadmd.c:547
 msgid "finished, exiting"
 msgstr ""
 
@@ -3412,54 +3420,54 @@
 msgid "chpw: Couldn't open admin keytab %s"
 msgstr ""
 
-#: ../../src/kadmin/server/server_stubs.c:394
+#: ../../src/kadmin/server/server_stubs.c:396
 #, c-format
 msgid ""
 "Unauthorized request: %s, %.*s%s, client=%.*s%s, service=%.*s%s, addr=%s"
 msgstr ""
 
-#: ../../src/kadmin/server/server_stubs.c:415
-#: ../../src/kadmin/server/server_stubs.c:693
-#: ../../src/kadmin/server/server_stubs.c:1568
+#: ../../src/kadmin/server/server_stubs.c:417
+#: ../../src/kadmin/server/server_stubs.c:695
+#: ../../src/kadmin/server/server_stubs.c:1570
 msgid "success"
 msgstr ""
 
-#: ../../src/kadmin/server/server_stubs.c:425
+#: ../../src/kadmin/server/server_stubs.c:427
 #, c-format
 msgid "Request: %s, %.*s%s, %s, client=%.*s%s, service=%.*s%s, addr=%s"
 msgstr ""
 
-#: ../../src/kadmin/server/server_stubs.c:673
+#: ../../src/kadmin/server/server_stubs.c:675
 #, c-format
 msgid ""
 "Unauthorized request: kadm5_rename_principal, %.*s%s to %.*s%s, client=%.*s"
 "%s, service=%.*s%s, addr=%s"
 msgstr ""
 
-#: ../../src/kadmin/server/server_stubs.c:688
+#: ../../src/kadmin/server/server_stubs.c:690
 #, c-format
 msgid ""
 "Request: kadm5_rename_principal, %.*s%s to %.*s%s, %s, client=%.*s%s, "
 "service=%.*s%s, addr=%s"
 msgstr ""
 
-#: ../../src/kadmin/server/server_stubs.c:1564
+#: ../../src/kadmin/server/server_stubs.c:1566
 #, c-format
 msgid ""
 "Request: kadm5_init, %.*s%s, %s, client=%.*s%s, service=%.*s%s, addr=%s, "
 "vers=%d, flavor=%d"
 msgstr ""
 
-#: ../../src/kdc/do_as_req.c:271
+#: ../../src/kdc/do_as_req.c:277
 #, c-format
 msgid "AS_REQ : handle_authdata (%d)"
 msgstr ""
 
-#: ../../src/kdc/do_tgs_req.c:602
+#: ../../src/kdc/do_tgs_req.c:581
 msgid "not checking transit path"
 msgstr ""
 
-#: ../../src/kdc/do_tgs_req.c:619
+#: ../../src/kdc/do_tgs_req.c:598
 #, c-format
 msgid "TGS_REQ : handle_authdata (%d)"
 msgstr ""
@@ -3567,16 +3575,16 @@
 msgid "preauth %s failed to setup loop: %s"
 msgstr ""
 
-#: ../../src/kdc/kdc_preauth.c:885
+#: ../../src/kdc/kdc_preauth.c:903
 #, c-format
 msgid "%spreauth required but hint list is empty"
 msgstr ""
 
-#: ../../src/kdc/kdc_preauth_ec.c:76
+#: ../../src/kdc/kdc_preauth_ec.c:74
 msgid "Encrypted Challenge used outside of FAST tunnel"
 msgstr ""
 
-#: ../../src/kdc/kdc_preauth_ec.c:121
+#: ../../src/kdc/kdc_preauth_ec.c:117
 msgid "Incorrect password in encrypted challenge"
 msgstr ""
 
@@ -3589,86 +3597,86 @@
 msgid "TGS_REQ: UNKNOWN SERVER: server='%s'"
 msgstr ""
 
-#: ../../src/kdc/kdc_util.c:748
+#: ../../src/kdc/kdc_util.c:842
 #, c-format
 msgid "Required auth indicators not present in ticket: %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:226
+#: ../../src/kdc/main.c:225
 #, c-format
 msgid "Requested master password enctype %s in %s is DEPRECATED!\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:242
+#: ../../src/kdc/main.c:241
 #, c-format
 msgid "while getting context for realm %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:344
+#: ../../src/kdc/main.c:348
 #, c-format
 msgid "while setting default realm to %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:352
+#: ../../src/kdc/main.c:356
 #, c-format
 msgid "while initializing database for realm %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:361
+#: ../../src/kdc/main.c:365
 #, c-format
 msgid "while setting up master key name %s for realm %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:374
+#: ../../src/kdc/main.c:378
 #, c-format
 msgid "while fetching master key %s for realm %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:383
+#: ../../src/kdc/main.c:387
 #, c-format
 msgid "Stash file %s uses DEPRECATED enctype %s!\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:390
+#: ../../src/kdc/main.c:394
 #, c-format
 msgid "while fetching master keys list for realm %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:399
+#: ../../src/kdc/main.c:403
 #, c-format
 msgid "while resolving kdb keytab for realm %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:408
+#: ../../src/kdc/main.c:412
 #, c-format
 msgid "while building TGS name for realm %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:526
+#: ../../src/kdc/main.c:502
 #, c-format
 msgid "creating %d worker processes"
 msgstr ""
 
-#: ../../src/kdc/main.c:536
+#: ../../src/kdc/main.c:512
 msgid "Unable to reinitialize main loop"
 msgstr ""
 
-#: ../../src/kdc/main.c:541
+#: ../../src/kdc/main.c:517
 #, c-format
 msgid "Unable to initialize signal handlers in pid %d"
 msgstr ""
 
-#: ../../src/kdc/main.c:571
+#: ../../src/kdc/main.c:547
 #, c-format
 msgid "worker %ld exited with status %d"
 msgstr ""
 
-#: ../../src/kdc/main.c:595
+#: ../../src/kdc/main.c:571
 #, c-format
 msgid "signal %d received in supervisor"
 msgstr ""
 
-#: ../../src/kdc/main.c:607
+#: ../../src/kdc/main.c:583
 #, c-format
 msgid ""
 "usage: %s -x db_args* -d dbpathname -r dbrealmname\n"
@@ -3682,86 +3690,86 @@
 "arguments\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:682 ../../src/kdc/main.c:689 ../../src/kdc/main.c:804
+#: ../../src/kdc/main.c:658 ../../src/kdc/main.c:665 ../../src/kdc/main.c:780
 #, c-format
 msgid " KDC cannot initialize. Not enough memory\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:708 ../../src/kdc/main.c:751 ../../src/kdc/main.c:762
+#: ../../src/kdc/main.c:684 ../../src/kdc/main.c:727 ../../src/kdc/main.c:738
 #, c-format
 msgid "%s: KDC cannot initialize. Not enough memory\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:728 ../../src/kdc/main.c:841
+#: ../../src/kdc/main.c:704 ../../src/kdc/main.c:817
 #, c-format
 msgid "%s: cannot initialize realm %s - see log file for details\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:739
+#: ../../src/kdc/main.c:715
 #, c-format
 msgid "%s: cannot initialize realm %s. Not enough memory\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:790
+#: ../../src/kdc/main.c:766
 #, c-format
 msgid "invalid enctype %s"
 msgstr ""
 
-#: ../../src/kdc/main.c:829
+#: ../../src/kdc/main.c:805
 msgid "while attempting to retrieve default realm"
 msgstr ""
 
-#: ../../src/kdc/main.c:831
+#: ../../src/kdc/main.c:807
 #, c-format
 msgid "%s: %s, attempting to retrieve default realm\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:939
+#: ../../src/kdc/main.c:915
 #, c-format
 msgid "%s: cannot get memory for realm list\n"
 msgstr ""
 
-#: ../../src/kdc/main.c:974
+#: ../../src/kdc/main.c:950
 msgid "while initializing lookaside cache"
 msgstr ""
 
-#: ../../src/kdc/main.c:982
+#: ../../src/kdc/main.c:958
 msgid "while creating main loop"
 msgstr ""
 
-#: ../../src/kdc/main.c:991
+#: ../../src/kdc/main.c:967
 msgid "while loading KDC policy plugin"
 msgstr ""
 
-#: ../../src/kdc/main.c:1016
+#: ../../src/kdc/main.c:992
 msgid "while initializing signal handlers"
 msgstr ""
 
-#: ../../src/kdc/main.c:1024
+#: ../../src/kdc/main.c:1000
 msgid "while initializing network"
 msgstr ""
 
-#: ../../src/kdc/main.c:1034
+#: ../../src/kdc/main.c:1010
 msgid "while detaching from tty"
 msgstr ""
 
-#: ../../src/kdc/main.c:1040
+#: ../../src/kdc/main.c:1016
 msgid "while creating PID file"
 msgstr ""
 
-#: ../../src/kdc/main.c:1048
+#: ../../src/kdc/main.c:1024
 msgid "creating worker processes"
 msgstr ""
 
-#: ../../src/kdc/main.c:1058
+#: ../../src/kdc/main.c:1034
 msgid "while loading audit plugin module(s)"
 msgstr ""
 
-#: ../../src/kdc/main.c:1062
+#: ../../src/kdc/main.c:1038
 msgid "commencing operation"
 msgstr ""
 
-#: ../../src/kdc/main.c:1070
+#: ../../src/kdc/main.c:1045
 msgid "shutting down"
 msgstr ""
 
@@ -3778,152 +3786,152 @@
 "\n"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:114
+#: ../../src/kprop/kprop.c:115
 #, c-format
 msgid "Database propagation to %s: SUCCEEDED\n"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:175
+#: ../../src/kprop/kprop.c:176
 msgid "while setting client principal name"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:184
+#: ../../src/kprop/kprop.c:185
 msgid "while setting server principal name"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:197
+#: ../../src/kprop/kprop.c:198
 msgid "while resolving keytab"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:205
+#: ../../src/kprop/kprop.c:206
 msgid "while getting initial credentials\n"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:241
+#: ../../src/kprop/kprop.c:242
 msgid "while creating socket"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:257
-msgid "while converting server address"
-msgstr ""
-
-#: ../../src/kprop/kprop.c:267
+#: ../../src/kprop/kprop.c:262
 msgid "while connecting to server"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:274 ../../src/kprop/kpropd.c:1198
+#: ../../src/kprop/kprop.c:269 ../../src/kprop/kpropd.c:1195
 msgid "while getting local socket address"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:279
+#: ../../src/kprop/kprop.c:274
 msgid "while converting local address"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:302
+#: ../../src/kprop/kprop.c:296
 msgid "in krb5_auth_con_setaddrs"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:310
+#: ../../src/kprop/kprop.c:304
 msgid "while authenticating to server"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:314 ../../src/kprop/kprop.c:513
-#: ../../src/kprop/kpropd.c:1510
+#: ../../src/kprop/kprop.c:308 ../../src/kprop/kprop.c:506
+#: ../../src/kprop/kpropd.c:1515
 #, c-format
 msgid "Generic remote error: %s\n"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:320 ../../src/kprop/kprop.c:519
+#: ../../src/kprop/kprop.c:314 ../../src/kprop/kprop.c:512
 msgid "signalled from server"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:322 ../../src/kprop/kprop.c:521
+#: ../../src/kprop/kprop.c:316 ../../src/kprop/kprop.c:514
 #, c-format
 msgid "Error text from server: %s\n"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:350
+#: ../../src/kprop/kprop.c:344
 #, c-format
 msgid "allocating database file name '%s'"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:356
+#: ../../src/kprop/kprop.c:350
 #, c-format
 msgid "while trying to open %s"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:363
+#: ../../src/kprop/kprop.c:357
 msgid "database locked"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:366 ../../src/kprop/kpropd.c:551
+#: ../../src/kprop/kprop.c:360 ../../src/kprop/kpropd.c:552
 #, c-format
 msgid "while trying to lock '%s'"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:370 ../../src/kprop/kprop.c:378
+#: ../../src/kprop/kprop.c:364 ../../src/kprop/kprop.c:372
 #, c-format
 msgid "while trying to stat %s"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:374
+#: ../../src/kprop/kprop.c:368
 msgid "while trying to malloc data_ok_fn"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:383
+#: ../../src/kprop/kprop.c:377
 #, c-format
 msgid "'%s' more recent than '%s'."
 msgstr ""
 
-#: ../../src/kprop/kprop.c:399
+#: ../../src/kprop/kprop.c:393
 #, c-format
 msgid "while unlocking database '%s'"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:432 ../../src/kprop/kprop.c:433
+#: ../../src/kprop/kprop.c:425 ../../src/kprop/kprop.c:426
 msgid "while encoding database size"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:441
+#: ../../src/kprop/kprop.c:434
 msgid "while sending database size"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:451
+#: ../../src/kprop/kprop.c:444
 msgid "while allocating i_vector"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:474
+#: ../../src/kprop/kprop.c:467
 #, c-format
-msgid "while sending database block starting at %d"
+msgid "while sending database block starting at %<PRIu64>"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:484
+#: ../../src/kprop/kprop.c:477
 msgid "Premature EOF found for database file!"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:497
+#: ../../src/kprop/kprop.c:490
 msgid "while reading response from server"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:508
+#: ../../src/kprop/kprop.c:501
 msgid "while decoding error response from server"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:539
+#: ../../src/kprop/kprop.c:531
+msgid "malformed sent database size message"
+msgstr ""
+
+#: ../../src/kprop/kprop.c:535
 #, c-format
-msgid "Kpropd sent database size %d, expecting %d"
+msgid "Kpropd sent database size %<PRIu64>, expecting %<PRIu64>"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:584
+#: ../../src/kprop/kprop.c:581
 msgid "while allocating filename for update_last_prop_file"
 msgstr ""
 
-#: ../../src/kprop/kprop.c:589
+#: ../../src/kprop/kprop.c:586
 #, c-format
 msgid "while creating 'last_prop' file, '%s'"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:170
+#: ../../src/kprop/kpropd.c:171
 #, c-format
 msgid ""
 "\n"
@@ -3933,470 +3941,474 @@
 "\t-a acl_file -A admin_server --pid-file=pid_file\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:230
+#: ../../src/kprop/kpropd.c:231
 #, c-format
 msgid "Killing fullprop child (%d)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:259
+#: ../../src/kprop/kpropd.c:260
 msgid "while checking if stdin is a socket"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:277
+#: ../../src/kprop/kpropd.c:278
 #, c-format
 msgid "ready\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:283
+#: ../../src/kprop/kpropd.c:284
 #, c-format
 msgid "Could not write pid file %s: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:295
+#: ../../src/kprop/kpropd.c:296
 #, c-format
 msgid "Could not open /dev/null: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:302
+#: ../../src/kprop/kpropd.c:303
 #, c-format
 msgid "Could not dup the inetd socket: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:337 ../../src/kprop/kpropd.c:350
+#: ../../src/kprop/kpropd.c:338 ../../src/kprop/kpropd.c:351
 msgid "do_iprop failed.\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:389
+#: ../../src/kprop/kpropd.c:390
 #, c-format
 msgid "getaddrinfo: %s\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:395
+#: ../../src/kprop/kpropd.c:396
 msgid "while obtaining socket"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:401
+#: ../../src/kprop/kpropd.c:402
 msgid "while setting SO_REUSEADDR option"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:409
+#: ../../src/kprop/kpropd.c:410
 msgid "while unsetting IPV6_V6ONLY option"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:414
+#: ../../src/kprop/kpropd.c:415
 msgid "while binding listener socket"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:425
+#: ../../src/kprop/kpropd.c:426
 #, c-format
 msgid "waiting for a kprop connection\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:431
+#: ../../src/kprop/kpropd.c:432
 msgid "while accepting connection"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:437
+#: ../../src/kprop/kpropd.c:438
 msgid "while forking"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:452
+#: ../../src/kprop/kpropd.c:453
 #, c-format
 msgid "waitpid() failed to wait for doit() (%d %s)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:456
+#: ../../src/kprop/kpropd.c:457
 msgid "while waiting to receive database"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:460
+#: ../../src/kprop/kpropd.c:461
 #, c-format
 msgid "Database load process for full propagation completed.\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:498
+#: ../../src/kprop/kpropd.c:499
 #, c-format
 msgid ""
 "%s: Standard input does not appear to be a network socket.\n"
 "\t(Not run from inetd, and missing the -S option?)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:511
+#: ../../src/kprop/kpropd.c:512
 msgid "while attempting setsockopt (SO_KEEPALIVE)"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:516
+#: ../../src/kprop/kpropd.c:517
 #, c-format
 msgid "Connection from %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:536
+#: ../../src/kprop/kpropd.c:537
 #, c-format
 msgid "Rejected connection from unauthorized principal %s\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:540
+#: ../../src/kprop/kpropd.c:541
 #, c-format
 msgid "Rejected connection from unauthorized principal %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:557
+#: ../../src/kprop/kpropd.c:558
 #, c-format
 msgid "while opening database file, '%s'"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:563
+#: ../../src/kprop/kpropd.c:564
 #, c-format
 msgid "while renaming %s to %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:569
+#: ../../src/kprop/kpropd.c:570
 #, c-format
 msgid "while downgrading lock on '%s'"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:576
+#: ../../src/kprop/kpropd.c:577
 #, c-format
 msgid "while unlocking '%s'"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:588
+#: ../../src/kprop/kpropd.c:589
 msgid "while sending # of received bytes"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:594
+#: ../../src/kprop/kpropd.c:595
 msgid "while trying to close database file"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:649
+#: ../../src/kprop/kpropd.c:650
 #, c-format
 msgid "Incremental propagation enabled\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:660
+#: ../../src/kprop/kpropd.c:659
 #, c-format
 msgid "%s: unable to get kiprop host based service name for realm %s\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:671
+#: ../../src/kprop/kpropd.c:669
 msgid "while trying to construct host service principal"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:690
+#: ../../src/kprop/kpropd.c:686
 #, c-format
 msgid "Initializing kadm5 as client %s\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:704
+#: ../../src/kprop/kpropd.c:700
 #, c-format
 msgid "kadm5 initialization failed!\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:713
+#: ../../src/kprop/kpropd.c:709
 msgid "while attempting to connect to primary KDC ... retrying"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:717
+#: ../../src/kprop/kpropd.c:713
 #, c-format
 msgid "Sleeping %d seconds to re-initialize kadm5 (RPC ERROR)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:733
+#: ../../src/kprop/kpropd.c:729
 #, c-format
 msgid "while initializing %s interface, retrying"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:737
+#: ../../src/kprop/kpropd.c:733
 #, c-format
 msgid "Sleeping %d seconds to re-initialize kadm5 (krb5kdc not running?)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:747
+#: ../../src/kprop/kpropd.c:743
 #, c-format
 msgid "kadm5 initialization succeeded\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:769
+#: ../../src/kprop/kpropd.c:765
 msgid "reading update log header"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:780
+#: ../../src/kprop/kpropd.c:776
 #, c-format
 msgid "Calling iprop_get_updates_1 (sno=%u sec=%u usec=%u)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:790
+#: ../../src/kprop/kpropd.c:786
 msgid "iprop_get_updates call failed"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:796
+#: ../../src/kprop/kpropd.c:792
 #, c-format
 msgid "Reinitializing iprop because get updates failed\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:817
+#: ../../src/kprop/kpropd.c:813
 #, c-format
 msgid "Still waiting for full resync\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:822
+#: ../../src/kprop/kpropd.c:818
 #, c-format
 msgid "Full resync needed\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:823
+#: ../../src/kprop/kpropd.c:819
 msgid "kpropd: Full resync needed."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:828
+#: ../../src/kprop/kpropd.c:824
 msgid "iprop_full_resync call failed"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:839
+#: ../../src/kprop/kpropd.c:835
 #, c-format
 msgid "Full resync request granted\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:840
+#: ../../src/kprop/kpropd.c:836
 msgid "Full resync request granted."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:849
+#: ../../src/kprop/kpropd.c:845
 #, c-format
 msgid "Exponential backoff\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:855
+#: ../../src/kprop/kpropd.c:851
 #, c-format
 msgid "Full resync permission denied\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:856
+#: ../../src/kprop/kpropd.c:852
 msgid "Full resync, permission denied."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:861
+#: ../../src/kprop/kpropd.c:857
 #, c-format
 msgid "Full resync error from primary\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:862
+#: ../../src/kprop/kpropd.c:858
 msgid " Full resync, error returned from primary KDC."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:870
+#: ../../src/kprop/kpropd.c:866
 #, c-format
 msgid "Full resync invalid result from primary\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:872
+#: ../../src/kprop/kpropd.c:868
 msgid "Full resync, invalid return from primary KDC."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:888
+#: ../../src/kprop/kpropd.c:884
 #, c-format
 msgid "Got incremental updates (sno=%u sec=%u usec=%u)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:900
+#: ../../src/kprop/kpropd.c:896
 #, c-format
 msgid "ulog_replay failed (%s), updates not registered\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:903
+#: ../../src/kprop/kpropd.c:899
 #, c-format
 msgid "ulog_replay failed (%s), updates not registered."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:912
+#: ../../src/kprop/kpropd.c:908
 #, c-format
 msgid "Incremental updates: %d updates / %lu us"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:915
+#: ../../src/kprop/kpropd.c:911
 #, c-format
 msgid "Incremental updates: %d updates / %lu us\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:923
+#: ../../src/kprop/kpropd.c:919
 #, c-format
 msgid "get_updates permission denied\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:924
+#: ../../src/kprop/kpropd.c:920
 msgid "get_updates, permission denied."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:929
+#: ../../src/kprop/kpropd.c:925
 #, c-format
 msgid "get_updates error from primary\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:931
+#: ../../src/kprop/kpropd.c:927
 msgid "get_updates, error returned from primary KDC."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:939
+#: ../../src/kprop/kpropd.c:935
 #, c-format
 msgid "get_updates primary busy; backoff\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:948
+#: ../../src/kprop/kpropd.c:944
 #, c-format
 msgid "KDC is synchronized with primary.\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:957
+#: ../../src/kprop/kpropd.c:953
 #, c-format
 msgid "get_updates invalid result from primary\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:960
+#: ../../src/kprop/kpropd.c:956
 msgid "get_updates, invalid return from primary KDC."
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:975
+#: ../../src/kprop/kpropd.c:971
 #, c-format
 msgid "Busy signal received from primary, backoff for %d secs\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:982
+#: ../../src/kprop/kpropd.c:978
 #, c-format
 msgid "Waiting for %d seconds before checking for updates again\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:993
+#: ../../src/kprop/kpropd.c:989
 #, c-format
 msgid "ERROR returned by primary, bailing\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:994
+#: ../../src/kprop/kpropd.c:990
 msgid "ERROR returned by primary KDC, bailing.\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1111
+#: ../../src/kprop/kpropd.c:1108
 msgid "copying db args"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1136
+#: ../../src/kprop/kpropd.c:1133
 msgid "Unable to get default realm"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1143
+#: ../../src/kprop/kpropd.c:1140
 msgid "Unable to set default realm"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1153
+#: ../../src/kprop/kpropd.c:1150
 msgid "while trying to construct my service name"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1160
+#: ../../src/kprop/kpropd.c:1157
 msgid "while allocating filename for temp file"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1168
+#: ../../src/kprop/kpropd.c:1165
 msgid "while initializing"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1176
+#: ../../src/kprop/kpropd.c:1173
 msgid "Unable to map log!\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1218
+#: ../../src/kprop/kpropd.c:1215
 #, c-format
 msgid "Error in krb5_auth_con_ini: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1226
+#: ../../src/kprop/kpropd.c:1223
 #, c-format
 msgid "Error in krb5_auth_con_setflags: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1239
+#: ../../src/kprop/kpropd.c:1236
 #, c-format
 msgid "Error in krb5_auth_con_setaddrs: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1247
+#: ../../src/kprop/kpropd.c:1244
 #, c-format
 msgid "Error in krb5_kt_resolve: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1256
+#: ../../src/kprop/kpropd.c:1253
 #, c-format
 msgid "Error in krb5_recvauth: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1263
+#: ../../src/kprop/kpropd.c:1260
 #, c-format
 msgid "Error in krb5_copy_prinicpal: %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1280
+#: ../../src/kprop/kpropd.c:1277
 msgid "while unparsing ticket etype"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1284
+#: ../../src/kprop/kpropd.c:1281
 #, c-format
 msgid "authenticated client: %s (etype == %s)\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1363
+#: ../../src/kprop/kpropd.c:1361
 msgid "while reading size of database from client"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1373
+#: ../../src/kprop/kpropd.c:1371
 msgid "while decoding database size from client"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1386
-msgid "while initializing i_vector"
+#: ../../src/kprop/kpropd.c:1379
+msgid "malformed database size message from client"
 msgstr ""
 
 #: ../../src/kprop/kpropd.c:1391
+msgid "while initializing i_vector"
+msgstr ""
+
+#: ../../src/kprop/kpropd.c:1396
 #, c-format
 msgid "Full propagation transfer started.\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1444
+#: ../../src/kprop/kpropd.c:1450
 #, c-format
 msgid "Full propagation transfer finished.\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1505
+#: ../../src/kprop/kpropd.c:1510
 msgid "while decoding error packet from client"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1514
+#: ../../src/kprop/kpropd.c:1519
 msgid "signaled from server"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1516
+#: ../../src/kprop/kpropd.c:1521
 #, c-format
 msgid "Error text from client: %s\n"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1565
+#: ../../src/kprop/kpropd.c:1570
 #, c-format
 msgid "while trying to fork %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1569
+#: ../../src/kprop/kpropd.c:1574
 #, c-format
 msgid "while trying to exec %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1576
+#: ../../src/kprop/kpropd.c:1581
 #, c-format
 msgid "while waiting for %s"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1582
+#: ../../src/kprop/kpropd.c:1587
 #, c-format
 msgid "%s load terminated"
 msgstr ""
 
-#: ../../src/kprop/kpropd.c:1588
+#: ../../src/kprop/kpropd.c:1593
 #, c-format
 msgid "%s returned a bad exit status (%d)"
 msgstr ""
@@ -4598,134 +4610,134 @@
 msgid "\tAttributes changed : %d\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:454
+#: ../../src/kprop/kproplog.c:462
 #, c-format
 msgid ""
 "Unable to initialize Kerberos\n"
 "\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:461
+#: ../../src/kprop/kproplog.c:469
 #, c-format
 msgid ""
 "Couldn't read database_name\n"
 "\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:465
+#: ../../src/kprop/kproplog.c:473
 #, c-format
 msgid ""
 "\n"
 "Kerberos update log (%s)\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:469 ../../src/kprop/kproplog.c:485
+#: ../../src/kprop/kproplog.c:477 ../../src/kprop/kproplog.c:493
 #, c-format
 msgid ""
 "Unable to map log file %s\n"
 "\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:474
+#: ../../src/kprop/kproplog.c:482
 #, c-format
 msgid ""
 "Couldn't reinitialize ulog file %s\n"
 "\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:478
+#: ../../src/kprop/kproplog.c:486
 #, c-format
 msgid "Reinitialized the ulog.\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:491
+#: ../../src/kprop/kproplog.c:499
 #, c-format
 msgid ""
 "Corrupt header log, exiting\n"
 "\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:495
+#: ../../src/kprop/kproplog.c:503
 #, c-format
 msgid "Update log dump :\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:496
+#: ../../src/kprop/kproplog.c:504
 #, c-format
 msgid "\tLog version # : %u\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:497
+#: ../../src/kprop/kproplog.c:505
 #, c-format
 msgid "\tLog state : "
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:500
+#: ../../src/kprop/kproplog.c:508
 #, c-format
 msgid "Stable\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:503
+#: ../../src/kprop/kproplog.c:511
 #, c-format
 msgid "Unstable\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:506
+#: ../../src/kprop/kproplog.c:514
 #, c-format
 msgid "Corrupt\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:509
+#: ../../src/kprop/kproplog.c:517
 #, c-format
 msgid "Unknown state: %d\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:512
+#: ../../src/kprop/kproplog.c:520
 #, c-format
 msgid "\tEntry block size : %u\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:513
+#: ../../src/kprop/kproplog.c:521
 #, c-format
 msgid "\tNumber of entries : %u\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:516
+#: ../../src/kprop/kproplog.c:524
 #, c-format
 msgid "\tLast serial # : None\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:519
+#: ../../src/kprop/kproplog.c:527
 #, c-format
 msgid "\tFirst serial # : None\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:521
+#: ../../src/kprop/kproplog.c:529
 #, c-format
 msgid "\tFirst serial # : "
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:525
+#: ../../src/kprop/kproplog.c:533
 #, c-format
 msgid "\tLast serial # : "
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:530
+#: ../../src/kprop/kproplog.c:538
 #, c-format
 msgid "\tLast time stamp : None\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:533
+#: ../../src/kprop/kproplog.c:541
 #, c-format
 msgid "\tFirst time stamp : None\n"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:535
+#: ../../src/kprop/kproplog.c:543
 #, c-format
 msgid "\tFirst time stamp : %s"
 msgstr ""
 
-#: ../../src/kprop/kproplog.c:539
+#: ../../src/kprop/kproplog.c:547
 #, c-format
 msgid "\tLast time stamp : %s\n"
 msgstr ""
@@ -4867,93 +4879,89 @@
 msgid "No addresses added to the net server"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:842
+#: ../../src/lib/apputils/net-server.c:845
 #, c-format
 msgid "Failed getting address info (for %s): %s"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:872
+#: ../../src/lib/apputils/net-server.c:875
 #, c-format
 msgid "Failed setting up a %s socket (for %s)"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:913
+#: ../../src/lib/apputils/net-server.c:916
 msgid "setting up network..."
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:916
+#: ../../src/lib/apputils/net-server.c:919
 msgid "Error setting up network"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:919
+#: ../../src/lib/apputils/net-server.c:922
 #, c-format
 msgid "set up %d sockets"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:922
+#: ../../src/lib/apputils/net-server.c:925
 msgid "no sockets set up?"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:985
-#: ../../src/lib/apputils/net-server.c:1039
+#: ../../src/lib/apputils/net-server.c:988
+#: ../../src/lib/apputils/net-server.c:1042
 msgid "while dispatching (udp)"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1014
+#: ../../src/lib/apputils/net-server.c:1017
 #, c-format
 msgid "while sending reply to %s/%s from %s"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1019
+#: ../../src/lib/apputils/net-server.c:1022
 #, c-format
 msgid "short reply write %d vs %d\n"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1064
+#: ../../src/lib/apputils/net-server.c:1067
 msgid "while receiving from network"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1107
+#: ../../src/lib/apputils/net-server.c:1110
 msgid "too many connections"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1125
+#: ../../src/lib/apputils/net-server.c:1128
 #, c-format
 msgid "dropping %s fd %d from %s"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1195
+#: ../../src/lib/apputils/net-server.c:1198
 #, c-format
 msgid "allocating buffer for new TCP session from %s"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1227
+#: ../../src/lib/apputils/net-server.c:1230
 msgid "while dispatching (tcp)"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1259
+#: ../../src/lib/apputils/net-server.c:1262
 msgid "error allocating tcp dispatch private!"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1306
+#: ../../src/lib/apputils/net-server.c:1309
 #, c-format
 msgid "TCP client %s wants %lu bytes, cap is %lu"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1314
+#: ../../src/lib/apputils/net-server.c:1317
 #, c-format
 msgid "error constructing KRB_ERR_FIELD_TOOLONG error! %s"
 msgstr ""
 
-#: ../../src/lib/apputils/net-server.c:1353
+#: ../../src/lib/apputils/net-server.c:1356
 #, c-format
 msgid "getsockname failed: %s"
 msgstr ""
 
-#: ../../src/lib/crypto/krb/prng_fortuna.c:428
-msgid "Random number generator could not be seeded"
-msgstr ""
-
 #: ../../src/lib/gssapi/generic/disp_major_status.c:43
 #: ../../src/lib/gssapi/mechglue/g_dsp_status.c:165
 msgid "A required input parameter could not be read"
@@ -5082,7 +5090,7 @@
 msgid "Unknown %s (field = %d)"
 msgstr ""
 
-#: ../../src/lib/gssapi/krb5/acquire_cred.c:153
+#: ../../src/lib/gssapi/krb5/acquire_cred.c:148
 #, c-format
 msgid "No key table entry found matching %s"
 msgstr ""
@@ -5321,36 +5329,36 @@
 msgid "No default realm set; cannot initialize KDB"
 msgstr ""
 
-#: ../../src/lib/kdb/kdb5.c:372
+#: ../../src/lib/kdb/kdb5.c:370
 #, c-format
 msgid "Unable to find requested database type: %s"
 msgstr ""
 
-#: ../../src/lib/kdb/kdb5.c:452 ../lib/krb5/error_tables/kdb5_err.c:55
+#: ../../src/lib/kdb/kdb5.c:450 ../lib/krb5/error_tables/kdb5_err.c:55
 msgid "Unable to find requested database type"
 msgstr ""
 
-#: ../../src/lib/kdb/kdb5.c:460
+#: ../../src/lib/kdb/kdb5.c:458
 msgid "plugin symbol 'kdb_function_table' lookup failed"
 msgstr ""
 
-#: ../../src/lib/kdb/kdb5.c:468
+#: ../../src/lib/kdb/kdb5.c:466
 #, c-format
 msgid ""
 "Unable to load requested database module '%s': plugin symbol "
 "'kdb_function_table' not found"
 msgstr ""
 
-#: ../../src/lib/kdb/kdb5.c:606
+#: ../../src/lib/kdb/kdb5.c:604
 msgid "Cannot initialize database library"
 msgstr ""
 
-#: ../../src/lib/kdb/kdb5.c:1765
+#: ../../src/lib/kdb/kdb5.c:1770
 #, c-format
 msgid "Illegal version number for KRB5_TL_MKEY_AUX %d\n"
 msgstr ""
 
-#: ../../src/lib/kdb/kdb5.c:1937
+#: ../../src/lib/kdb/kdb5.c:1942
 #, c-format
 msgid "Illegal version number for KRB5_TL_ACTKVNO %d\n"
 msgstr ""
@@ -5422,7 +5430,7 @@
 "collection"
 msgstr ""
 
-#: ../../src/lib/krb5/ccache/cc_kcm.c:740
+#: ../../src/lib/krb5/ccache/cc_kcm.c:908
 #, c-format
 msgid "Credentials cache 'KCM:%s' not found"
 msgstr ""
@@ -5438,16 +5446,16 @@
 msgid "Credentials cache keyring '%s' not found"
 msgstr ""
 
-#: ../../src/lib/krb5/ccache/cccursor.c:178
+#: ../../src/lib/krb5/ccache/cccursor.c:207
 #, c-format
 msgid "Can't find client principal %s in cache collection"
 msgstr ""
 
-#: ../../src/lib/krb5/ccache/cccursor.c:258
+#: ../../src/lib/krb5/ccache/cccursor.c:270
 msgid "No Kerberos credentials available"
 msgstr ""
 
-#: ../../src/lib/krb5/ccache/cccursor.c:264
+#: ../../src/lib/krb5/ccache/cccursor.c:276
 #, c-format
 msgid "No Kerberos credentials available (default cache: %s)"
 msgstr ""
@@ -5577,37 +5585,37 @@
 msgid "Reply has wrong form of session key for anonymous request"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/get_in_tkt.c:1576
+#: ../../src/lib/krb5/krb/get_in_tkt.c:1570
 #, c-format
 msgid "Warning: Your password will expire in less than one hour on %s"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/get_in_tkt.c:1580
+#: ../../src/lib/krb5/krb/get_in_tkt.c:1574
 #, c-format
 msgid "Warning: Your password will expire in %d hour%s on %s"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/get_in_tkt.c:1584
+#: ../../src/lib/krb5/krb/get_in_tkt.c:1578
 #, c-format
 msgid "Warning: Your password will expire in %d days on %s"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/get_in_tkt.c:1606
+#: ../../src/lib/krb5/krb/get_in_tkt.c:1600
 msgid ""
 "Warning: encryption type des3-cbc-sha1 used for authentication is weak and "
 "will be disabled"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/get_in_tkt.c:1816
+#: ../../src/lib/krb5/krb/get_in_tkt.c:1844
 msgid "Failed to store credentials"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/get_in_tkt.c:1912
+#: ../../src/lib/krb5/krb/get_in_tkt.c:1939
 #, c-format
 msgid "Client '%s' not found in Kerberos database"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/gic_keytab.c:224
+#: ../../src/lib/krb5/krb/gic_keytab.c:225
 #, c-format
 msgid "Keytab contains no suitable keys for %s"
 msgstr ""
@@ -5631,12 +5639,12 @@
 msgid "%.*s%s%s.  Please try again.\n"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/parse.c:201
+#: ../../src/lib/krb5/krb/parse.c:202
 #, c-format
 msgid "Principal %s is missing required realm"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/parse.c:213
+#: ../../src/lib/krb5/krb/parse.c:214
 #, c-format
 msgid "Principal %s has realm present"
 msgstr ""
@@ -5672,7 +5680,7 @@
 msgid "Encrypted timestamp is disabled"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/preauth_otp.c:515
+#: ../../src/lib/krb5/krb/preauth_otp.c:514
 msgid "Please choose from the following:\n"
 msgstr ""
 
@@ -5680,27 +5688,27 @@
 msgid "Vendor:"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/preauth_otp.c:528
+#: ../../src/lib/krb5/krb/preauth_otp.c:525
 msgid "Enter #"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/preauth_otp.c:564
+#: ../../src/lib/krb5/krb/preauth_otp.c:561
 msgid "OTP Challenge:"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/preauth_otp.c:593
+#: ../../src/lib/krb5/krb/preauth_otp.c:590
 msgid "OTP Token PIN"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/preauth_otp.c:707
+#: ../../src/lib/krb5/krb/preauth_otp.c:704
 msgid "OTP value doesn't match any token formats"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/preauth_otp.c:774
+#: ../../src/lib/krb5/krb/preauth_otp.c:771
 msgid "Enter OTP Token Value"
 msgstr ""
 
-#: ../../src/lib/krb5/krb/preauth_otp.c:920
+#: ../../src/lib/krb5/krb/preauth_otp.c:917
 msgid "No supported tokens"
 msgstr ""
 
@@ -6262,11 +6270,11 @@
 msgid "Default realm not set"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c:262
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c:264
 msgid "DN information missing"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c:474
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c:476
 msgid "dn information missing"
 msgstr ""
 
@@ -6300,68 +6308,68 @@
 msgid "ldap object is already kerberized"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:802
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:803
 msgid "Principal does not belong to the default realm"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:870
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:869
 #, c-format
 msgid ""
 "operation can not continue, more than one entry with principal name \"%s\" "
 "found"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:933
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:928
 #, c-format
 msgid "'%s' not found"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:997
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:992
 #, c-format
 msgid ""
 "link information can not be set/updated as the kerberos principal belongs to "
 "an ldap object"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1012
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1007
 #, c-format
 msgid "Failed getting object references"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1019
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1014
 #, c-format
 msgid "kerberos principal is already linked to a ldap object"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1345
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1340
 msgid "ticket policy object value: "
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1393
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1388
 #, c-format
 msgid "Principal delete failed (trying to replace entry): %s"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1403
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1398
 #, c-format
 msgid "Principal add failed: %s"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1441
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1436
 #, c-format
 msgid "User modification failed: %s"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1514
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1510
 #: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c:294
 msgid "Error reading ticket policy"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1644
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1640
 msgid "unable to decode stored principal key data"
 msgstr ""
 
-#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1702
+#: ../../src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c:1698
 msgid "unable to decode stored principal pw history"
 msgstr ""
 
@@ -6523,146 +6531,161 @@
 msgid "LMDB lockout update failure"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:496
+#: ../../src/plugins/preauth/pkinit/pkinit_clnt.c:1088
+msgid "No pkinit_anchors supplied"
+msgstr ""
+
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:957
 #, c-format
 msgid "%s: %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:526
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:987
 #, c-format
 msgid "%s (depth %d): %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:769
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4193
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1230
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4180
 msgid "Pass phrase for"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1093
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1103
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1359
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1369
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1846
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1516
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1526
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1784
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1794
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2271
 msgid "Failed to DER encode PKCS7"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1194
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1617
 msgid "Failed to verify own certificate"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1343
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1768
 msgid "Failed to add digest attribute"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1465
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1890
 msgid "Failed to decode CMS message"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1483
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1908
 msgid "Invalid pkinit packet: octet string expected"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1501
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1926
 msgid "wrong oid\n"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1653
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2078
 msgid "Failed to verify received certificate"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1689
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2114
 msgid "Failed to verify CMS message"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1834
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2259
 msgid "Failed to encrypt PKCS7 object"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1892
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2317
 msgid "Failed to decode PKCS7"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:1908
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2333
 msgid "Failed to decrypt PKCS7 message"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4313
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2756
+msgid "Failed to fetch SSKDF"
+msgstr ""
+
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2763
+msgid "Failed to instantiate SSKDF"
+msgstr ""
+
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2776
+msgid "Failed to derive key using SSKDF"
+msgstr ""
+
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:2838
+msgid "Failed to compute digest"
+msgstr ""
+
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4300
 #, c-format
 msgid "Cannot read certificate file '%s'"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4321
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:4308
 #, c-format
 msgid "Cannot read key file '%s'"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:5181
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:5165
 #, c-format
 msgid "Cannot open file '%s'"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:5188
+#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:5172
 #, c-format
 msgid "Cannot read file '%s'"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_crypto_openssl.c:5798
-#, c-format
-msgid "unknown code 0x%x"
-msgstr ""
-
-#: ../../src/plugins/preauth/pkinit/pkinit_identity.c:413
+#: ../../src/plugins/preauth/pkinit/pkinit_identity.c:415
 #, c-format
 msgid "Unsupported type while processing '%s'\n"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_identity.c:448
+#: ../../src/plugins/preauth/pkinit/pkinit_identity.c:451
 msgid "Internal error parsing X509_user_identity\n"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_identity.c:549
+#: ../../src/plugins/preauth/pkinit/pkinit_identity.c:552
 msgid "No user identity options specified"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:401
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:403
 #, c-format
 msgid "PKINIT: no freshness token, rejecting auth from %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:405
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:407
 #, c-format
 msgid "PKINIT: freshness token received from %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:407
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:409
 #, c-format
 msgid "PKINIT: no freshness token received from %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:510
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:512
 msgid "Pkinit request not signed, but client not anonymous."
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:544
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:546
 msgid "Anonymous pkinit without DH public value not supported."
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1086
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1082
 #, c-format
 msgid "No pkinit_identity supplied for realm %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1097
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1093
 #, c-format
 msgid "No pkinit_anchors supplied for realm %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1117
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1113
 #, c-format
 msgid "OCSP is not supported: (realm: %s)"
 msgstr ""
 
-#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1518
+#: ../../src/plugins/preauth/pkinit/pkinit_srv.c:1514
 msgid "No realms configured correctly for pkinit support"
 msgstr ""
 
@@ -6675,7 +6698,7 @@
 msgid "SPAKE challenge group not a permitted group: %s"
 msgstr ""
 
-#: ../../src/plugins/preauth/spake/spake_kdc.c:529
+#: ../../src/plugins/preauth/spake/spake_kdc.c:534
 msgid "Unknown SPAKE request type"
 msgstr ""
 
@@ -6692,26 +6715,26 @@
 msgid "error %ld"
 msgstr ""
 
-#: ../../src/util/support/plugins.c:200
+#: ../../src/util/support/plugins.c:201
 #, c-format
 msgid "unable to find plugin %s: %s"
 msgstr ""
 
-#: ../../src/util/support/plugins.c:288
+#: ../../src/util/support/plugins.c:291
 msgid "unknown failure"
 msgstr ""
 
-#: ../../src/util/support/plugins.c:291
+#: ../../src/util/support/plugins.c:294
 #, c-format
 msgid "unable to load plugin %s: %s"
 msgstr ""
 
-#: ../../src/util/support/plugins.c:314
+#: ../../src/util/support/plugins.c:317
 #, c-format
 msgid "unable to load DLL %s"
 msgstr ""
 
-#: ../../src/util/support/plugins.c:330
+#: ../../src/util/support/plugins.c:333
 #, c-format
 msgid "plugin unavailable: %s"
 msgstr ""
@@ -7307,6 +7330,10 @@
 msgid "Authorize and set hw-authent ticket flag"
 msgstr ""
 
+#: ../lib/krb5/error_tables/k5e1_err.c:36
+msgid "Set hw-authent ticket flag but do not authorize"
+msgstr ""
+
 #: ../lib/krb5/error_tables/krb5_err.c:24
 msgid "Client's entry in database has expired"
 msgstr ""

_service:tar_scm:krb5-1.19.2.tar.gz/src/prototype/prototype.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/prototype/prototype.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/prototype/prototype.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/prototype/prototype.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/Makefile.in Changed

@@ -1,17 +1,19 @@
 mydir=tests
 BUILDTOP=$(REL)..
-SUBDIRS = asn.1 create hammer verify gssapi dejagnu shlib gss-threads misc \
-	threads softpkcs11
+SUBDIRS = asn.1 create hammer verify gssapi shlib gss-threads misc threads \
+	softpkcs11
 
 RUN_DB_TEST = $(RUN_SETUP) KRB5_KDC_PROFILE=kdc.conf KRB5_CONFIG=krb5.conf \
 	GSS_MECH_CONFIG=mech.conf LC_ALL=C $(VALGRIND)
 
-OBJS= adata.o etinfo.o forward.o gcred.o hist.o hooks.o hrealm.o \
+OBJS= adata.o conccache.o etinfo.o forward.o gcred.o hist.o hooks.o hrealm.o \
 	icinterleave.o icred.o kdbtest.o localauth.o plugorder.o rdreq.o \
-	replay.o responder.o s2p.o s4u2self.o s4u2proxy.o unlockiter.o
-EXTRADEPSRCS= adata.c etinfo.c forward.c gcred.c hist.c hooks.c hrealm.c \
-	icinterleave.c icred.c kdbtest.c localauth.c plugorder.c rdreq.c \
-	replay.c responder.c s2p.c s4u2self.c s4u2proxy.c unlockiter.c
+	replay.o responder.o s2p.o s4u2self.o s4u2proxy.o t_inetd.o \
+	unlockiter.o
+EXTRADEPSRCS= adata.c conccache.c etinfo.c forward.c gcred.c hist.c hooks.c \
+	hrealm.c icinterleave.c icred.c kdbtest.c localauth.c plugorder.c \
+	rdreq.c replay.c responder.c s2p.c s4u2self.c s4u2proxy.c t_inetd.c \
+	unlockiter.c
 
 TEST_DB = ./testdb
 TEST_REALM = FOO.TEST.REALM
@@ -26,6 +28,9 @@
 adata: adata.o $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o $@ adata.o $(KRB5_BASE_LIBS)
 
+conccache: conccache.o $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o $@ conccache.o $(KRB5_BASE_LIBS)
+
 etinfo: etinfo.o $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o $@ etinfo.o $(KRB5_BASE_LIBS)
 
@@ -78,10 +83,15 @@
 s4u2proxy: s4u2proxy.o $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o $@ s4u2proxy.o $(KRB5_BASE_LIBS)
 
+t_inetd: t_inetd.o $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o $@ t_inetd.o $(LIBS) $(KRB5_BASE_LIBS)
+
 unlockiter: unlockiter.o $(KDB5_DEPLIBS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o $@ unlockiter.o $(KDB5_LIBS) $(KADMSRV_LIBS) \
 		$(KRB5_BASE_LIBS)
 
+all-unix: t_inetd
+
 check-unix: kdb_check
 
 kdc.conf: Makefile
@@ -118,9 +128,9 @@
 	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) destroy -f
 	$(RM) $(TEST_DB)* stash_file
 
-check-pytests: adata etinfo forward gcred hist hooks hrealm icinterleave icred
-check-pytests: kdbtest localauth plugorder rdreq replay responder s2p s4u2proxy
-check-pytests: unlockiter s4u2self
+check-pytests: adata conccache etinfo forward gcred hist hooks hrealm
+check-pytests: icinterleave icred kdbtest localauth plugorder rdreq replay
+check-pytests: responder s2p s4u2proxy unlockiter s4u2self
 	$(RUNPYTEST) $(srcdir)/t_general.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_hooks.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_dump.py $(PYTESTFLAGS)
@@ -147,6 +157,7 @@
 	$(RUNPYTEST) $(srcdir)/t_referral.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_skew.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_keytab.py $(PYTESTFLAGS)
+	$(RUNPYTEST) $(srcdir)/t_kadmin.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_kadmin_acl.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_kadmin_parsing.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_kdb.py $(PYTESTFLAGS)
@@ -182,9 +193,9 @@
 	$(RUNPYTEST) $(srcdir)/t_replay.py $(PYTESTFLAGS)
 
 clean:
-	$(RM) adata etinfo forward gcred hist hooks hrealm icinterleave icred
-	$(RM) kdbtest localauth plugorder rdreq replay responder s2p s4u2proxy
-	$(RM) unlockiter s4u2self
+	$(RM) adata conccache etinfo forward gcred hist hooks hrealm
+	$(RM) icinterleave icred kdbtest localauth plugorder rdreq replay
+	$(RM) responder s2p s4u2proxy s4u2self t_inetd unlockiter
 	$(RM) krb5.conf kdc.conf
 	$(RM) -rf kdc_realm/sandbox ldap
 	$(RM) au.log

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/adata.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/adata.c Changed

@@ -55,9 +55,10 @@
 
 static krb5_context ctx;
 
-static void display_authdata_list(krb5_authdata **list, krb5_keyblock *skey,
+static void display_authdata_list(krb5_authdata **list,
+                                  krb5_enc_tkt_part *enc_tkt,
                                   krb5_keyblock *tktkey, char prefix_byte,
-                                  krb5_boolean pac_expected);
+                                  krb5_boolean pac_ok);
 
 static void
 check(krb5_error_code code)
@@ -165,6 +166,43 @@
     return inner_ad;
 }
 
+static int
+compare_uint32(const void *p1, const void *p2)
+{
+    uint32_t t1 = *(uint32_t *)p1, t2 = *(uint32_t *)p2;
+
+    return (t1 > t2) ? 1 : (t1 == t2) ? 0 : -1;
+}
+
+static void
+display_pac(krb5_authdata *ad, krb5_enc_tkt_part *enc_tkt,
+            krb5_keyblock *tktkey)
+{
+    krb5_pac pac;
+    size_t tlen, i;
+    uint32_t *types;
+
+    assert(ad->ad_type == KRB5_AUTHDATA_WIN2K_PAC);
+    check(krb5_pac_parse(ctx, ad->contents, ad->length, &pac));
+
+    check(krb5_pac_verify(ctx, pac, enc_tkt->times.authtime, enc_tkt->client,
+                          tktkey, NULL));
+
+    check(krb5_pac_get_types(ctx, pac, &tlen, &types));
+    qsort(types, tlen, sizeof(*types), compare_uint32);
+
+    printf("");
+    for (i = 0; i < tlen; i++) {
+        printf("%d", (int)typesi);
+        if (i + 1 < tlen)
+            printf(", ");
+    }
+    printf("");
+
+    free(types);
+    krb5_pac_free(ctx, pac);
+}
+
 /* Decode and display authentication indicator authdata. */
 static void
 display_auth_indicator(krb5_authdata *ad)
@@ -206,8 +244,8 @@
 /* Display the contents of an authdata element, prefixed by prefix_byte.  skey
  * must be the ticket session key. */
 static void
-display_authdata(krb5_authdata *ad, krb5_keyblock *skey, krb5_keyblock *tktkey,
-                 int prefix_byte, krb5_boolean pac_expected)
+display_authdata(krb5_authdata *ad, krb5_enc_tkt_part *enc_tkt,
+                 krb5_keyblock *tktkey, int prefix_byte, krb5_boolean pac_ok)
 {
     krb5_authdata **inner_ad;
 
@@ -216,21 +254,23 @@
         ad->ad_type == KRB5_AUTHDATA_KDC_ISSUED ||
         ad->ad_type == KRB5_AUTHDATA_CAMMAC) {
         if (ad->ad_type != KRB5_AUTHDATA_IF_RELEVANT)
-            pac_expected = FALSE;
+            pac_ok = FALSE;
         /* Decode and display the contents. */
-        inner_ad = get_container_contents(ad, skey, tktkey);
-        display_authdata_list(inner_ad, skey, tktkey, get_prefix_byte(ad),
-                              pac_expected);
+        inner_ad = get_container_contents(ad, enc_tkt->session, tktkey);
+        display_authdata_list(inner_ad, enc_tkt, tktkey, get_prefix_byte(ad),
+                              pac_ok);
         krb5_free_authdata(ctx, inner_ad);
         return;
     }
 
-    assert(!pac_expected || ad->ad_type == KRB5_AUTHDATA_WIN2K_PAC);
+    assert(pac_ok || ad->ad_type != KRB5_AUTHDATA_WIN2K_PAC);
 
     printf("%c", prefix_byte);
     printf("%d: ", (int)ad->ad_type);
 
-    if (ad->ad_type == KRB5_AUTHDATA_AUTH_INDICATOR)
+    if (ad->ad_type == KRB5_AUTHDATA_WIN2K_PAC)
+        display_pac(ad, enc_tkt, tktkey);
+    else if (ad->ad_type == KRB5_AUTHDATA_AUTH_INDICATOR)
         display_auth_indicator(ad);
     else
         display_binary_or_ascii(ad);
@@ -238,46 +278,19 @@
 }
 
 static void
-display_authdata_list(krb5_authdata **list, krb5_keyblock *skey,
+display_authdata_list(krb5_authdata **list, krb5_enc_tkt_part *tkt_enc,
                       krb5_keyblock *tktkey, char prefix_byte,
-                      krb5_boolean pac_expected)
+                      krb5_boolean pac_ok)
 {
     if (list == NULL)
         return;
     /* Only expect a PAC in the first element, if at all. */
     for (; *list != NULL; list++) {
-        display_authdata(*list, skey, tktkey, prefix_byte, pac_expected);
-        pac_expected = FALSE;
+        display_authdata(*list, tkt_enc, tktkey, prefix_byte, pac_ok);
+        pac_ok = FALSE;
     }
 }
 
-/* If a PAC is present in enc_part2, verify its service signature with key and
- * set *has_pac to true. */
-static void
-check_pac(krb5_context context, krb5_enc_tkt_part *enc_part2,
-          const krb5_keyblock *key, krb5_boolean *has_pac)
-{
-    krb5_authdata **authdata;
-    krb5_pac pac;
-
-    *has_pac = FALSE;
-
-    check(krb5_find_authdata(context, enc_part2->authorization_data, NULL,
-                             KRB5_AUTHDATA_WIN2K_PAC, &authdata));
-    if (authdata == NULL)
-        return;
-
-    assert(authdata1 == NULL);
-    check(krb5_pac_parse(context, authdata0->contents, authdata0->length,
-                         &pac));
-    krb5_free_authdata(context, authdata);
-
-    check(krb5_pac_verify(context, pac, enc_part2->times.authtime,
-                          enc_part2->client, key, NULL));
-    krb5_pac_free(context, pac);
-    *has_pac = TRUE;
-}
-
 int
 main(int argc, char **argv)
 {
@@ -289,7 +302,6 @@
     krb5_ticket *ticket;
     krb5_authdata **req_authdata = NULL, *ad;
     krb5_keytab_entry ktent;
-    krb5_boolean with_pac;
     size_t count;
     int c;
 
@@ -349,10 +361,8 @@
                             ticket->enc_part.enctype, &ktent));
     check(krb5_decrypt_tkt_part(ctx, &ktent.key, ticket));
 
-    check_pac(ctx, ticket->enc_part2, &ktent.key, &with_pac);
     display_authdata_list(ticket->enc_part2->authorization_data,
-                          ticket->enc_part2->session, &ktent.key, ' ',
-                          with_pac);
+                          ticket->enc_part2, &ktent.key, ' ', TRUE);
 
     while (count > 0) {
         free(req_authdata--count->contents);

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/krb5_decode_leak.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/krb5_decode_leak.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/krb5_decode_test.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/krb5_decode_test.c Changed

@@ -104,6 +104,7 @@
     }                                                                   \
     test(1,typestring);                                                 \
     printf("%s\n",description);                                         \
+    krb5_free_data_contents(test_context, &code);                       \
 } while (0)
 
     /****************************************************************/
@@ -998,14 +999,6 @@
     }
 
     /****************************************************************/
-    /* decode_ad_signedpath */
-    {
-        setup(krb5_ad_signedpath,ktest_make_sample_ad_signedpath);
-        decode_run("ad_signedpath","","30 3E A0 03 02 01 01 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61",decode_krb5_ad_signedpath,ktest_equal_ad_signedpath,krb5_free_ad_signedpath);
-        ktest_empty_ad_signedpath(&ref);
-    }
-
-    /****************************************************************/
     /* decode_iakerb_header */
     {
         setup(krb5_iakerb_header,ktest_make_sample_iakerb_header);
@@ -1182,7 +1175,7 @@
     /* decode_krb5_auth_pack */
     {
         setup(krb5_auth_pack,ktest_make_sample_auth_pack);
-        decode_run("krb5_auth_pack","","30 81 93 A0 29 30 27 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A1 22 30 20 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 03 09 00 6B 72 62 35 64 61 74 61 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
+        decode_run("krb5_auth_pack","","30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
                    acc.decode_krb5_auth_pack,
                    ktest_equal_auth_pack,ktest_free_auth_pack);
         ktest_empty_auth_pack(&ref);

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/krb5_encode_test.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/krb5_encode_test.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/ktest.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/ktest.c Changed

@@ -560,28 +560,6 @@
 }
 
 void
-ktest_make_sample_ad_signedpath_data(krb5_ad_signedpath_data *p)
-{
-    ktest_make_sample_principal(&p->client);
-    p->authtime = SAMPLE_TIME;
-    p->delegated = ealloc(2 * sizeof(krb5_principal));
-    ktest_make_sample_principal(&p->delegated0);
-    p->delegated1 = NULL;
-    ktest_make_sample_authorization_data(&p->authorization_data);
-    ktest_make_sample_pa_data_array(&p->method_data);
-}
-
-void
-ktest_make_sample_ad_signedpath(krb5_ad_signedpath *p)
-{
-    p->enctype = 1;
-    ktest_make_sample_checksum(&p->checksum);
-    p->delegated = ealloc(2 * sizeof(krb5_principal));
-    p->delegated1 = NULL;
-    ktest_make_sample_pa_data_array(&p->method_data);
-}
-
-void
 ktest_make_sample_iakerb_header(krb5_iakerb_header *ih)
 {
     ktest_make_sample_data(&(ih->target_realm));
@@ -751,13 +729,6 @@
 }
 
 static void
-ktest_make_sample_subject_pk_info(krb5_subject_pk_info *p)
-{
-    ktest_make_sample_algorithm_identifier(&p->algorithm);
-    ktest_make_sample_data(&p->subjectPublicKey);
-}
-
-static void
 ktest_make_sample_external_principal_identifier(
     krb5_external_principal_identifier *p)
 {
@@ -806,8 +777,8 @@
 ktest_make_sample_auth_pack(krb5_auth_pack *p)
 {
     ktest_make_sample_pk_authenticator(&p->pkAuthenticator);
-    p->clientPublicValue = ealloc(sizeof(krb5_subject_pk_info));
-    ktest_make_sample_subject_pk_info(p->clientPublicValue);
+    /* Need a valid DER encoding here; this is the OCTET STRING "pvalue". */
+    krb5_data_parse(&p->clientPublicValue, "\x04\x06" "pvalue");
     p->supportedCMSTypes = ealloc(3 * sizeof(krb5_algorithm_identifier *));
     p->supportedCMSTypes0 = ealloc(sizeof(krb5_algorithm_identifier));
     ktest_make_sample_algorithm_identifier(p->supportedCMSTypes0);
@@ -1532,39 +1503,6 @@
 }
 
 void
-ktest_empty_ad_signedpath_data(krb5_ad_signedpath_data *p)
-{
-    int i;
-
-    ktest_destroy_principal(&p->client);
-    if (p->delegated != NULL) {
-        for (i = 0; p->delegatedi != NULL; i++) {
-            krb5_principal princ = p->delegatedi;
-            ktest_destroy_principal(&princ);
-        }
-        free(p->delegated);
-    }
-    ktest_destroy_pa_data_array(&p->method_data);
-    ktest_destroy_authorization_data(&p->authorization_data);
-}
-
-void
-ktest_empty_ad_signedpath(krb5_ad_signedpath *p)
-{
-    int i;
-
-    free(p->checksum.contents);
-    if (p->delegated != NULL) {
-        for (i = 0; p->delegatedi != NULL; i++) {
-            krb5_principal princ = p->delegatedi;
-            ktest_destroy_principal(&princ);
-        }
-        free(p->delegated);
-    }
-    ktest_destroy_pa_data_array(&p->method_data);
-}
-
-void
 ktest_empty_iakerb_header(krb5_iakerb_header *p)
 {
     krb5_free_data_contents(NULL, &p->target_realm);
@@ -1673,13 +1611,6 @@
 }
 
 static void
-ktest_empty_subject_pk_info(krb5_subject_pk_info *p)
-{
-    ktest_empty_algorithm_identifier(&p->algorithm);
-    ktest_empty_data(&p->subjectPublicKey);
-}
-
-static void
 ktest_empty_external_principal_identifier(
     krb5_external_principal_identifier *p)
 {
@@ -1728,11 +1659,7 @@
     krb5_data **d;
 
     ktest_empty_pk_authenticator(&p->pkAuthenticator);
-    if (p->clientPublicValue != NULL) {
-        ktest_empty_subject_pk_info(p->clientPublicValue);
-        free(p->clientPublicValue);
-        p->clientPublicValue = NULL;
-    }
+    ktest_empty_data(&p->clientPublicValue);
     if (p->supportedCMSTypes != NULL) {
         for (ai = p->supportedCMSTypes; *ai != NULL; ai++) {
             ktest_empty_algorithm_identifier(*ai);

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/ktest.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/ktest.h Changed

@@ -85,8 +85,6 @@
 void ktest_make_sample_pa_for_user(krb5_pa_for_user *p);
 void ktest_make_sample_pa_s4u_x509_user(krb5_pa_s4u_x509_user *p);
 void ktest_make_sample_ad_kdcissued(krb5_ad_kdcissued *p);
-void ktest_make_sample_ad_signedpath_data(krb5_ad_signedpath_data *p);
-void ktest_make_sample_ad_signedpath(krb5_ad_signedpath *p);
 void ktest_make_sample_iakerb_header(krb5_iakerb_header *p);
 void ktest_make_sample_iakerb_finished(krb5_iakerb_finished *p);
 void ktest_make_sample_fast_response(krb5_fast_response *p);
@@ -179,8 +177,6 @@
 void ktest_empty_pa_for_user(krb5_pa_for_user *p);
 void ktest_empty_pa_s4u_x509_user(krb5_pa_s4u_x509_user *p);
 void ktest_empty_ad_kdcissued(krb5_ad_kdcissued *p);
-void ktest_empty_ad_signedpath_data(krb5_ad_signedpath_data *p);
-void ktest_empty_ad_signedpath(krb5_ad_signedpath *p);
 void ktest_empty_iakerb_header(krb5_iakerb_header *p);
 void ktest_empty_iakerb_finished(krb5_iakerb_finished *p);
 void ktest_empty_fast_response(krb5_fast_response *p);

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/ktest_equal.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/ktest_equal.c Changed

@@ -538,34 +538,6 @@
 }
 
 int
-ktest_equal_ad_signedpath_data(krb5_ad_signedpath_data *ref,
-                               krb5_ad_signedpath_data *var)
-{
-    int p = TRUE;
-    if (ref == var) return TRUE;
-    else if (ref == NULL || var == NULL) return FALSE;
-    p = p && ptr_equal(client,ktest_equal_principal_data);
-    p = p && scalar_equal(authtime);
-    p = p && ptr_equal(delegated,ktest_equal_sequence_of_principal);
-    p = p && ptr_equal(method_data,ktest_equal_sequence_of_pa_data);
-    p = p && ptr_equal(authorization_data,ktest_equal_authorization_data);
-    return p;
-}
-
-int
-ktest_equal_ad_signedpath(krb5_ad_signedpath *ref, krb5_ad_signedpath *var)
-{
-    int p = TRUE;
-    if (ref == var) return TRUE;
-    else if (ref == NULL || var == NULL) return FALSE;
-    p = p && scalar_equal(enctype);
-    p = p && struct_equal(checksum,ktest_equal_checksum);
-    p = p && ptr_equal(delegated,ktest_equal_sequence_of_principal);
-    p = p && ptr_equal(method_data,ktest_equal_sequence_of_pa_data);
-    return p;
-}
-
-int
 ktest_equal_iakerb_header(krb5_iakerb_header *ref, krb5_iakerb_header *var)
 {
     int p = TRUE;
@@ -877,18 +849,6 @@
 }
 
 static int
-ktest_equal_subject_pk_info(krb5_subject_pk_info *ref,
-                            krb5_subject_pk_info *var)
-{
-    int p = TRUE;
-    if (ref == var) return TRUE;
-    else if (ref == NULL || var == NULL) return FALSE;
-    p = p && struct_equal(algorithm, ktest_equal_algorithm_identifier);
-    p = p && equal_str(subjectPublicKey);
-    return p;
-}
-
-static int
 ktest_equal_external_principal_identifier(
     krb5_external_principal_identifier *ref,
     krb5_external_principal_identifier *var)
@@ -962,7 +922,7 @@
     if (ref == var) return TRUE;
     else if (ref == NULL || var == NULL) return FALSE;
     p = p && struct_equal(pkAuthenticator, ktest_equal_pk_authenticator);
-    p = p && ptr_equal(clientPublicValue, ktest_equal_subject_pk_info);
+    p = p && equal_str(clientPublicValue);
     p = p && ptr_equal(supportedCMSTypes,
                        ktest_equal_sequence_of_algorithm_identifier);
     p = p && equal_str(clientDHNonce);

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/ktest_equal.h -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/ktest_equal.h Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/pkinit_encode.out -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/pkinit_encode.out Changed

@@ -1,7 +1,7 @@
 encode_krb5_pa_pk_as_req: 30 38 80 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 1E 80 08 6B 72 62 35 64 61 74 61 81 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_pk_as_rep(dhInfo): A0 28 30 26 80 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_pk_as_rep(encKeyPack): 81 08 6B 72 62 35 64 61 74 61
-encode_krb5_auth_pack: 30 81 9F A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 03 09 00 6B 72 62 35 64 61 74 61 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
+encode_krb5_auth_pack: 30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
 encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03 02 01 2A A2 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
 encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
 encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/pkinit_trval.out -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/pkinit_trval.out Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/reference_encode.out -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/reference_encode.out Changed

@@ -55,8 +55,6 @@
 encode_krb5_pa_for_user: 30 4B A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 0A 1B 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_s4u_x509_user: 30 68 A0 55 30 53 A0 06 02 04 00 CA 14 9A A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 12 04 10 70 61 5F 73 34 75 5F 78 35 30 39 5F 75 73 65 72 A4 07 03 05 00 80 00 00 00 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
 encode_krb5_ad_kdcissued: 30 65 A0 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A3 24 30 22 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72
-encode_krb5_ad_signedpath_data: 30 81 C7 A0 30 30 2E A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 32 30 30 30 2E A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 A4 24 30 22 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72
-encode_krb5_ad_signedpath: 30 3E A0 03 02 01 01 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61
 encode_krb5_iakerb_header: 30 18 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
 encode_krb5_iakerb_finished: 30 11 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
 encode_krb5_fast_response: 30 81 9F A0 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 A1 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A2 5B 30 59 A0 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A1 05 02 03 01 E2 40 A2 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A4 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 03 02 01 2A

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/asn.1/trval_reference.out -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/asn.1/trval_reference.out Changed

@@ -1251,55 +1251,6 @@
 .  .  .  0 Integer 1
 .  .  .  1 Octet String "foobar"
 
-encode_krb5_ad_signedpath_data:
-
-Sequence/Sequence Of
-.  0 Sequence/Sequence Of
-.  .  0 Sequence/Sequence Of
-.  .  .  0 Integer 1
-.  .  .  1 Sequence/Sequence Of
-.  .  .  .  General string "hftsai"
-.  .  .  .  General string "extra"
-.  .  1 General string "ATHENA.MIT.EDU"
-.  1 Generalized Time "19940610060317Z"
-.  2 Sequence/Sequence Of
-.  .  Sequence/Sequence Of
-.  .  .  0 Sequence/Sequence Of
-.  .  .  .  0 Integer 1
-.  .  .  .  1 Sequence/Sequence Of
-.  .  .  .  .  General string "hftsai"
-.  .  .  .  .  General string "extra"
-.  .  .  1 General string "ATHENA.MIT.EDU"
-.  3 Sequence/Sequence Of
-.  .  Sequence/Sequence Of
-.  .  .  1 Integer 13
-.  .  .  2 Octet String "pa-data"
-.  .  Sequence/Sequence Of
-.  .  .  1 Integer 13
-.  .  .  2 Octet String "pa-data"
-.  4 Sequence/Sequence Of
-.  .  Sequence/Sequence Of
-.  .  .  0 Integer 1
-.  .  .  1 Octet String "foobar"
-.  .  Sequence/Sequence Of
-.  .  .  0 Integer 1
-.  .  .  1 Octet String "foobar"
-
-encode_krb5_ad_signedpath:
-
-Sequence/Sequence Of
-.  0 Integer 1
-.  1 Sequence/Sequence Of
-.  .  0 Integer 1
-.  .  1 Octet String "1234"
-.  3 Sequence/Sequence Of
-.  .  Sequence/Sequence Of
-.  .  .  1 Integer 13
-.  .  .  2 Octet String "pa-data"
-.  .  Sequence/Sequence Of
-.  .  .  1 Integer 13
-.  .  .  2 Octet String "pa-data"
-
 encode_krb5_iakerb_header:
 
 Sequence/Sequence Of

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/conccache.c Added

@@ -0,0 +1,190 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* tests/conccache.c - ccache concurrent get_creds/refresh test program */
+/*
+ * Copyright (C) 2021 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Usage: conccache ccname clientprinc serverprinc
+ *
+ * This program spawns two subprocesses.  One repeatedly runs
+ * krb5_get_credentials() on ccname, and the other repeatedly refreshes ccname
+ * from the default keytab.  If either subprocess fails, the program exits with
+ * status 1.  The goal is to expose time windows where cache refreshes cause
+ * get_cred operations to fail.
+ */
+
+#include "k5-platform.h"
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <pthread.h>
+#include <krb5.h>
+
+/* Run this many iterations of each operation. */
+static const int iterations = 200;
+
+/* Saved command-line arguments. */
+static const char *ccname, *server_name, *client_name;
+
+static void
+check(krb5_error_code code)
+{
+    if (code)
+        abort();
+}
+
+static krb5_boolean
+get_cred(krb5_context context)
+{
+    krb5_error_code ret;
+    krb5_ccache cc;
+    krb5_principal client, server;
+    krb5_creds mcred, *cred;
+
+    check(krb5_cc_resolve(context, ccname, &cc));
+    check(krb5_parse_name(context, client_name, &client));
+    check(krb5_parse_name(context, server_name, &server));
+
+    memset(&mcred, 0, sizeof(mcred));
+    mcred.client = client;
+    mcred.server = server;
+    ret = krb5_get_credentials(context, 0, cc, &mcred, &cred);
+
+    krb5_free_creds(context, cred);
+    krb5_free_principal(context, client);
+    krb5_free_principal(context, server);
+    krb5_cc_close(context, cc);
+
+    return ret == 0;
+}
+
+static krb5_boolean
+refresh_cache(krb5_context context)
+{
+    krb5_error_code ret;
+    krb5_ccache cc;
+    krb5_principal client;
+    krb5_get_init_creds_opt *opt;
+    krb5_creds cred;
+
+    check(krb5_cc_resolve(context, ccname, &cc));
+    check(krb5_parse_name(context, client_name, &client));
+
+    check(krb5_get_init_creds_opt_alloc(context, &opt));
+    check(krb5_get_init_creds_opt_set_out_ccache(context, opt, cc));
+    ret = krb5_get_init_creds_keytab(context, &cred, client, NULL, 0, NULL,
+                                     opt);
+
+    krb5_get_init_creds_opt_free(context, opt);
+    krb5_free_cred_contents(context, &cred);
+    krb5_free_principal(context, client);
+    krb5_cc_close(context, cc);
+
+    return ret == 0;
+}
+
+static pid_t
+spawn_cred_subprocess()
+{
+    krb5_context context;
+    pid_t pid;
+    int i;
+
+    pid = fork();
+    assert(pid >= 0);
+    if (pid > 0)
+        return pid;
+
+    check(krb5_init_context(&context));
+    for (i = 0; i < iterations; i++) {
+        if (!get_cred(context)) {
+            fprintf(stderr, "cred worker failed after %d successes\n", i);
+            exit(1);
+        }
+    }
+    krb5_free_context(context);
+    exit(0);
+}
+
+static pid_t
+spawn_refresh_subprocess()
+{
+    krb5_context context;
+    pid_t pid;
+    int i;
+
+    pid = fork();
+    assert(pid >= 0);
+    if (pid > 0)
+        return pid;
+
+    check(krb5_init_context(&context));
+    for (i = 0; i < iterations; i++) {
+        if (!refresh_cache(context)) {
+            fprintf(stderr, "refresh worker failed after %d successes\n", i);
+            exit(1);
+        }
+    }
+    krb5_free_context(context);
+    exit(0);
+}
+
+int
+main(int argc, char *argv)
+{
+    krb5_context context;
+    pid_t cred_pid, refresh_pid, pid;
+    int cstatus, rstatus;
+
+    assert(argc == 4);
+    ccname = argv1;
+    client_name = argv2;
+    server_name = argv3;
+
+    /* Begin with an initialized cache. */
+    check(krb5_init_context(&context));
+    refresh_cache(context);
+    krb5_free_context(context);
+
+    cred_pid = spawn_cred_subprocess();
+    refresh_pid = spawn_refresh_subprocess();
+
+    pid = waitpid(cred_pid, &cstatus, 0);
+    if (pid == -1)
+        abort();
+    pid = waitpid(refresh_pid, &rstatus, 0);
+    if (pid == -1)
+        abort();
+
+    if (!WIFEXITED(cstatus) || WEXITSTATUS(cstatus) != 0)
+        return 1;
+    if (!WIFEXITED(rstatus) || WEXITSTATUS(rstatus) != 0)
+        return 1;
+    return 0;
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/deps Changed

@@ -11,6 +11,10 @@
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
   $(top_srcdir)/include/socket-utils.h adata.c
+$(OUTPRE)conccache.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-platform.h \
+  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/krb5.h \
+  conccache.c
 $(OUTPRE)etinfo.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
@@ -163,6 +167,8 @@
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
   $(top_srcdir)/include/socket-utils.h s4u2proxy.c
+$(OUTPRE)t_inetd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(COM_ERR_DEPS) t_inetd.c
 $(OUTPRE)unlockiter.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
   $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \
   $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gss-threads/gss-misc.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gss-threads/gss-misc.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gss-threads/gss-server.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gss-threads/gss-server.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gssapi/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/Makefile.in Changed

@@ -19,7 +19,7 @@
 	$(srcdir)/t_lifetime.c $(srcdir)/t_namingexts.c $(srcdir)/t_oid.c \
 	$(srcdir)/t_pcontok.c $(srcdir)/t_prf.c $(srcdir)/t_s4u.c \
 	$(srcdir)/t_s4u2proxy_krb5.c $(srcdir)/t_saslname.c \
-	$(srcdir)/t_spnego.c $(srcdir)/t_srcattrs.c
+	$(srcdir)/t_spnego.c $(srcdir)/t_srcattrs.c $(srcdir)/t_store_cred.c
 
 OBJS=	ccinit.o ccrefresh.o common.o reload.o t_accname.o t_add_cred.o \
 	t_bindings.o t_ccselect.o t_ciflags.o t_context.o t_credstore.o \
@@ -27,7 +27,7 @@
 	t_imp_cred.o t_imp_name.o t_invalid.o t_inq_cred.o t_inq_ctx.o \
 	t_inq_mechs_name.o t_iov.o t_lifetime.o t_namingexts.o t_oid.o \
 	t_pcontok.o t_prf.o t_s4u.o t_s4u2proxy_krb5.o t_saslname.o \
-	t_spnego.o t_srcattrs.o
+	t_spnego.o t_srcattrs.o t_store_cred.o
 
 COMMON_DEPS= common.o $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS)
 COMMON_LIBS= common.o $(GSS_LIBS) $(KRB5_BASE_LIBS)
@@ -36,7 +36,7 @@
 	t_context t_credstore t_enctypes t_err t_export_cred t_export_name \
 	t_gssexts t_imp_cred t_imp_name t_invalid t_inq_cred t_inq_ctx \
 	t_inq_mechs_name t_iov t_lifetime t_namingexts t_oid t_pcontok t_prf \
-	t_s4u t_s4u2proxy_krb5 t_saslname t_spnego t_srcattrs
+	t_s4u t_s4u2proxy_krb5 t_saslname t_spnego t_srcattrs t_store_cred
 
 check-unix: t_oid reload
 	$(RUN_TEST) ./t_invalid
@@ -48,8 +48,10 @@
 check-pytests: ccinit ccrefresh t_accname t_add_cred t_bindings t_ccselect \
 	t_ciflags t_context t_credstore t_enctypes t_err t_export_cred \
 	t_export_name t_imp_cred t_inq_cred t_inq_ctx t_inq_mechs_name t_iov \
-	t_lifetime t_pcontok t_s4u t_s4u2proxy_krb5 t_spnego t_srcattrs
+	t_lifetime t_pcontok t_s4u t_s4u2proxy_krb5 t_spnego t_srcattrs \
+	t_store_cred
 	$(RUNPYTEST) $(srcdir)/t_gssapi.py $(PYTESTFLAGS)
+	$(RUNPYTEST) $(srcdir)/t_store_cred.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_credstore.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_bindings.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_ccselect.py $(PYTESTFLAGS)
@@ -65,7 +67,7 @@
 ccrefresh: ccrefresh.o $(KRB5_BASE_DEPLIBS)
 	$(CC_LINK) -o ccrefresh ccrefresh.o $(KRB5_BASE_LIBS)
 reload: reload.o
-	$(CC_LINK) -o $@ reload.o $(DL_LIB)
+	$(CC_LINK) -o $@ reload.o $(LIBS) $(DL_LIB)
 t_accname: t_accname.o $(COMMON_DEPS)
 	$(CC_LINK) -o $@ t_accname.o $(COMMON_LIBS)
 t_add_cred: t_add_cred.o $(COMMON_DEPS)
@@ -124,6 +126,8 @@
 	$(CC_LINK) -o $@ t_spnego.o $(COMMON_LIBS)
 t_srcattrs: t_srcattrs.o $(COMMON_DEPS)
 	$(CC_LINK) -o $@ t_srcattrs.o $(COMMON_LIBS)
+t_store_cred: t_store_cred.o $(COMMON_DEPS)
+	$(CC_LINK) -o $@ t_store_cred.o $(COMMON_LIBS)
 
 clean:
 	$(RM) ccinit ccrefresh reload t_accname t_add_cred t_bindings
@@ -131,4 +135,4 @@
 	$(RM) t_export_cred t_export_name t_gssexts t_imp_cred t_imp_name
 	$(RM) t_invalid t_inq_cred t_inq_ctx t_inq_mechs_name t_iov t_lifetime
 	$(RM) t_namingexts t_oid t_pcontok t_prf t_s4u t_s4u2proxy_krb5
-	$(RM) t_saslname t_spnego t_srcattrs
+	$(RM) t_saslname t_spnego t_srcattrs t_store_cred

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gssapi/common.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/common.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gssapi/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/deps Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gssapi/t_client_keytab.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/t_client_keytab.py Changed

@@ -141,5 +141,49 @@
         '/Matching credential not found')
 realm.run('./t_ccselect', phost, expected_code=1,
           expected_msg='Ticket expired', expected_trace=msgs)
+realm.run(kdestroy, '-A')
+
+# Test 19: host-based initiator name
+mark('host-based initiator name')
+hsvc = 'h:svc@' + hostname
+svcprinc = 'svc/%s@%s' % (hostname, realm.realm)
+realm.addprinc(svcprinc)
+realm.extract_keytab(svcprinc, realm.client_keytab)
+# On the first run we match against the keytab while getting tickets,
+# substituting the default realm.
+msgs = ('/Can\'t find client principal svc/%s@ in' % hostname,
+        'Getting initial credentials for svc/%s@' % hostname,
+        'Found entries for %s in keytab' % svcprinc,
+        'Retrieving %s from FILE:%s' % (svcprinc, realm.client_keytab),
+        'Storing %s -> %s in' % (svcprinc, realm.krbtgt_princ),
+        'Retrieving %s -> %s from' % (svcprinc, realm.krbtgt_princ),
+        'authenticator for %s -> %s' % (svcprinc, realm.host_princ))
+realm.run('./t_ccselect', phost, hsvc, expected_trace=msgs)
+# On the second run we match against the collection.
+msgs = ('Matching svc/%s@ in collection with result: 0' % hostname,
+        'Getting credentials %s -> %s' % (svcprinc, realm.host_princ),
+        'authenticator for %s -> %s' % (svcprinc, realm.host_princ))
+realm.run('./t_ccselect', phost, hsvc, expected_trace=msgs)
+realm.run(kdestroy, '-A')
+
+# Test 20: host-based initiator name with fallback
+mark('host-based fallback initiator name')
+canonname = canonicalize_hostname(hostname)
+if canonname != hostname:
+    hfsvc = 'h:fsvc@' + hostname
+    canonprinc = 'fsvc/%s@%s' % (canonname, realm.realm)
+    realm.addprinc(canonprinc)
+    realm.extract_keytab(canonprinc, realm.client_keytab)
+    msgs = ('/Can\'t find client principal fsvc/%s@ in' % hostname,
+            'Found entries for %s in keytab' % canonprinc,
+            'authenticator for %s -> %s' % (canonprinc, realm.host_princ))
+    realm.run('./t_ccselect', phost, hfsvc, expected_trace=msgs)
+    msgs = ('Matching fsvc/%s@ in collection with result: 0' % hostname,
+            'Getting credentials %s -> %s' % (canonprinc, realm.host_princ))
+    realm.run('./t_ccselect', phost, hfsvc, expected_trace=msgs)
+    realm.run(kdestroy, '-A')
+else:
+    skipped('GSS initiator name fallback test',
+            '%s does not canonicalize to a different name' % hostname)
 
 success('Client keytab tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gssapi/t_credstore.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/t_credstore.py Changed

@@ -9,19 +9,50 @@
 realm.addprinc(service_cs)
 realm.extract_keytab(service_cs, servicekeytab)
 realm.kinit(service_cs, None, '-k', '-t', servicekeytab)
-msgs = ('Storing %s -> %s in %s' % (service_cs, realm.krbtgt_princ,
-                                    storagecache),
+msgs = ('Storing %s -> %s in MEMORY:' % (service_cs, realm.krbtgt_princ),
+        'Moving ccache MEMORY:',
         'Retrieving %s from FILE:%s' % (service_cs, servicekeytab))
 realm.run('./t_credstore', '-s', 'p:' + service_cs, 'ccache', storagecache,
            'keytab', servicekeytab, expected_trace=msgs)
 
+mark('matching')
+scc = 'FILE:' + os.path.join(realm.testdir, 'service_cache')
+realm.kinit(realm.host_princ, flags='-k', '-c', scc)
+realm.run('./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc)
+realm.run('./t_credstore', '-i', 'h:host', 'ccache', scc)
+realm.run('./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc)
+realm.run('./t_credstore', '-i', 'p:wrong', 'ccache', scc,
+          expected_code=1, expected_msg='does not match desired name')
+realm.run('./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc,
+          expected_code=1, expected_msg='does not match desired name')
+realm.run('./t_credstore', '-i', 'h:svc', 'ccache', scc,
+          expected_code=1, expected_msg='does not match desired name')
+
+mark('matching (fallback)')
+canonname = canonicalize_hostname(hostname)
+if canonname != hostname:
+    canonprinc = 'host/%s@%s' % (canonname, realm.realm)
+    realm.addprinc(canonprinc)
+    realm.extract_keytab(canonprinc, realm.keytab)
+    realm.kinit(canonprinc, flags='-k', '-c', scc)
+    realm.run('./t_credstore', '-i', 'h:host', 'ccache', scc)
+    realm.run('./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc)
+    realm.run('./t_credstore', '-i', 'h:host@' + canonname, 'ccache', scc)
+    realm.run('./t_credstore', '-i', 'p:' + canonprinc, 'ccache', scc)
+    realm.run('./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc,
+              expected_code=1, expected_msg='does not match desired name')
+    realm.run('./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc,
+              expected_code=1, expected_msg='does not match desired name')
+else:
+    skipped('fallback matching test',
+            '%s does not canonicalize to a different name' % hostname)
+
 mark('rcache')
 # t_credstore -r should produce a replay error normally, but not with
 # rcache set to "none:".
-output = realm.run('./t_credstore', '-r', '-a', 'p:' + realm.host_princ,
-                   expected_code=1)
-if 'gss_accept_sec_context(2): Request is a replay' not in output:
-    fail('Expected replay error not seen in t_credstore output')
+realm.run('./t_credstore', '-r', '-a', 'p:' + realm.host_princ,
+          expected_code=1,
+          expected_msg='gss_accept_sec_context(2): Request is a replay')
 realm.run('./t_credstore', '-r', '-a', 'p:' + realm.host_princ,
            'rcache', 'none:')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gssapi/t_gssapi.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/t_gssapi.py Changed

@@ -8,7 +8,7 @@
     realm.run('./t_iov', '-s', 'p:' + realm.host_princ)
     realm.run('./t_pcontok', 'p:' + realm.host_princ)
 
-realm = K5Realm(krb5_conf={'libdefaults': {'rdns': 'false'}})
+realm = K5Realm()
 
 # Test gss_add_cred().
 realm.run('./t_add_cred')
@@ -23,11 +23,20 @@
 realm.run(kadminl, 'addprinc', '-randkey', 'service2/calvin')
 realm.run(kadminl, 'addprinc', '-randkey', 'service2/dwight')
 realm.run(kadminl, 'addprinc', '-randkey', 'host/-nomatch-')
+realm.run(kadminl, 'addprinc', '-randkey', 'http/localhost')
 realm.run(kadminl, 'xst', 'service1/abraham')
 realm.run(kadminl, 'xst', 'service1/barack')
 realm.run(kadminl, 'xst', 'service2/calvin')
+realm.run(kadminl, 'xst', 'http/localhost')
 realm.run(kadminl, 'renprinc', 'service1/abraham', 'service1/andrew')
 
+# Test with no default realm and no dots in the server name.
+realm.run('./t_accname', 'h:http@localhost', expected_msg='http/localhost')
+remove_default = {'libdefaults': {'default_realm': None}}
+no_default = realm.special_env('no_default', False, krb5_conf=remove_default)
+realm.run('./t_accname', 'h:http@localhost', expected_msg='http/localhost',
+          env=no_default)
+
 # Test with no acceptor name, including client/keytab principal
 # mismatch (non-fatal) and missing keytab entry (fatal).
 realm.run('./t_accname', 'p:service1/andrew',
@@ -62,13 +71,8 @@
           expected_msg=' not found in keytab')
 
 # If possible, test with an acceptor name requiring fallback to match
-# against a keytab entry.  Forward-canonicalize the hostname, relying
-# on the rdns=false realm setting.
-try:
-    ai = socket.getaddrinfo(hostname, None, 0, 0, 0, socket.AI_CANONNAME)
-    (family, socktype, proto, canonname, sockaddr) = ai0
-except socket.gaierror:
-    canonname = hostname
+# against a keytab entry.
+canonname = canonicalize_hostname(hostname)
 if canonname != hostname:
     os.rename(realm.keytab, realm.keytab + '.save')
     canonprinc = 'host/' + canonname
@@ -91,9 +95,9 @@
 
 # Verify that we can't acquire acceptor creds without a keytab.
 os.remove(realm.keytab)
-output = realm.run('./t_accname', 'p:abc', expected_code=1)
-if ('gss_acquire_cred: Keytab' not in output or
-    'nonexistent or empty' not in output):
+out = realm.run('./t_accname', 'p:abc', expected_code=1)
+if ('gss_acquire_cred: Keytab' not in out or
+    'nonexistent or empty' not in out):
     fail('Expected error message not seen for nonexistent keytab')
 
 realm.stop()
@@ -148,23 +152,18 @@
 realm.run('./t_inq_cred', '-k', '-b', expected_msg=realm.host_princ)
 
 # Test gss_export_name behavior.
-out = realm.run('./t_export_name', 'u:x')
-if out != '0401000B06092A864886F7120102020000000D78404B5242544553542E434F4D\n':
-    fail('Unexpected output from t_export_name (krb5 username)')
-output = realm.run('./t_export_name', '-s', 'u:xyz')
-if output != '0401000806062B06010505020000000378797A\n':
-    fail('Unexpected output from t_export_name (SPNEGO username)')
-output = realm.run('./t_export_name', 'p:a@b')
-if output != '0401000B06092A864886F71201020200000003614062\n':
-    fail('Unexpected output from t_export_name (krb5 principal)')
-output = realm.run('./t_export_name', '-s', 'p:a@b')
-if output != '0401000806062B060105050200000003614062\n':
-    fail('Unexpected output from t_export_name (SPNEGO krb5 principal)')
+realm.run('./t_export_name', 'u:x', expected_msg=\
+          '0401000B06092A864886F7120102020000000D78404B5242544553542E434F4D\n')
+realm.run('./t_export_name', '-s', 'u:xyz',
+          expected_msg='0401000806062B06010505020000000378797A\n')
+realm.run('./t_export_name', 'p:a@b',
+          expected_msg='0401000B06092A864886F71201020200000003614062\n')
+realm.run('./t_export_name', '-s', 'p:a@b',
+          expected_msg='0401000806062B060105050200000003614062\n')
 
 # Test that composite-export tokens can be imported.
-output = realm.run('./t_export_name', '-c', 'p:a@b')
-if (output != '0402000B06092A864886F7120102020000000361406200000000\n'):
-    fail('Unexpected output from t_export_name (using COMPOSITE_EXPORT)')
+realm.run('./t_export_name', '-c', 'p:a@b', expected_msg=
+          '0402000B06092A864886F7120102020000000361406200000000\n')
 
 # Test gss_inquire_mechs_for_name behavior.
 krb5_mech = '{ 1 2 840 113554 1 2 2 }'

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/gssapi/t_s4u.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/t_s4u.py Changed

@@ -298,8 +298,7 @@
             'sensitive': {'keys': 'aes128-cts',
                           'flags': '+disallow_forwardable'},
             'impersonator': {'keys': 'aes128-cts'},
-            'service1': {'keys': 'aes128-cts',
-                         'flags': '+ok_to_auth_as_delegate'},
+            'service1': {'keys': 'aes128-cts'},
             'rb2': {'keys': 'aes128-cts'},
             'rb': {'keys': 'aes128-cts'}}
 a_kconf = {'realms': {'$realm': {'database_module': 'test'}},
@@ -311,7 +310,6 @@
                                   'alias': {'rb@A': 'rb',
                                             'rb@B': '@B',
                                             'rb@C': '@B',
-                                            'rb2_alias': 'rb2',
                                             'service/rb.a': 'rb',
                                             'service/rb.b': '@B',
                                             'service/rb.c': '@B' }}}}
@@ -338,7 +336,8 @@
            'capaths': { 'A' : { 'C' : 'B' }},
            'dbmodules': {'test': {'db_library': 'test',
                                   'princs': c_princs,
-                                  'rbcd': {'rb@C': 'impersonator@A'},
+                                  'rbcd': {'rb@C': 'impersonator@A',
+                                                    'service1@A'},
                                   'alias': {'rb@C': 'rb',
                                             'service/rb.c': 'rb' }}}}
 
@@ -356,7 +355,7 @@
 domain_conf = ra.special_env('domain_conf', False, krb5_conf=domain_realm)
 
 ra.extract_keytab('impersonator@A', ra.keytab)
-ra.kinit('impersonator@A', None, '-F', '-k', '-t', ra.keytab)
+ra.kinit('impersonator@A', None, '-f', '-k', '-t', ra.keytab)
 
 mark('Local-realm RBCD')
 ra.run('./t_s4u', 'p:' + ra.user_princ, 'p:rb')
@@ -388,13 +387,14 @@
 ra.run('./t_s4u', 'p:' + 'sensitive@A', 'h:service@rb.c', expected_code=1)
 ra.run('./t_s4u', 'p:' + rb.user_princ, 'h:service@rb.c')
 
-mark('With both delegation types, 2nd ticket must be forwardable')
+# Although service1 has RBCD delegation privileges to rb2@A, it does
+# not have ok-to-auth-as-delegate and does have traditional delegation
+# privileges, so it cannot get a forwardable S4U2Self ticket.
+mark('RBCD forwardable blocked by forward delegation privileges')
 ra.extract_keytab('service1@A', ra.keytab)
-ra.kinit('service1@A', None, '-F', '-k', '-t', ra.keytab)
-ra.run('./t_s4u', 'p:' + ra.user_princ, 'p:rb2', expected_code=1)
-ra.run('./t_s4u', 'p:' + ra.user_princ, 'p:rb2_alias')
 ra.kinit('service1@A', None, '-f', '-k', '-t', ra.keytab)
-ra.run('./t_s4u', 'p:' + ra.user_princ, 'p:rb2')
+ra.run('./t_s4u', 'p:' + ra.user_princ, 'e:rb2@A', expected_code=1,
+       expected_msg='KDC can\'t fulfill requested option')
 
 ra.stop()
 rb.stop()

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/t_store_cred.c Added

@@ -0,0 +1,114 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* tests/gssapi/t_store_cred.c - gss_store_cred() test harness */
+/*
+ * Copyright (C) 2021 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Usage: t_store_cred -d -i -o src_ccname dest_ccname
+ *
+ * Acquires creds from src_ccname using gss_acquire_cred_from() and then stores
+ * them, using gss_store_cred_into() if -i is specified or gss_store_cred()
+ * otherwise.  If dest_ccname is specified with -i, it is included in the cred
+ * store for the store operation; if it is specified without -i, it is set with
+ * gss_krb5_ccache_name() before the store operation.  If -d and/or -o are
+ * specified they set the default_cred and overwrite_cred flags to true
+ * respectively.
+ */
+
+#include "k5-platform.h"
+#include <gssapi/gssapi_ext.h>
+#include "common.h"
+
+int
+main(int argc, char *argv)
+{
+    OM_uint32 major, minor;
+    gss_key_value_set_desc store;
+    gss_key_value_element_desc elem;
+    gss_cred_id_t cred;
+    krb5_boolean def = FALSE, into = FALSE, overwrite = FALSE;
+    const char *src_ccname, *dest_ccname;
+    int c;
+
+    /* Parse arguments. */
+    while ((c = getopt(argc, argv, "dio")) != -1) {
+        switch (c) {
+        case 'd':
+            def = TRUE;
+            break;
+        case 'i':
+            into = TRUE;
+            break;
+        case 'o':
+            overwrite = TRUE;
+            break;
+        default:
+            abort();
+        }
+    }
+    argc -= optind;
+    argv += optind;
+    assert(argc == 1 || argc == 2);
+    src_ccname = argv0;
+    dest_ccname = argv1;
+
+    elem.key = "ccache";
+    elem.value = src_ccname;
+    store.count = 1;
+    store.elements = &elem;
+    major = gss_acquire_cred_from(&minor, GSS_C_NO_NAME, GSS_C_INDEFINITE,
+                                  &mechset_krb5, GSS_C_INITIATE, &store, &cred,
+                                  NULL, NULL);
+    check_gsserr("acquire_cred", major, minor);
+
+    if (into) {
+        if (dest_ccname != NULL) {
+            elem.key = "ccache";
+            elem.value = dest_ccname;
+            store.count = 1;
+        } else {
+            store.count = 0;
+        }
+        major = gss_store_cred_into(&minor, cred, GSS_C_INITIATE, &mech_krb5,
+                                    overwrite, def, &store, NULL, NULL);
+        check_gsserr("store_cred_into", major, minor);
+    } else {
+        if (dest_ccname != NULL) {
+            major = gss_krb5_ccache_name(&minor, dest_ccname, NULL);
+            check_gsserr("ccache_name", major, minor);
+        }
+        major = gss_store_cred(&minor, cred, GSS_C_INITIATE, &mech_krb5,
+                               overwrite, def, NULL, NULL);
+        check_gsserr("store_cred", major, minor);
+    }
+
+    gss_release_cred(&minor, &cred);
+    return 0;
+}

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/gssapi/t_store_cred.py Added

@@ -0,0 +1,80 @@
+from k5test import *
+
+realm = K5Realm(create_user=False)
+
+alice = 'alice@' + realm.realm
+bob = 'bob@' + realm.realm
+cc_alice = realm.ccache + '.alice'
+cc_bob = realm.ccache + '.bob'
+realm.addprinc(alice)
+realm.addprinc(bob)
+realm.extract_keytab(alice, realm.keytab)
+realm.extract_keytab(bob, realm.keytab)
+realm.kinit(alice, flags='-k', '-c', cc_alice)
+realm.kinit(bob, flags='-k', '-c', cc_bob)
+
+mark('FILE, default output ccache')
+realm.run('./t_store_cred', cc_alice)
+realm.klist(alice)
+# Overwriting should fail by default, whether or not the principal matches.
+realm.run('./t_store_cred', cc_alice, expected_code=1,
+          expected_msg='The requested credential element already exists')
+realm.run('./t_store_cred', cc_bob, expected_code=1,
+          expected_msg='The requested credential element already exists')
+# Overwriting should succeed with overwrite_cred set.
+realm.run('./t_store_cred', '-o', cc_bob)
+realm.klist(bob)
+# default_cred has no effect without a collection.
+realm.run('./t_store_cred', '-d', '-o', cc_alice)
+realm.klist(alice)
+
+mark('FILE, gss_krb5_ccache_name()')
+cc_alternate = realm.ccache + '.alternate'
+realm.run('./t_store_cred', cc_alice, cc_alternate)
+realm.klist(alice, ccache=cc_alternate)
+realm.run('./t_store_cred', cc_bob, cc_alternate, expected_code=1,
+          expected_msg='The requested credential element already exists')
+
+mark('FILE, gss_store_cred_into()')
+os.remove(cc_alternate)
+realm.run('./t_store_cred', '-i', cc_alice, cc_alternate)
+realm.klist(alice, ccache=cc_alternate)
+realm.run('./t_store_cred', '-i', cc_bob, cc_alternate, expected_code=1,
+          expected_msg='The requested credential element already exists')
+
+mark('DIR, gss_krb5_ccache_name()')
+cc_dir = 'DIR:' + os.path.join(realm.testdir, 'cc')
+realm.run('./t_store_cred', cc_alice, cc_dir)
+realm.run(klist, '-c', cc_dir, expected_code=1,
+          expected_msg='No credentials cache found')
+realm.run(klist, '-l', '-c', cc_dir, expected_msg=alice)
+realm.run('./t_store_cred', cc_alice, cc_dir, expected_code=1,
+          expected_msg='The requested credential element already exists')
+realm.run('./t_store_cred', '-o', cc_alice, cc_dir)
+realm.run(klist, '-c', cc_dir, expected_code=1,
+          expected_msg='No credentials cache found')
+realm.run(klist, '-l', cc_dir, expected_msg=alice)
+realm.run('./t_store_cred', '-d', cc_bob, cc_dir)
+# The k5test klist method does not currently work with a collection name.
+realm.run(klist, cc_dir, expected_msg=bob)
+realm.run(klist, '-l', cc_dir, expected_msg=alice)
+realm.run('./t_store_cred', '-o', '-d', cc_alice, cc_dir)
+realm.run(klist, cc_dir, expected_msg=alice)
+realm.run(kdestroy, '-A', '-c', cc_dir)
+
+mark('DIR, gss_store_cred_into()')
+realm.run('./t_store_cred', '-i', cc_alice, cc_dir)
+realm.run('./t_store_cred', '-i', '-d', cc_bob, cc_dir)
+realm.run(klist, cc_dir, expected_msg=bob)
+realm.run(klist, '-l', cc_dir, expected_msg=alice)
+realm.run(kdestroy, '-A', '-c', cc_dir)
+
+mark('DIR, default output ccache')
+realm.ccache = cc_dir
+realm.env'KRB5CCNAME' = cc_dir
+realm.run('./t_store_cred', '-i', cc_alice, cc_dir)
+realm.run('./t_store_cred', '-i', '-d', cc_bob, cc_dir)
+realm.run(klist, expected_msg=bob)
+realm.run(klist, '-l', expected_msg=alice)
+
+success('gss_store_cred() tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/kcmserver.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/kcmserver.py Changed

@@ -23,6 +23,7 @@
 #         traceback.print_exception(etype, value, tb, file=f)
 # sys.excepthook = ehook
 
+import optparse
 import select
 import socket
 import struct
@@ -39,6 +40,7 @@
     INITIALIZE = 4
     DESTROY = 5
     STORE = 6
+    RETRIEVE = 7
     GET_PRINCIPAL = 8
     GET_CRED_UUID_LIST = 9
     GET_CRED_BY_UUID = 10
@@ -49,12 +51,16 @@
     SET_DEFAULT_CACHE = 21
     GET_KDC_OFFSET = 22
     SET_KDC_OFFSET = 23
+    GET_CRED_LIST = 13001
+    REPLACE = 13002
 
 
 class KRB5Errors(object):
+    KRB5_CC_NOTFOUND = -1765328243
     KRB5_CC_END = -1765328242
     KRB5_CC_NOSUPP = -1765328137
     KRB5_FCC_NOFILE = -1765328189
+    KRB5_FCC_INTERNAL = -1765328188
 
 
 def make_uuid():
@@ -88,6 +94,25 @@
     return argbytes0:offset, argbytesoffset+1:
 
 
+# Find the bounds of a marshalled principal, returning it and the
+# remainder of argbytes.
+def extract_princ(argbytes):
+    ncomps, rlen = struct.unpack('>LL', argbytes4:12)
+    pos = 12 + rlen
+    for i in range(ncomps):
+        clen, = struct.unpack('>L', argbytespos:pos+4)
+        pos += 4 + clen
+    return argbytes0:pos, argbytespos:
+
+
+# Return true if the marshalled principals p1 and p2 name the same
+# principal.
+def princ_eq(p1, p2):
+    # Ignore the name-types at bytes 0..3.  The remaining bytes should
+    # be identical if the principals are the same.
+    return p14: == p24:
+
+
 def op_gen_new(argbytes):
     # Does not actually check for uniqueness.
     global next_unique
@@ -123,6 +148,22 @@
     return 0, b''
 
 
+def op_retrieve(argbytes):
+    name, rest = unmarshal_name(argbytes)
+    # Ignore the flags at rest0:4 and the header at rest4:8.
+    # Assume there are client and server creds in the tag and match
+    # only against them.
+    cprinc, rest = extract_princ(rest8:)
+    sprinc, rest = extract_princ(rest)
+    cache = get_cache(name)
+    for cred in (cache.credsu for u in cache.cred_uuids):
+        cred_cprinc, rest = extract_princ(cred)
+        cred_sprinc, rest = extract_princ(rest)
+        if princ_eq(cred_cprinc, cprinc) and princ_eq(cred_sprinc, sprinc):
+            return 0, cred
+    return KRB5Errors.KRB5_CC_NOTFOUND, b''
+
+
 def op_get_principal(argbytes):
     name, rest = unmarshal_name(argbytes)
     cache = get_cache(name)
@@ -183,11 +224,45 @@
     return 0, b''
 
 
+def op_get_cred_list(argbytes):
+    name, rest = unmarshal_name(argbytes)
+    cache = get_cache(name)
+    creds = cache.credsu for u in cache.cred_uuids
+    return 0, (struct.pack('>L', len(creds)) +
+               b''.join(struct.pack('>L', len(c)) + c for c in creds))
+
+
+def op_replace(argbytes):
+    name, rest = unmarshal_name(argbytes)
+    offset, = struct.unpack('>L', rest0:4)
+    princ, rest = extract_princ(rest4:)
+    ncreds, = struct.unpack('>L', rest0:4)
+    rest = rest4:
+    creds = 
+    for i in range(ncreds):
+        len, = struct.unpack('>L', rest0:4)
+        creds.append(rest4:4+len)
+        rest = rest4+len:
+
+    cache = get_cache(name)
+    cache.princ = princ
+    cache.cred_uuids = 
+    cache.creds = {}
+    cache.time_offset = offset
+    for i in range(ncreds):
+        uuid = make_uuid()
+        cache.credsuuid = credsi
+        cache.cred_uuids.append(uuid)
+
+    return 0, b''
+
+
 ophandlers = {
     KCMOpcodes.GEN_NEW : op_gen_new,
     KCMOpcodes.INITIALIZE : op_initialize,
     KCMOpcodes.DESTROY : op_destroy,
     KCMOpcodes.STORE : op_store,
+    KCMOpcodes.RETRIEVE : op_retrieve,
     KCMOpcodes.GET_PRINCIPAL : op_get_principal,
     KCMOpcodes.GET_CRED_UUID_LIST : op_get_cred_uuid_list,
     KCMOpcodes.GET_CRED_BY_UUID : op_get_cred_by_uuid,
@@ -197,7 +272,9 @@
     KCMOpcodes.GET_DEFAULT_CACHE : op_get_default_cache,
     KCMOpcodes.SET_DEFAULT_CACHE : op_set_default_cache,
     KCMOpcodes.GET_KDC_OFFSET : op_get_kdc_offset,
-    KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset
+    KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset,
+    KCMOpcodes.GET_CRED_LIST : op_get_cred_list,
+    KCMOpcodes.REPLACE : op_replace
 }
 
 # Read and respond to a request from the socket s.
@@ -215,7 +292,11 @@
 
     majver, minver, op = struct.unpack('>BBH', req:4)
     argbytes = req4:
-    code, payload = ophandlersop(argbytes)
+
+    if op in ophandlers:
+        code, payload = ophandlersop(argbytes)
+    else:
+        code, payload = KRB5Errors.KRB5_FCC_INTERNAL, b''
 
     # The KCM response is the code (4 bytes) and the response payload.
     # The Heimdal IPC response is the length of the KCM response (4
@@ -226,9 +307,18 @@
     s.sendall(hipc_response)
     return True
 
+parser = optparse.OptionParser()
+parser.add_option('-f', '--fallback', action='store_true', dest='fallback',
+                  default=False,
+                  help='Do not support RETRIEVE/GET_CRED_LIST/REPLACE')
+(options, args) = parser.parse_args()
+if options.fallback:
+    del ophandlersKCMOpcodes.RETRIEVE
+    del ophandlersKCMOpcodes.GET_CRED_LIST
+    del ophandlersKCMOpcodes.REPLACE
 
 server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-server.bind(sys.argv1)
+server.bind(args0)
 server.listen(5)
 select_input = server,
 sys.stderr.write('starting...\n')

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/ca.pem Added

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE5TCCA82gAwIBAgIBATANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowgacxCzAJ
+BgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRIwEAYDVQQHDAlDYW1i
+cmlkZ2UxDDAKBgNVBAoMA01JVDEpMCcGA1UECwwgSW5zZWN1cmUgUEtJTklUIEtl
+cmJlcm9zIHRlc3QgQ0ExMzAxBgNVBAMMKnBraW5pdCB0ZXN0IHN1aXRlIENBOyBk
+byBub3QgdXNlIG90aGVyd2lzZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAM+lV5iaVats0yBFN4FBe6bovloNe3d0F9qMuhKqlECv6cFra75gSGmHJz6t
+GTK8zITU7sni429azTZC9IQnUt/2lW8dWzpZD1T5Vt1DYvYFqVzjhNfzeEDK88ig
+ENfzaX/cY2P76arJr0cewGaauzaux8heYW1CjBxWmk6kWq4aD+5jggchvBeOGEE2
+NkV3MPbXut8fu+3NzuuIG7Z0ilwQv+KUvQ8QQb9VCwdsDh/ERsQ4loC9P4jtuWCJ
+ikIE78GxDcOMoC1ftJtW/mBCS2iCHipXrp2BDDJMyHxZjHpl0VoDR7koWGtD3sos
+EwUkXVvWIuKs432h2dXQ+u8HaBsCAwEAAaOCARgwggEUMB0GA1UdDgQWBBT0F6X7
+1QRftDiSeNSY3bks3nK0IzCB1AYDVR0jBIHMMIHJgBT0F6X71QRftDiSeNSY3bks
+3nK0I6GBraSBqjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0
+dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoGA1UECgwDTUlUMSkwJwYDVQQLDCBJ
+bnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAwwqcGtpbml0
+IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlggEBMAsGA1UdDwQE
+AwIB/jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBT2FJVPS+U
+0MXa1HUOETuUPrVff7VeIvyAPm9IgX1zNbCvktCc4d7ErNB3P5ng8aZz4MKqwzuX
+HVhUxbF7JKfyUI41lcixPG+k+U9mzBJaozWT+K1OhdUF//mGPxaxe5jyUhDiQArD
+/6vulX0/B+1iuIa1sCfoeelzqQcYHqhZdWn6bBdcDWNARHIXWs5zPeKA975+d5TW
+rofE7T8nNQJvcZoVjCSfcYXhP82D/0sA+wPCt3fgbBZdvJ89xwvIlzBtiwC++Zbe
+37Rt5av0+ykpR7nmh2jyG+ItzE73nYKdBrUI5J6JLSbUcQTw4jeXHwDULUHZ6fXg
+TBEM2v1VW4Df
+-----END CERTIFICATE-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/generic.p12 Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/generic.pem Added

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCS
+OTfZununxFDxuThhIFDWEZ9p2qSqTrxKtKx4CDvdckz4kaKybiNZTW7Dlh6IwWta
+60eq98WrMHXYlSaN87r95lU0ug2RFJh4uLdq3a5NM/daIIjO0Bo86oC+8EBM961Q
+mCMe7dn9ngFK92msdqO+wfpAfvhSpBPtAjQovigirheiEoER/ov9t9/3mRi5OTkY
+8YfKT/z6XJrnOUIB3AgCdGyzSRvWLqLrbh7iAFVrm6Pq6D2nNr+mE9r5u7uFl3r8
+QeDgp0Unwd1ISWTHZlrP4bq29w7y2O+/2KV04Og8z+4zoGD4nRinuJBUdNqwAXVz
+dz6pXFWgLRD+9ddI5jB0
+-----END CERTIFICATE-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/kdc.pem Added

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE4TCCA8mgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowSTELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+U1QuQ09NMQwwCgYDVQQDDANLREMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDPpVeYmlWrbNMgRTeBQXum6L5aDXt3dBfajLoSqpRAr+nBa2u+YEhphyc+
+rRkyvMyE1O7J4uNvWs02QvSEJ1Lf9pVvHVs6WQ9U+VbdQ2L2Balc44TX83hAyvPI
+oBDX82l/3GNj++mqya9HHsBmmrs2rsfIXmFtQowcVppOpFquGg/uY4IHIbwXjhhB
+NjZFdzD217rfH7vtzc7riBu2dIpcEL/ilL0PEEG/VQsHbA4fxEbEOJaAvT+I7blg
+iYpCBO/BsQ3DjKAtX7SbVv5gQktogh4qV66dgQwyTMh8WYx6ZdFaA0e5KFhrQ97K
+LBMFJF1b1iLirON9odnV0PrvB2gbAgMBAAGjggFzMIIBbzAdBgNVHQ4EFgQU9Bel
++9UEX7Q4knjUmN25LN5ytCMwgdQGA1UdIwSBzDCByYAU9Bel+9UEX7Q4knjUmN25
+LN5ytCOhga2kgaowgacxCzAJBgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHDAlDYW1icmlkZ2UxDDAKBgNVBAoMA01JVDEpMCcGA1UECwwg
+SW5zZWN1cmUgUEtJTklUIEtlcmJlcm9zIHRlc3QgQ0ExMzAxBgNVBAMMKnBraW5p
+dCB0ZXN0IHN1aXRlIENBOyBkbyBub3QgdXNlIG90aGVyd2lzZYIBATALBgNVHQ8E
+BAMCA+gwDAYDVR0TAQH/BAIwADBIBgNVHREEQTA/oD0GBisGAQUCAqAzMDGgDRsL
+S1JCVEVTVC5DT02hIDAeoAMCAQKhFzAVGwZrcmJ0Z3QbC0tSQlRFU1QuQ09NMBIG
+A1UdJQQLMAkGBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEBAJZd7v5ZOMs8Y3ht
+Kmtql8rKs0Jee73gVHYw3LXxJfHjIiNGdexxuWJ6Hy9gFnfwSco+15HP3MxMBkau
+TKo3i1+Kwf+lc7gIZ0g/CEnYOx2smHGd9yGudWypunYLjGWfH/2M8/Wu1gZDTxQ1
+pNMQZ2pPLL/C6c6vYpVQJ5cA0RSh/SC5IbOESUpZaFFMYxF5TNz+28/lDr/rN41O
+miklos6cH5EkJyI0WUqJMk04HHjREl/9RTak8mo/eaqjUMTAOyweSwpaYRCddBOo
+y1ix9yH0fSBib1+WQ3MAHZHgbgVnu7V2GnB6qMNqRLHoGa03x+5Q1X0QuKxP6iYo
+9tiGt3k=
+-----END CERTIFICATE-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/make-certs.sh Added

@@ -0,0 +1,172 @@
+#!/bin/sh -e
+
+NAMETYPE=1
+KRBTGT_NAMETYPE=2
+KEYSIZE=2048
+DAYS=4000
+REALM=KRBTEST.COM
+LOWREALM=krbtest.com
+KRB5_PRINCIPAL_SAN=1.3.6.1.5.2.2
+KRB5_UPN_SAN=1.3.6.1.4.1.311.20.2.3
+PKINIT_KDC_EKU=1.3.6.1.5.2.3.5
+PKINIT_CLIENT_EKU=1.3.6.1.5.2.3.4
+TLS_SERVER_EKU=1.3.6.1.5.5.7.3.1
+TLS_CLIENT_EKU=1.3.6.1.5.5.7.3.2
+EMAIL_PROTECTION_EKU=1.3.6.1.5.5.7.3.4
+# Add TLS EKUs to these if we're testing with NSS and we still have to
+# piggy-back on the TLS trust settings.
+KDC_EKU_LIST=$PKINIT_KDC_EKU
+CLIENT_EKU_LIST=$PKINIT_CLIENT_EKU
+
+cat > openssl.cnf << EOF
+req
+prompt = no
+distinguished_name = \$ENV::SUBJECT
+
+ca
+CN = test CA certificate
+C = US
+ST = Massachusetts
+L = Cambridge
+O = MIT
+OU = Insecure PKINIT Kerberos test CA
+CN = pkinit test suite CA; do not use otherwise
+
+kdc
+C = US
+ST = Massachusetts
+O = KRBTEST.COM
+CN = KDC
+
+user
+C = US
+ST = Massachusetts
+O = KRBTEST.COM
+CN = user
+
+exts_ca
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,dataEncipherment,keyAgreement,keyCertSign,cRLSign
+basicConstraints = critical,CA:TRUE
+
+components_kdc
+0.component=GeneralString:krbtgt
+1.component=GeneralString:$REALM
+
+princ_kdc
+nametype=EXPLICIT:0,INTEGER:$KRBTGT_NAMETYPE
+components=EXPLICIT:1,SEQUENCE:components_kdc
+
+krb5princ_kdc
+realm=EXPLICIT:0,GeneralString:$REALM
+princ=EXPLICIT:1,SEQUENCE:princ_kdc
+
+exts_kdc
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+basicConstraints = critical,CA:FALSE
+subjectAltName = otherName:$KRB5_PRINCIPAL_SAN;SEQUENCE:krb5princ_kdc
+extendedKeyUsage = $KDC_EKU_LIST
+
+components_client
+component=GeneralString:user
+
+princ_client
+nametype=EXPLICIT:0,INTEGER:$NAMETYPE
+components=EXPLICIT:1,SEQUENCE:components_client
+
+krb5princ_client
+realm=EXPLICIT:0,GeneralString:$REALM
+princ=EXPLICIT:1,SEQUENCE:princ_client
+
+exts_client
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+basicConstraints = critical,CA:FALSE
+subjectAltName = otherName:$KRB5_PRINCIPAL_SAN;SEQUENCE:krb5princ_client
+extendedKeyUsage = $CLIENT_EKU_LIST
+
+exts_upn_client
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+basicConstraints = critical,CA:FALSE
+subjectAltName = otherName:$KRB5_UPN_SAN;UTF8:user@$LOWREALM
+extendedKeyUsage = $CLIENT_EKU_LIST
+
+exts_upn2_client
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+basicConstraints = critical,CA:FALSE
+subjectAltName = otherName:$KRB5_UPN_SAN;UTF8:user
+extendedKeyUsage = $CLIENT_EKU_LIST
+
+exts_upn3_client
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+basicConstraints = critical,CA:FALSE
+subjectAltName = otherName:$KRB5_UPN_SAN;UTF8:user@$REALM
+extendedKeyUsage = $CLIENT_EKU_LIST
+
+exts_none
+EOF
+
+# Generate a private key.
+openssl genrsa $KEYSIZE > privkey.pem
+openssl rsa -in privkey.pem -out privkey-enc.pem -des3 -passout pass:encrypted
+
+# Generate a "CA" certificate.
+SUBJECT=ca openssl req -config openssl.cnf -new -x509 -extensions exts_ca \
+    -set_serial 1 -days $DAYS -key privkey.pem -out ca.pem
+
+serial=2
+gen_cert() {
+    SUBJECT=$1 openssl req -config openssl.cnf -new -key privkey.pem -out csr
+    SUBJECT=$1 openssl x509 -extfile openssl.cnf -extensions $2 \
+           -set_serial $serial -days $DAYS -req -CA ca.pem -CAkey privkey.pem \
+           -in csr -out $3
+    serial=$((serial + 1))
+    rm -f csr
+}
+
+gen_pkcs12() {
+    # Use -descert to make OpenSSL 1.1 generate files OpenSSL 3.0 can
+    # read (the default uses RC2, which is only available in the
+    # legacy provider in OpenSSL 3).  This option causes an algorithm
+    # downgrade with OpenSSL 3.0 (AES to DES3), but that isn't
+    # important for test certs.
+    openssl pkcs12 -export -descert -in "$1" -inkey privkey.pem -out "$2" \
+            -passout pass:"$3"
+}
+
+# Generate a KDC certificate.
+gen_cert kdc exts_kdc kdc.pem
+
+# Generate a client certificate and PKCS#12 bundles.
+gen_cert user exts_client user.pem
+gen_pkcs12 user.pem user.p12
+gen_pkcs12 user.pem user-enc.p12 encrypted
+
+# Generate a client certificate and PKCS#12 bundle with a UPN SAN.
+gen_cert user exts_upn_client user-upn.pem
+gen_pkcs12 user-upn.pem user-upn.p12
+
+# Same, but with no realm in the UPN SAN.
+gen_cert user exts_upn2_client user-upn2.pem
+gen_pkcs12 user-upn2.pem user-upn2.p12
+
+# Same, but with an uppercase realm in the UPN SAN.
+gen_cert user exts_upn3_client user-upn3.pem
+gen_pkcs12 user-upn3.pem user-upn3.p12
+
+# Generate a client certificate and PKCS#12 bundle with no PKINIT extensions.
+gen_cert user exts_none generic.pem
+gen_pkcs12 generic.pem generic.p12
+
+# Clean up.
+rm -f openssl.cnf

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/privkey-enc.pem Added

@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,5FFF1E71BFFB65E3
+
+p89x5YEL+Mb6IPZXEkkr0KC4Wj+JtgE3VKdTT0wEcRD74QVv+dbbZt62WgmpJtId
+ph0Ial2z5Mws8L/aTkPdW2H/bEroApLu4TfUV+w67KcWgrc8gOg73d6gEObqx8li
+qGbs7FC1cI1WfDfnNOnCbD66e5+bTI8fDuchaieNRqzROd9RHhmlBHgylTmf55us
+laGuwLq2cZk/+Xz0M8PPx07uauGkAK0fyfifn/JR3PsGsE9s334osVQMjbjyT0VE
+rm8HGm3PvZHHDUnkOh7AGKyEtsIa5fJAULUjugp2lQJqOigC4HVn8a33xfLI0F1+
+2nH9MZ+Ap1rtI1cJX8CDn/Ij9oFt01scLxynYekYej11zFiR6qHC0sspxu0Yi8l0
+puBPXCI0GzyF9I53ukjGeibTtssz5yw1r+2oVasR4bvfXczPjqTQCBsPSUayNNhw
+RgT7k4QTY2OlrK/5XdILBzBlsvfndXgGOwEDw4YE7PMzMmz69vPMK7CfedUqtuXq
+bGBks58tzeOa4NSfVDOuFLI+LMkoYWMSjPGD/I0trX41xCU+O6PZOnDyt5ZWl1Tm
+klJpsB7rUcwsP8d4w4QGhyyV6Mo2MTlnTILr4CwwvmDMBch3yzwbfKdeywsFQh0S
+NMrG3aYNO7csRRTD6aGvYcBCbavWq7Ujsb/fV7SOIS26f4VEqewvOFlFEXm66zaz
+GJ0IcjtNHYNIIIW4690djxPqlGgbIZTblBSBlT+iOW5HrhXvrLeMmwAPxInU5dK+
+ypk2MGc4SzemkDi8H9jDW3dwbgcvVD9wn0glhVLQKWvP6F73UUdVEXMCZ+960xnR
+gxeEwDdIpzXNadWdON1kRbqI2KesRY/XQErGHDOvf2gNSM9V2gPz+5humvcu3mXY
+r4537On4+IdzetEVtI7D0slgojs+jN8waigpkLFB5RVl8PnzblMuWOkHNA86rrp+
+h6wNqv9kHLgPjpAyB1l/7w4VqXLXeC4PdaGc2fcpdNWOncUnHROmDmYvdTocqhIF
+bAsEFV7QZoTgDB7J6vLsmbtfawtHMSb81V/wTJWRrtY/gJCrkJXR2pTYAZlPX6vK
+aK7K2NuhJFMnrQD+kxsrloSEyfsZmHtk0mAVXJw4wSxlH3eGQ+Jphb/M2wtsnWV1
+w0fehxL2Vd5SyBBctAGhUirhRngbOO/E8IioymrziQ88vJZs2DxvbuNG4WKTuTwj
+CIggXohCNKdqrwL2HAynm2FVEWhbKrQwe4kjZc64WjccR4cy9vv+dxFfrKl+vZ1o
+Wvb0WXND7fiSBrPo7OfaYM5HjrcvIRP1AtMuArhuQYVARmawUG0l7dFLN97Rh9M+
+Ud9vBIfQYlubnTGVVm/5xrUh2isQbp2vrZLfMrUNXMQm0vSxKgGkAxqNUuklJC06
+LvCtEWMYXiBmB1zP4khwCHmHB+/E1gHBAutCzhpPu86ayEtNHBHIFkqKvZSg/UuZ
++ygDdTJV00I2neIdeQcyG+vPg6huIDIHpG5u6eQn5sLqVkhr+apeNcskMWpdkpFS
+Lo62KUZDR3yB83ne63c3IGex0hWhVojJOAxykpGp6OD9uFn6Xn7x2Q==
+-----END RSA PRIVATE KEY-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/privkey.pem Added

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEoAIBAAKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtr
+vmBIaYcnPq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE
+1/N4QMrzyKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOC
+ByG8F44YQTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiW
+gL0/iO25YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNH
+uShYa0PeyiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABAoIBAEpnKYMR0h6xyNjo
+VGIpT6BYB1UHPbVo0N9Ly6TCoIqpPe5DioDVyTye5A4OQlgu1G3ISqPme6478ApA
+ZZMw7/42QgdlknnOzbKaAWkZK02Sa8RP9hrXL8CvuDisOjzXCHd7RdXevzSmPfsS
+5sgdK3YFnKqMPwbCcKf61CHXvHJjWGuTIHIRh8P7gJelA4ahO0kYQ8aRXv3ldquO
+ukSI5gyk9CN+aAHqt25kEmt9oOgk+8kfKpnk+5gkOCY2YOFDDckD7nL1VIIrDxwG
+SmU598qjVwycDairWUY8uSuPCOLgbvDM9N8cERDMsyNQL63GE8ZZyHZsJ3Pbwdfs
+JVHh5ekCgYEA/CwhaT9D0WQ49GQdeI7aqazHEYDmqPdE2/qbmr67tPMZzX8AAk9j
+r4aMT+oIdtIMPdoQNNcBP6NYZLlAoMbLoAzHmWJnF5/YWLnS2Wg9OuXUOBn3jk1l
+SWelJfAKGeBld5fpSLTdHjRAwJrNCX+mc0IZIiEw2IvGUPgKGX08bX8CgYEA0swx
+xCDgvfoaKueInw/rUIcKxrSxK3pDhaR01Dg2pwSo7Vj9W01zf33qe+mjma6+U2SB
+fk+/O2VXDuEOmVDLwvp6PkmUeRE5PyH7urTMEjy5ELNGiZd9zHoG/zJnRgPwTjuW
+yguvjVGJwI1IvmODuA7Xc7iHFlvGNuxXZjPkS2UCgYA0nFxoIdvbTsaXLl/7rAow
+xixOGY+GBvil0HYwZcSxrtpeRjXRRZDtqOuTLKeRaqdFLD6fV5AaH9EsSn4STQdk
+n+XwuVf61M2FTVeRJi9IH3UUM06zsLAGDYqmDJt+5JMmzVnNYnaTe6FazbEjXy9x
+8oNd3IDdXOQGNomc4cT+rwKBgBbABOr25Wp7cJGK1XrdO/c/69DQNYLMujbVLeqt
+enCCFz0uaoGNFVcAHutqpsZyToYvha49KxVc9Y1cirfPOX58i+7nAAgk7Lm8kC9x
+Tcj2Fr8PqiA1YlVMIi8uoGi1Ch1XXwnFQxgMYcKPPPeXQ+L8bxJFKwcltnm8/h3A
+ofXlAn9AW6fYZLSzOfNQTMnuukhuAtZcEW9NlJHbej305zK89J66S8wroQs5iOla
+5GG+S4YaZh5sVGw+mnS+FCw7cQCUk40kXwX3yTrxlX1qGSCFCQnFdJow+5NVg4D+
+dzDKzniH71OZZFxTqiiz76XxiaW/rS1uOfP/WSVR9NBLpV5n
+-----END RSA PRIVATE KEY-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user-enc.p12 Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user-upn.p12 Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user-upn.pem Added

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIExTCCA62gAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFPQX
+pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+BAQDAgPoMAwGA1UdEwEB/wQCMAAwKwYDVR0RBCQwIqAgBgorBgEEAYI3FAIDoBIM
+EHVzZXJAa3JidGVzdC5jb20wEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0B
+AQsFAAOCAQEAYTW8tzURX2s8vuDawXEJt2as5q2MnvhUmG0YPIvK4n2fODkMW/I9
+XENFhK8wwQJNdzvBUwXUXzEGjFcGPs672ZVzykRb7sAfGlNu1f15z0KrjyUj82oz
+/gWoLwdYwZnO8jqtKjGtnLi2MeWjVCoiUW5ypUGwtEdcyZUG0PeRUrdrZu5cm+iZ
+1B1exR4lepR1iSAPYTNhp5VF6T8BSLf2BO2IKTgFnF4Xx1vyZZTsY10mruZ8S1ZR
+XiajBVdHkN1BpWWyFKt1BCt0dpRx9W7CihC3Ln9fBCsY8QA969EjRhszG2i09Xxw
+0M6/UgIQRU6hy7QTlcmehDKY0zvVJ2/RLw==
+-----END CERTIFICATE-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user-upn2.p12 Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user-upn2.pem Added

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEuTCCA6GgAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBSjCCAUYwHQYDVR0OBBYEFPQX
+pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+BAQDAgPoMAwGA1UdEwEB/wQCMAAwHwYDVR0RBBgwFqAUBgorBgEEAYI3FAIDoAYM
+BHVzZXIwEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0BAQsFAAOCAQEAAsGC
+LvikD/nW3eOym4f/uuKBscOGSByP9/HoP8QwvnLYU00i5n+zXSTQctotHIifsRc4
+xHLO8xemJp7rm0h/27C1Wo5AVxJ0cmnDKQf8Ast+QXsz9ZeaeKLa5D8sDOfnZXJB
+aMTb8ChjyZz+KLjXV0VbaVkY95mfqsOoJQcl9wHhNdDOygnSucvA5Svlrbo2rlKt
+75OJZJJWrZxuaBuuSYNpCKyyg61t69hPoDKDQZ8QJZHGugWqQ2swYe9dZpUYy5xV
+CGTLCAk9ZOn8hTCC6xbNaJFjflIjcjpwabw0r986/9GeAF6KqSNbMXKaY4LLuk/8
+5FH9S8/3F56ZCNxbZQ==
+-----END CERTIFICATE-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user-upn3.p12 Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user-upn3.pem Added

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIExTCCA62gAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFPQX
+pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+BAQDAgPoMAwGA1UdEwEB/wQCMAAwKwYDVR0RBCQwIqAgBgorBgEEAYI3FAIDoBIM
+EHVzZXJAS1JCVEVTVC5DT00wEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0B
+AQsFAAOCAQEApwXjFJ86RLM4MzbScqk0JGqm+jzaFZ6h5oyt0rlaxdhOl7kqOmIE
+sLhXtvZm75roA+UULZHumB6xg3Y0p7cc6VBAYYycWoNkhWXZMdQ8Q33vMos5cwLY
+kXjl4oTDK53goh8IlriRMV7Tv/QpJ8wh+7iqQn3lak0Tv51JexYGwp5sJREYm8q5
+rr3ChlgH7SWF8mhbu2EEiipm0whEqA4tlNKGBsTQBslnm8sK0VfVDcmLOGbMNjRs
+r+Hkd8yVvhIJ9M+WAp/OeF2vUzPBJtAfIaJBxcZmKtNI5Jk8cK/vScJZboa0qAAz
+2Y1uC9rP830mpOe0juhV2mMPron0hi1HaA==
+-----END CERTIFICATE-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user.p12 Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/pkinit-certs/user.pem Added

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE0zCCA7ugAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowSjELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBZDCCAWAwHQYDVR0OBBYEFPQX
+pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+BAQDAgPoMAwGA1UdEwEB/wQCMAAwOQYDVR0RBDIwMKAuBgYrBgEFAgKgJDAioA0b
+C0tSQlRFU1QuQ09NoREwD6ADAgEBoQgwBhsEdXNlcjASBgNVHSUECzAJBgcrBgEF
+AgMEMA0GCSqGSIb3DQEBCwUAA4IBAQAOBeCDK6Eg6Cu8TZ7xeAw2AbTpaW04nNSV
+Fmm0aIskMgLl2a5KEmalG7rnArRXv5IZVYFjJ6X0MzjOx+BgaGUCvN8jz1fuO3Hp
+iGhxPDzKjFMWJeY/z5bQRueSI6RCC8DzH8iPdlPUQ8ZhnukhY1Vt47wqraf197uT
+0XP21qQr1uRY+ZcLSBKZuKe9ZP3ijh57MOLvYDdAFxVp77JLznpk+oU18ujAtYgZ
+7naIGYtSQRkIi970jk82hSpc9B/KN8UcDuo+DQHWPQaDf39s30qoxooZBoue5ipp
+LQHuVaX5Hoi83cWbsVluce/JsW8GfbuC8+8CosAmzJly183f8++9
+-----END CERTIFICATE-----

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs Added

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs/ca.pem Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs/make-certs.sh Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs/proxy-badsig.pem Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs/proxy-ideal.pem Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs/proxy-no-match.pem Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs/proxy-san.pem Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/proxy-certs/proxy-subject.pem Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/softpkcs11/main.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/softpkcs11/main.c Changed

@@ -375,10 +375,9 @@
         return NULL;
     soft_token.object.objs = objs;
 
-    o = malloc(sizeof(*o));
+    o = calloc(1, sizeof(*o));
     if (o == NULL)
         return NULL;
-    memset(o, 0, sizeof(*o));
     o->attrs = NULL;
     o->num_attributes = 0;
     o->object_handle = soft_token.object.num_objs;
@@ -414,49 +413,83 @@
     return CKR_OK;
 }
 
+#ifdef HAVE_EVP_PKEY_GET_BN_PARAM
+
+/* Declare owner pointers since EVP_PKEY_get_bn_param() gives us copies. */
+#define DECLARE_BIGNUM(name) BIGNUM *name = NULL
+#define RELEASE_BIGNUM(bn) BN_clear_free(bn)
 static CK_RV
-add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
+get_bignums(EVP_PKEY *key, BIGNUM **n, BIGNUM **e)
 {
-    switch (key_type) {
-    case CKK_RSA: {
-        CK_BYTE *modulus = NULL;
-        size_t modulus_len = 0;
-        CK_ULONG modulus_bits = 0;
-        CK_BYTE *exponent = NULL;
-        size_t exponent_len = 0;
-        RSA *rsa;
-        const BIGNUM *n, *e;
-
-        rsa = EVP_PKEY_get0_RSA(key);
-        RSA_get0_key(rsa, &n, &e, NULL);
-        modulus_bits = BN_num_bits(n);
-
-        modulus_len = BN_num_bytes(n);
-        modulus = malloc(modulus_len);
-        BN_bn2bin(n, modulus);
-
-        exponent_len = BN_num_bytes(e);
-        exponent = malloc(exponent_len);
-        BN_bn2bin(e, exponent);
-
-        add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
-        add_object_attribute(o, 0, CKA_MODULUS_BITS,
-                             &modulus_bits, sizeof(modulus_bits));
-        add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT,
-                             exponent, exponent_len);
-
-        RSA_set_method(rsa, RSA_PKCS1_OpenSSL());
-
-        free(modulus);
-        free(exponent);
-    }
-    default:
-        /* XXX */
-        break;
-    }
+    if (EVP_PKEY_get_bn_param(key, "n", n) == 0 ||
+        EVP_PKEY_get_bn_param(key, "e", e) == 0)
+        return CKR_DEVICE_ERROR;
+
+    return CKR_OK;
+}
+
+#else
+
+/* Declare const pointers since the old API gives us aliases. */
+#define DECLARE_BIGNUM(name) const BIGNUM *name
+#define RELEASE_BIGNUM(bn)
+static CK_RV
+get_bignums(EVP_PKEY *key, const BIGNUM **n, const BIGNUM **e)
+{
+    const RSA *rsa;
+
+    rsa = EVP_PKEY_get0_RSA(key);
+    RSA_get0_key(rsa, n, e, NULL);
+
     return CKR_OK;
 }
 
+#endif
+
+static CK_RV
+add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
+{
+    CK_BYTE *modulus = NULL, *exponent = 0;
+    size_t modulus_len = 0, exponent_len = 0;
+    CK_ULONG modulus_bits = 0;
+    CK_RV ret;
+    DECLARE_BIGNUM(n);
+    DECLARE_BIGNUM(e);
+
+    if (key_type != CKK_RSA)
+        abort();
+
+    ret = get_bignums(key, &n, &e);
+    if (ret != CKR_OK)
+        goto done;
+
+    modulus_bits = BN_num_bits(n);
+    modulus_len = BN_num_bytes(n);
+    exponent_len = BN_num_bytes(e);
+
+    modulus = malloc(modulus_len);
+    exponent = malloc(exponent_len);
+    if (modulus == NULL || exponent == NULL) {
+        ret = CKR_DEVICE_MEMORY;
+        goto done;
+    }
+
+    BN_bn2bin(n, modulus);
+    BN_bn2bin(e, exponent);
+
+    add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
+    add_object_attribute(o, 0, CKA_MODULUS_BITS, &modulus_bits,
+                         sizeof(modulus_bits));
+    add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, exponent, exponent_len);
+
+    ret = CKR_OK;
+done:
+    free(modulus);
+    free(exponent);
+    RELEASE_BIGNUM(n);
+    RELEASE_BIGNUM(e);
+    return ret;
+}
 
 static int
 pem_callback(char *buf, int num, int w, void *key)
@@ -679,10 +712,6 @@
         } else {
             /* XXX verify keytype */
 
-            if (key_type == CKK_RSA)
-                RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key),
-                               RSA_PKCS1_OpenSSL());
-
             if (X509_check_private_key(cert, o->u.private_key.key) != 1) {
                 EVP_PKEY_free(o->u.private_key.key);
                 o->u.private_key.key = NULL;
@@ -695,7 +724,7 @@
     }
 
     ret = CKR_OK;
- out:
+out:
     if (ret != CKR_OK) {
         st_logf("something went wrong when adding cert!\n");
 
@@ -1224,8 +1253,6 @@
         }
 
         /* XXX check keytype */
-        RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key),
-                       RSA_PKCS1_OpenSSL());
 
         if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) {
             EVP_PKEY_free(o->u.private_key.key);
@@ -1495,8 +1522,9 @@
     struct st_object *o;
     void *buffer = NULL;
     CK_RV ret;
-    RSA *rsa;
-    int padding, len, buffer_len, padding_len;
+    size_t buffer_len = 0;
+    int padding;
+    EVP_PKEY_CTX *ctx = NULL;
 
     st_logf("Encrypt\n");
 
@@ -1512,70 +1540,59 @@
         return CKR_ARGUMENTS_BAD;
     }
 
-    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
-
-    if (rsa == NULL)
-        return CKR_ARGUMENTS_BAD;
-
-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-
-    buffer_len = RSA_size(rsa);
+    if (pulEncryptedDataLen == NULL) {
+        st_logf("pulEncryptedDataLen NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
+        goto out;
+    }
 
-    buffer = malloc(buffer_len);
-    if (buffer == NULL) {
-        ret = CKR_DEVICE_MEMORY;
+    if (pData == NULL) {
+        st_logf("data NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
         goto out;
     }
 
-    ret = CKR_OK;
     switch(state->encrypt_mechanism->mechanism) {
     case CKM_RSA_PKCS:
         padding = RSA_PKCS1_PADDING;
-        padding_len = RSA_PKCS1_PADDING_SIZE;
         break;
     case CKM_RSA_X_509:
         padding = RSA_NO_PADDING;
-        padding_len = 0;
         break;
     default:
         ret = CKR_FUNCTION_NOT_SUPPORTED;
         goto out;
     }
 
-    if ((CK_ULONG)buffer_len + padding_len < ulDataLen) {
-        ret = CKR_ARGUMENTS_BAD;
-        goto out;
-    }
-
-    if (pulEncryptedDataLen == NULL) {
-        st_logf("pulEncryptedDataLen NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
+    ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL);
+    if (ctx == NULL || EVP_PKEY_encrypt_init(ctx) <= 0 ||
+        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
+        EVP_PKEY_encrypt(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) {
+        ret = CKR_DEVICE_ERROR;
         goto out;
     }
 
-    if (pData == NULL_PTR) {
-        st_logf("data NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
+    buffer = OPENSSL_malloc(buffer_len);
+    if (buffer == NULL) {
+        ret = CKR_DEVICE_MEMORY;
         goto out;
     }
 
-    len = RSA_public_encrypt(ulDataLen, pData, buffer, rsa, padding);
-    if (len <= 0) {
+    if (EVP_PKEY_encrypt(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) {
         ret = CKR_DEVICE_ERROR;
         goto out;
     }
-    if (len > buffer_len)
-        abort();
+    st_logf("Encrypt done\n");
 
-    if (pEncryptedData != NULL_PTR)
-        memcpy(pEncryptedData, buffer, len);
-    *pulEncryptedDataLen = len;
+    if (pEncryptedData != NULL)
+        memcpy(pEncryptedData, buffer, buffer_len);
+    *pulEncryptedDataLen = buffer_len;
 
- out:
-    if (buffer) {
-        memset(buffer, 0, buffer_len);
-        free(buffer);
-    }
+    ret = CKR_OK;
+out:
+    OPENSSL_cleanse(buffer, buffer_len);
+    OPENSSL_free(buffer);
+    EVP_PKEY_CTX_free(ctx);
     return ret;
 }
 
@@ -1646,8 +1663,9 @@
     struct st_object *o;
     void *buffer = NULL;
     CK_RV ret;
-    RSA *rsa;
-    int padding, len, buffer_len, padding_len;
+    size_t buffer_len = 0;
+    int padding;
+    EVP_PKEY_CTX *ctx = NULL;
 
     st_logf("Decrypt\n");
 
@@ -1663,71 +1681,61 @@
         return CKR_ARGUMENTS_BAD;
     }
 
-    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
-
-    if (rsa == NULL)
-        return CKR_ARGUMENTS_BAD;
-
-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-
-    buffer_len = RSA_size(rsa);
+    if (pulDataLen == NULL) {
+        st_logf("pulDataLen NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
+        goto out;
+    }
 
-    buffer = malloc(buffer_len);
-    if (buffer == NULL) {
-        ret = CKR_DEVICE_MEMORY;
+    if (pEncryptedData == NULL_PTR) {
+        st_logf("data NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
         goto out;
     }
 
-    ret = CKR_OK;
     switch(state->decrypt_mechanism->mechanism) {
     case CKM_RSA_PKCS:
         padding = RSA_PKCS1_PADDING;
-        padding_len = RSA_PKCS1_PADDING_SIZE;
         break;
     case CKM_RSA_X_509:
         padding = RSA_NO_PADDING;
-        padding_len = 0;
         break;
     default:
         ret = CKR_FUNCTION_NOT_SUPPORTED;
         goto out;
     }
 
-    if ((CK_ULONG)buffer_len + padding_len < ulEncryptedDataLen) {
-        ret = CKR_ARGUMENTS_BAD;
-        goto out;
-    }
-
-    if (pulDataLen == NULL) {
-        st_logf("pulDataLen NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
+    ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL);
+    if (ctx == NULL || EVP_PKEY_decrypt_init(ctx) <= 0 ||
+        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
+        EVP_PKEY_decrypt(ctx, NULL, &buffer_len, pEncryptedData,
+                         ulEncryptedDataLen) <= 0) {
+        ret = CKR_DEVICE_ERROR;
         goto out;
     }
 
-    if (pEncryptedData == NULL_PTR) {
-        st_logf("data NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
+    buffer = OPENSSL_malloc(buffer_len);
+    if (buffer == NULL) {
+        ret = CKR_DEVICE_MEMORY;
         goto out;
     }
 
-    len = RSA_private_decrypt(ulEncryptedDataLen, pEncryptedData, buffer,
-                              rsa, padding);
-    if (len <= 0) {
+    if (EVP_PKEY_decrypt(ctx, buffer, &buffer_len, pEncryptedData,
+                         ulEncryptedDataLen) <= 0) {
         ret = CKR_DEVICE_ERROR;
         goto out;
     }
-    if (len > buffer_len)
-        abort();
+    st_logf("Decrypt done\n");
 
     if (pData != NULL_PTR)
-        memcpy(pData, buffer, len);
-    *pulDataLen = len;
+        memcpy(pData, buffer, buffer_len);
+    *pulDataLen = buffer_len;
 
- out:
-    if (buffer) {
-        memset(buffer, 0, buffer_len);
-        free(buffer);
-    }
+    ret = CKR_OK;
+out:
+    OPENSSL_cleanse(buffer, buffer_len);
+    OPENSSL_free(buffer);
+    EVP_PKEY_CTX_free(ctx);
     return ret;
 }
 
@@ -1806,8 +1814,9 @@
     struct st_object *o;
     void *buffer = NULL;
     CK_RV ret;
-    RSA *rsa;
-    int padding, len, buffer_len, padding_len;
+    int padding;
+    size_t buffer_len = 0;
+    EVP_PKEY_CTX *ctx = NULL;
 
     st_logf("Sign\n");
     VERIFY_SESSION_HANDLE(hSession, &state);
@@ -1822,72 +1831,59 @@
         return CKR_ARGUMENTS_BAD;
     }
 
-    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
-
-    if (rsa == NULL)
-        return CKR_ARGUMENTS_BAD;
-
-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-
-    buffer_len = RSA_size(rsa);
+    if (pulSignatureLen == NULL) {
+        st_logf("signature len NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
+        goto out;
+    }
 
-    buffer = malloc(buffer_len);
-    if (buffer == NULL) {
-        ret = CKR_DEVICE_MEMORY;
+    if (pData == NULL_PTR) {
+        st_logf("data NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
         goto out;
     }
 
     switch(state->sign_mechanism->mechanism) {
     case CKM_RSA_PKCS:
         padding = RSA_PKCS1_PADDING;
-        padding_len = RSA_PKCS1_PADDING_SIZE;
         break;
     case CKM_RSA_X_509:
         padding = RSA_NO_PADDING;
-        padding_len = 0;
         break;
     default:
         ret = CKR_FUNCTION_NOT_SUPPORTED;
         goto out;
     }
 
-    if ((CK_ULONG)buffer_len < ulDataLen + padding_len) {
-        ret = CKR_ARGUMENTS_BAD;
-        goto out;
-    }
-
-    if (pulSignatureLen == NULL) {
-        st_logf("signature len NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
+    ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL);
+    if (ctx == NULL || EVP_PKEY_sign_init(ctx) <= 0 ||
+        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
+        EVP_PKEY_sign(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) {
+        ret = CKR_DEVICE_ERROR;
         goto out;
     }
 
-    if (pData == NULL_PTR) {
-        st_logf("data NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
+    buffer = OPENSSL_malloc(buffer_len);
+    if (buffer == NULL) {
+        ret = CKR_DEVICE_MEMORY;
         goto out;
     }
 
-    len = RSA_private_encrypt(ulDataLen, pData, buffer, rsa, padding);
-    st_logf("private encrypt done\n");
-    if (len <= 0) {
+    if (EVP_PKEY_sign(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) {
         ret = CKR_DEVICE_ERROR;
         goto out;
     }
-    if (len > buffer_len)
-        abort();
+    st_logf("Sign done\n");
 
-    if (pSignature != NULL_PTR)
-        memcpy(pSignature, buffer, len);
-    *pulSignatureLen = len;
+    if (pSignature != NULL)
+        memcpy(pSignature, buffer, buffer_len);
+    *pulSignatureLen = buffer_len;
 
     ret = CKR_OK;
-
- out:
-    if (buffer) {
-        memset(buffer, 0, buffer_len);
-        free(buffer);
-    }
+out:
+    OPENSSL_cleanse(buffer, buffer_len);
+    OPENSSL_free(buffer);
+    EVP_PKEY_CTX_free(ctx);
     return ret;
 }
 
@@ -1951,10 +1947,9 @@
 {
     struct session_state *state;
     struct st_object *o;
-    void *buffer = NULL;
     CK_RV ret;
-    RSA *rsa;
-    int padding, len, buffer_len;
+    int padding;
+    EVP_PKEY_CTX *ctx = NULL;
 
     st_logf("Verify\n");
     VERIFY_SESSION_HANDLE(hSession, &state);
@@ -1969,22 +1964,18 @@
         return CKR_ARGUMENTS_BAD;
     }
 
-    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
-
-    if (rsa == NULL)
-        return CKR_ARGUMENTS_BAD;
-
-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-
-    buffer_len = RSA_size(rsa);
+    if (pSignature == NULL) {
+        st_logf("signature NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
+        goto out;
+    }
 
-    buffer = malloc(buffer_len);
-    if (buffer == NULL) {
-        ret = CKR_DEVICE_MEMORY;
+    if (pData == NULL_PTR) {
+        st_logf("data NULL\n");
+        ret = CKR_ARGUMENTS_BAD;
         goto out;
     }
 
-    ret = CKR_OK;
     switch(state->verify_mechanism->mechanism) {
     case CKM_RSA_PKCS:
         padding = RSA_PKCS1_PADDING;
@@ -1997,51 +1988,22 @@
         goto out;
     }
 
-    if ((CK_ULONG)buffer_len < ulDataLen) {
-        ret = CKR_ARGUMENTS_BAD;
-        goto out;
-    }
-
-    if (pSignature == NULL) {
-        st_logf("signature NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
-        goto out;
-    }
-
-    if (pData == NULL_PTR) {
-        st_logf("data NULL\n");
-        ret = CKR_ARGUMENTS_BAD;
-        goto out;
-    }
-
-    len = RSA_public_decrypt(ulDataLen, pData, buffer, rsa, padding);
-    st_logf("private encrypt done\n");
-    if (len <= 0) {
+    ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL);
+    if (ctx == NULL || EVP_PKEY_verify_init(ctx) <= 0 ||
+        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
+        EVP_PKEY_verify(ctx, pSignature, ulSignatureLen, pData,
+                        ulDataLen) <= 0) {
         ret = CKR_DEVICE_ERROR;
         goto out;
     }
-    if (len > buffer_len)
-        abort();
+    st_logf("Verify done\n");
 
-    if ((CK_ULONG)len != ulSignatureLen) {
-        ret = CKR_GENERAL_ERROR;
-        goto out;
-    }
-
-    if (memcmp(pSignature, buffer, len) != 0) {
-        ret = CKR_GENERAL_ERROR;
-        goto out;
-    }
-
- out:
-    if (buffer) {
-        memset(buffer, 0, buffer_len);
-        free(buffer);
-    }
+    ret = CKR_OK;
+out:
+    EVP_PKEY_CTX_free(ctx);
     return ret;
 }
 
-
 CK_RV
 C_VerifyUpdate(CK_SESSION_HANDLE hSession,
                CK_BYTE_PTR pPart,
@@ -2072,7 +2034,6 @@
     return CKR_FUNCTION_NOT_SUPPORTED;
 }
 
-
 CK_FUNCTION_LIST funcs = {
     { 2, 11 },
     C_Initialize,

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_authdata.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_authdata.py Changed

@@ -6,12 +6,12 @@
 conf = {'plugins': {'kdcauthdata': {'module': 'greet:' + greet_path}}}
 realm = K5Realm(krb5_conf=conf)
 
-# With no requested authdata, we expect to see SIGNTICKET (512) in an
+# With no requested authdata, we expect to see PAC (128) in an
 # if-relevant container and the greet authdata in a kdc-issued
 # container.
 mark('baseline authdata')
 out = realm.run('./adata', realm.host_princ)
-if '?512: ' not in out or '^-42: Hello' not in out:
+if '?128: 6, 7, 10, 16' not in out or '^-42: Hello' not in out:
     fail('expected authdata not seen for basic request')
 
 # Requested authdata is copied into the ticket, with KDC-only types
@@ -29,54 +29,44 @@
 realm.run('./adata', realm.host_princ, '!-1', 'mandatoryforkdc',
           expected_code=1, expected_msg='KDC policy rejects request')
 
-# The no_auth_data_required server flag should suppress SIGNTICKET,
-# but not module or request authdata.
+# The no_auth_data_required server flag should suppress the PAC, but
+# not module or request authdata.
 mark('no_auth_data_required server flag')
 realm.run(kadminl, 'ank', '-randkey', '+no_auth_data_required', 'noauth')
 realm.extract_keytab('noauth', realm.keytab)
 out = realm.run('./adata', 'noauth', '-2', 'test')
 if '^-42: Hello' not in out or ' -2: test' not in out:
     fail('expected authdata not seen for no_auth_data_required request')
-if '512: ' in out:
-    fail('SIGNTICKET authdata seen for no_auth_data_required request')
+if '128: ' in out:
+    fail('PAC authdata seen for no_auth_data_required request')
 
-# Cross-realm TGT requests should also suppress SIGNTICKET, but not
-# module or request authdata.
+# Cross-realm TGT requests should not suppress PAC or request
+# authdata.
 mark('cross-realm')
 realm.addprinc('krbtgt/XREALM')
 realm.extract_keytab('krbtgt/XREALM', realm.keytab)
 out = realm.run('./adata', 'krbtgt/XREALM', '-3', 'test')
-if '^-42: Hello' not in out or ' -3: test' not in out:
+if '128:' not in out or  '^-42: Hello' not in out or ' -3: test' not in out:
     fail('expected authdata not seen for cross-realm TGT request')
-if '512: ' in out:
-    fail('SIGNTICKET authdata seen in cross-realm TGT')
 
 realm.stop()
 
-if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')):
+if not pkinit_enabled:
     skipped('anonymous ticket authdata tests', 'PKINIT not built')
 else:
     # Set up a realm with PKINIT support and get anonymous tickets.
-    certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs')
-    ca_pem = os.path.join(certs, 'ca.pem')
-    kdc_pem = os.path.join(certs, 'kdc.pem')
-    privkey_pem = os.path.join(certs, 'privkey.pem')
-    pkinit_conf = {'realms': {'$realm': {
-                'pkinit_anchors': 'FILE:%s' % ca_pem,
-                'pkinit_identity': 'FILE:%s,%s' % (kdc_pem, privkey_pem)}}}
-    conf.update(pkinit_conf)
-    realm = K5Realm(krb5_conf=conf, get_creds=False)
+    realm = K5Realm(krb5_conf=conf, get_creds=False, pkinit=True)
     realm.addprinc('WELLKNOWN/ANONYMOUS')
     realm.kinit('@%s' % realm.realm, flags='-n')
 
-    # SIGNTICKET and module authdata should be suppressed for
-    # anonymous tickets, but not request authdata.
+    # PAC and module authdata should be suppressed for anonymous
+    # tickets, but not request authdata.
     mark('anonymous')
     out = realm.run('./adata', realm.host_princ, '-4', 'test')
     if ' -4: test' not in out:
         fail('expected authdata not seen for anonymous request')
-    if '512: ' in out or '-42: ' in out:
-        fail('SIGNTICKET or greet authdata seen for anonymous request')
+    if '128: ' in out or '-42: ' in out:
+        fail('PAC or greet authdata seen for anonymous request')
 
 realm.stop()
 
@@ -191,7 +181,8 @@
 realm2.stop()
 
 # Load the test KDB module to allow successful S4U2Proxy
-# auth-indicator requests.
+# auth-indicator requests and to detect whether replaced_reply_key is
+# set.
 testprincs = {'krbtgt/KRBTEST.COM': {'keys': 'aes128-cts'},
               'krbtgt/FOREIGN': {'keys': 'aes128-cts'},
               'user': {'keys': 'aes128-cts', 'flags': '+preauth'},
@@ -207,7 +198,8 @@
            'dbmodules': {'test': {'db_library': 'test',
                                   'princs': testprincs,
                                   'delegation': {'service/1': 'service/2'}}}}
-realm = K5Realm(krb5_conf=krb5conf, kdc_conf=kdcconf, create_kdb=False)
+realm = K5Realm(krb5_conf=krb5conf, kdc_conf=kdcconf, create_kdb=False,
+                pkinit=True)
 usercache = 'FILE:' + os.path.join(realm.testdir, 'usercache')
 realm.extract_keytab(realm.krbtgt_princ, realm.keytab)
 realm.extract_keytab('krbtgt/FOREIGN', realm.keytab)
@@ -218,6 +210,17 @@
 realm.extract_keytab('noauthdata', realm.keytab)
 realm.start_kdc()
 
+if not pkinit_enabled:
+    skipped('replaced_reply_key test', 'PKINIT not built')
+else:
+    # Check that replaced_reply_key is set in issue_pac() when PKINIT
+    # is used.  The test KDB module will indicate this by including a
+    # fake PAC_CREDENTIAL_INFO(2) buffer in the PAC.
+    mark('PKINIT (replaced_reply_key set)')
+    realm.pkinit(realm.user_princ)
+    realm.run('./adata', realm.krbtgt_princ,
+              expected_msg='?128: 1, 2, 6, 7, 10')
+
 # S4U2Self (should have no indicators since client did not authenticate)
 mark('S4U2Self (no auth indicators expected)')
 realm.kinit('service/1', None, '-k', '-f', '-X', 'indicators=inds1')
@@ -239,6 +242,9 @@
 out = realm.run('./adata', '-p', realm.user_princ, 'service/2')
 if '+97: indcl' not in out or 'inds1' in out:
     fail('correct auth-indicator not seen for S4U2Proxy req')
+# Make sure a PAC with an S4U_DELEGATION_INFO(11) buffer is included.
+if '?128: 1, 6, 7, 10, 11, 16' not in out:
+    fail('PAC with delegation info not seen for S4U2Proxy req')
 
 # Get another S4U2Proxy ticket including request-authdata.
 realm.run('./s4u2proxy', usercache, 'service/2', '-2', 'proxy_ad')
@@ -264,40 +270,20 @@
             '-k', '-X', 'indicators=strong dbincr1', '-S', 'rservice',
             expected_code=1)
 
-# Test that KDB module authdata is included in an AS request, by
-# default or with an explicit PAC request.
-mark('AS-REQ KDB module authdata')
-realm.kinit(realm.user_princ, None, '-k')
-realm.run('./adata', realm.krbtgt_princ,
-          expected_msg='-456: db-authdata-test')
-realm.kinit(realm.user_princ, None, '-k', '--request-pac')
-realm.run('./adata', realm.krbtgt_princ,
-          expected_msg='-456: db-authdata-test')
-
-# Test that KDB module authdata is suppressed in an AS request by a
-# negative PAC request.
-mark('AS-REQ KDB module authdata client supression')
+# Test that the PAC is suppressed in an AS request by a negative PAC
+# request.
+mark('AS-REQ PAC client supression')
 realm.kinit(realm.user_princ, None, '-k', '--no-request-pac')
 out = realm.run('./adata', realm.krbtgt_princ)
-if '-456: db-authdata-test' in out:
-    fail('DB authdata not suppressed by --no-request-pac')
-
-# Test that KDB authdata is included in a TGS request by default.
-mark('TGS-REQ KDB authdata')
-realm.run('./adata', 'service/1', expected_msg='-456: db-authdata-test')
-
-# Test that KDB authdata is suppressed in a TGS request by the
-# +no_auth_data_required flag.
-mark('TGS-REQ KDB authdata service suppression')
-out = realm.run('./adata', 'noauthdata')
-if '-456: db-authdata-test' in out:
-    fail('DB authdata not suppressed by +no_auth_data_required')
+if '128:' in out:
+    fail('PAC not suppressed by --no-request-pac')
 
 mark('S4U2Proxy with a foreign client')
 
 a_princs = {'krbtgt/A': {'keys': 'aes128-cts'},
             'krbtgt/B': {'keys': 'aes128-cts'},
             'impersonator': {'keys': 'aes128-cts'},
+            'impersonator2': {'keys': 'aes128-cts'},
             'resource': {'keys': 'aes128-cts'}}
 a_kconf = {'realms': {'$realm': {'database_module': 'test'}},
            'dbmodules': {'test': {'db_library': 'test',
@@ -312,9 +298,9 @@
 b_kconf = {'realms': {'$realm': {'database_module': 'test'}},
            'dbmodules': {'test': {'db_library': 'test',
                                   'princs': b_princs,
-                                  'rbcd': {'rb@B': 'impersonator@A'},
+                                  'rbcd': {'rb@B': 'impersonator2@A'},
                                   'alias': {'service/rb.b': 'rb',
-                                            'impersonator@A': '@A'}}}}
+                                            'impersonator2@A': '@A'}}}}
 
 ra, rb = cross_realms(2, xtgts=(),
                           args=({'realm': 'A', 'kdc_conf': a_kconf},
@@ -325,6 +311,7 @@
 rb.start_kdc()
 
 ra.extract_keytab('impersonator@A', ra.keytab)
+ra.extract_keytab('impersonator2@A', ra.keytab)
 rb.extract_keytab('user@B', rb.keytab)
 
 usercache = 'FILE:' + os.path.join(rb.testdir, 'usercache')
@@ -336,11 +323,11 @@
 
 mark('Cross realm S4U authdata tests')
 
-ra.kinit('impersonator@A', None, '-k', '-t', ra.keytab)
-ra.run('./s4u2self', rb.user_princ, 'impersonator@A', usercache, '-2',
+ra.kinit('impersonator2@A', None, '-f', '-k', '-t', ra.keytab)
+ra.run('./s4u2self', rb.user_princ, 'impersonator2@A', usercache, '-2',
         'cross_s4u_self_ad')
 out = ra.run('./adata', '-c', usercache, '-p', rb.user_princ,
-              'impersonator@A', '-2', 'cross_s4u_self_ad')
+              'impersonator2@A', '-2', 'cross_s4u_self_ad')
 if out.count(' -2: cross_s4u_self_ad') != 1:
     fail('expected one cross_s4u_self_ad, got: %s' % count)
 
@@ -357,9 +344,4 @@
 ra.stop()
 rb.stop()
 
-# Additional KDB module authdata behavior we don't currently test:
-# * KDB module authdata is suppressed in TGS requests if the TGT
-#   contains no authdata and the request is not cross-realm or S4U.
-# * KDB module authdata is suppressed for anonymous tickets.
-
 success('Authorization data tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_ccache.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_ccache.py Changed

@@ -21,11 +21,18 @@
 # or implied warranty.
 
 from k5test import *
+import tempfile
 
-kcm_socket_path = os.path.join(os.getcwd(), 'testdir', 'kcm')
+socketdir = tempfile.TemporaryDirectory()
+kcm_socket_path = os.path.join(socketdir.name, 'kcm')
 conf = {'libdefaults': {'kcm_socket': kcm_socket_path,
                         'kcm_mach_service': '-'}}
-realm = K5Realm(create_host=False, krb5_conf=conf)
+realm = K5Realm(krb5_conf=conf)
+
+realm.addprinc('contest')
+realm.extract_keytab('contest', realm.keytab)
+realm.run('./conccache', realm.ccache + '.contest', 'contest',
+           realm.host_princ)
 
 keyctl = which('keyctl')
 out = realm.run(klist, '-c', 'KEYRING:process:abcd', expected_code=1)
@@ -71,6 +78,11 @@
     realm.kinit('alice', password('alice'))
     realm.run(klist, expected_msg='Default principal: alice@')
     realm.run(klist, '-A', '-s')
+    realm.run(kvno, realm.host_princ, expected_msg = 'kvno = 1')
+    realm.run(kvno, realm.host_princ, expected_msg = 'kvno = 1')
+    out = realm.run(klist)
+    if out.count(realm.host_princ) != 1:
+        fail('Wrong number of service tickets in cache')
     realm.run(kdestroy)
     output = realm.run(klist, expected_code=1)
     if 'No credentials cache' not in output and 'not found' not in output:
@@ -125,10 +137,18 @@
 
 
 collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc'))
+
+# Test KCM with and without RETRIEVE and GET_CRED_LIST support.
 kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py')
-realm.start_server(sys.executable, kcmserver_path, kcm_socket_path,
+kcmd = realm.start_server(sys.executable, kcmserver_path, kcm_socket_path,
+                          'starting...')
+collection_test(realm, 'KCM:')
+stop_daemon(kcmd)
+os.remove(kcm_socket_path)
+realm.start_server(sys.executable, kcmserver_path, '-f', kcm_socket_path,
                    'starting...')
 collection_test(realm, 'KCM:')
+
 if test_keyring:
     def cleanup_keyring(anchor, name):
         out = realm.run('keyctl', 'list', anchor)

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_certauth.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_certauth.py Changed

@@ -1,59 +1,65 @@
 from k5test import *
 
 # Skip this test if pkinit wasn't built.
-if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')):
+if not pkinit_enabled:
     skip_rest('certauth tests', 'PKINIT module not built')
 
-certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs')
-ca_pem = os.path.join(certs, 'ca.pem')
-kdc_pem = os.path.join(certs, 'kdc.pem')
-privkey_pem = os.path.join(certs, 'privkey.pem')
-user_pem = os.path.join(certs, 'user.pem')
-
 modpath = os.path.join(buildtop, 'plugins', 'certauth', 'test',
                        'certauth_test.so')
-pkinit_krb5_conf = {'realms': {'$realm': {
-            'pkinit_anchors': 'FILE:%s' % ca_pem}},
-            'plugins': {'certauth': {'module': 'test1:' + modpath,
-                                                'test2:' + modpath,
-                                     'enable_only': 'test1', 'test2'}}}
-pkinit_kdc_conf = {'realms': {'$realm': {
-            'default_principal_flags': '+preauth',
-            'pkinit_eku_checking': 'none',
-            'pkinit_identity': 'FILE:%s,%s' % (kdc_pem, privkey_pem),
-            'pkinit_indicator': 'indpkinit1', 'indpkinit2'}}}
-
-file_identity = 'FILE:%s,%s' % (user_pem, privkey_pem)
-
-realm = K5Realm(krb5_conf=pkinit_krb5_conf, kdc_conf=pkinit_kdc_conf,
-                get_creds=False)
-
-# Let the test module match user to CN=user, with indicators.
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity)
+krb5_conf = {'plugins': {'certauth': {
+    'module': 'test1:' + modpath, 'test2:' + modpath, 'test3:' + modpath,
+    'enable_only': 'test1', 'test2', 'test3'}}}
+kdc_conf = {'realms': {'$realm': {
+    'default_principal_flags': '+preauth',
+    'pkinit_indicator': 'indpkinit1', 'indpkinit2'}}}
+
+realm = K5Realm(krb5_conf=krb5_conf, kdc_conf=kdc_conf, get_creds=False,
+                pkinit=True)
+realm.addprinc('nocert')
+
+def check_indicators(inds):
+    msg = '+97: %s' % inds
+    realm.run('./adata', realm.host_princ, expected_msg=msg)
+
+# Test that authentication fails if no module accepts.
+realm.pkinit('nocert', expected_code=1, expected_msg='Client name mismatch')
+
+# Let the test2 module match user to CN=user, with indicators.
+realm.pkinit(realm.user_princ)
 realm.klist(realm.user_princ)
-realm.run(kvno, realm.host_princ)
-realm.run('./adata', realm.host_princ,
-          expected_msg='+97: test1, test2, user, indpkinit1, indpkinit2')
+check_indicators('test1, test2, user, indpkinit1, indpkinit2')
 
-# Let the test module mismatch with user2 to CN=user.
-realm.addprinc("user2@KRBTEST.COM")
-out = realm.kinit("user2@KRBTEST.COM",
-                  flags='-X', 'X509_user_identity=%s' % file_identity,
-                  expected_code=1,
-                  expected_msg='kinit: Certificate mismatch')
+# Let the test2 module mismatch with user2 to CN=user.
+realm.addprinc('user2@KRBTEST.COM')
+realm.pkinit('user2', expected_code=1, expected_msg='Certificate mismatch')
 
 # Test the KRB5_CERTAUTH_HWAUTH return code.
 mark('hw-authent flag tests')
 # First test +requires_hwauth without causing the hw-authent ticket
 # flag to be set.  This currently results in a preauth loop.
 realm.run(kadminl, 'modprinc', '+requires_hwauth', realm.user_princ)
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity,
-            expected_code=1, expected_msg='Looping detected')
-# Cause the test2 module to return KRB5_CERTAUTH_HWAUTH and try again.
-realm.run(kadminl, 'setstr', realm.user_princ, 'hwauth', 'x')
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity)
+realm.pkinit(realm.user_princ, expected_code=1,
+             expected_msg='Looping detected')
+# Cause the test3 module to return KRB5_CERTAUTH_HWAUTH and try again.
+# Authentication should succeed whether or not another module accepts,
+# but not if another module rejects.
+realm.run(kadminl, 'setstr', realm.user_princ, 'hwauth', 'ok')
+realm.run(kadminl, 'setstr', 'user2', 'hwauth', 'ok')
+realm.run(kadminl, 'setstr', 'nocert', 'hwauth', 'ok')
+realm.pkinit(realm.user_princ)
+check_indicators('test1, test2, user, hwauth:ok, indpkinit1, indpkinit2')
+realm.pkinit('user2', expected_code=1, expected_msg='Certificate mismatch')
+realm.pkinit('nocert')
+check_indicators('test1, hwauth:ok, indpkinit1, indpkinit2')
+
+# Cause the test3 module to return KRB5_CERTAUTH_HWAUTH_PASS and try
+# again.  Authentication should succeed only if another module accepts.
+realm.run(kadminl, 'setstr', realm.user_princ, 'hwauth', 'pass')
+realm.run(kadminl, 'setstr', 'user2', 'hwauth', 'pass')
+realm.run(kadminl, 'setstr', 'nocert', 'hwauth', 'pass')
+realm.pkinit(realm.user_princ)
+check_indicators('test1, test2, user, hwauth:pass, indpkinit1, indpkinit2')
+realm.pkinit('user2', expected_code=1, expected_msg='Certificate mismatch')
+realm.pkinit('nocert', expected_code=1, expected_msg='Client name mismatch')
 
 success("certauth tests")

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_changepw.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_changepw.py Changed

@@ -1,23 +1,24 @@
 from k5test import *
 
-# This file is intended to cover any password-changing mechanism.  For
-# now it only contains a regression test for #7868.
-
 realm = K5Realm(create_host=False, get_creds=False, start_kadmind=True)
+realm.prep_kadmin()
 
 # Mark a principal as expired and change its password through kinit.
+mark('password change via kinit')
 realm.run(kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user')
 pwinput = password('user') + '\nabcd\nabcd\n'
 realm.run(kinit, realm.user_princ, input=pwinput)
 
-# Do the same thing with FAST, with tracing turned on.
-realm.run(kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user')
+# Regression test for #7868 (preauth options ignored when
+# krb5_get_init_creds_password() initiates a password change).  This
+# time use the REQUIRES_PWCHANGE bit instead of the password
+# expiration time.
+mark('password change via kinit with FAST')
+realm.run(kadminl, 'modprinc', '+needchange', 'user')
 pwinput = 'abcd\nefgh\nefgh\n'
 out, trace = realm.run(kinit, '-T', realm.ccache, realm.user_princ,
                        input=pwinput, return_trace=True)
-
-# Read the trace and check that FAST was used when getting the
-# kadmin/changepw ticket.
+# Check that FAST was used when getting the kadmin/changepw ticket.
 getting_changepw = fast_used_for_changepw = False
 for line in trace.splitlines():
     if 'Getting initial credentials for user@' in line:
@@ -29,4 +30,21 @@
 if not fast_used_for_changepw:
     fail('FAST was not used to get kadmin/changepw ticket')
 
+# Test that passwords specified via kadmin and kpasswd are usable with
+# kinit.
+mark('password change usability by kinit')
+realm.run(kadminl, 'addprinc', '-pw', 'pw1', 'testprinc')
+# Run kpasswd with an active cache to exercise automatic FAST use.
+realm.kinit('testprinc', 'pw1')
+realm.run(kpasswd, 'testprinc', input='pw1\npw2\npw2\n')
+realm.kinit('testprinc', 'pw2')
+realm.run(kdestroy)
+realm.run(kpasswd, 'testprinc', input='pw2\npw3\npw3\n')
+realm.kinit('testprinc', 'pw3')
+realm.run(kdestroy)
+realm.run_kadmin('cpw', '-pw', 'pw4', 'testprinc')
+realm.kinit('testprinc', 'pw4')
+realm.run(kdestroy)
+realm.run(kadminl, 'delprinc', 'testprinc')
+
 success('Password change tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_general.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_general.py Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_inetd.c Added

@@ -0,0 +1,129 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* tests/t_inetd.c */
+/*
+ * Copyright 1991 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ */
+
+/*
+ * A simple program to simulate starting a process from inetd.
+ *
+ * Unlike a proper inetd situation, environment variables are passed
+ * to the client.
+ *
+ * usage: t_inetd port program argv0 ...
+ */
+
+#include "autoconf.h"
+
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <string.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <signal.h>
+
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
+#include "com_err.h"
+
+
+char *progname;
+
+static void usage()
+{
+    fprintf(stderr, "%s: port program argv0 argv1 ...\n", progname);
+    exit(1);
+}
+
+int
+main(argc, argv)
+    int argc;
+    char **argv;
+{
+    unsigned short port;
+    char *path;
+    int sock, acc;
+    int one = 1;
+    struct sockaddr_in l_inaddr, f_inaddr;  /* local, foreign address */
+    socklen_t namelen = sizeof(f_inaddr);
+
+    progname = argv0;
+
+    if(argc <= 3) usage();
+
+    if(atoi(argv1) == 0) usage();
+
+    port = htons(atoi(argv1));
+    path = argv2;
+
+    if ((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
+        com_err(progname, errno, "creating socket");
+        exit(3);
+    }
+
+    (void) setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (char *)&one,
+                      sizeof (one));
+
+    memset(&l_inaddr, 0, sizeof(l_inaddr));
+    l_inaddr.sin_family = AF_INET;
+    l_inaddr.sin_addr.s_addr = 0;
+    l_inaddr.sin_port = port;
+
+    if (bind(sock, (struct sockaddr *)&l_inaddr, sizeof(l_inaddr))) {
+        com_err(progname, errno, "binding socket");
+        exit(3);
+    }
+
+    if (listen(sock, 1) == -1) {
+        com_err(progname, errno, "listening");
+        exit(3);
+    }
+
+    printf("Ready!\n");
+    fflush(stdout);
+    if ((acc = accept(sock, (struct sockaddr *)&f_inaddr,
+                      &namelen)) == -1) {
+        com_err(progname, errno, "accepting");
+        exit(3);
+    }
+
+    dup2(acc, 0);
+    dup2(acc, 1);
+    dup2(acc, 2);
+    close(sock);
+    sock = 0;
+
+    if(execv(path, &argv3))
+        fprintf(stderr, "t_inetd: Could not exec %s\n", path);
+    exit(1);
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_iprop.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_iprop.py Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_kadmin.py Added

@@ -0,0 +1,66 @@
+from k5test import *
+
+realm = K5Realm(start_kadmind=True)
+
+# Create a principal.  Test -q option and keyboard entry of the admin
+# password and principal password.  Verify creation with kadmin.local.
+realm.run(kadmin, '-q', 'addprinc princ/pw',
+          input=password('admin') + '\npw1\npw1\n')
+realm.run(kadminl, 'getprinc', 'princ/pw',
+          expected_msg='Principal: princ/pw@KRBTEST.COM')
+
+# Run the remaining tests with a cache for efficiency.
+realm.prep_kadmin()
+
+realm.run_kadmin('addpol', 'standardpol')
+realm.run_kadmin('listpols', expected_msg='standardpol')
+realm.run_kadmin('modpol', '-minlength', '5', 'standardpol')
+realm.run_kadmin('getpol', 'standardpol',
+                 expected_msg='Minimum password length: 5')
+
+realm.run_kadmin('addprinc', '-randkey', 'princ/random')
+realm.run(kadminl, 'getprinc', 'princ/random',
+          expected_msg='Principal: princ/random@KRBTEST.COM')
+
+realm.run_kadmin('cpw', 'princ/pw', input='newpw\nnewpw\n')
+realm.run_kadmin('cpw', '-randkey', 'princ/random')
+
+realm.run_kadmin('modprinc', '-allow_tix', 'princ/random')
+realm.run_kadmin('modprinc', '+allow_tix', 'princ/random')
+realm.run_kadmin('modprinc', '-policy', 'standardpol', 'princ/random')
+
+realm.run_kadmin('listprincs', expected_msg='princ/random@KRBTEST.COM')
+
+realm.run_kadmin('ktadd', 'princ/pw')
+
+realm.run_kadmin('delprinc', 'princ/random')
+realm.run(kadminl, 'getprinc', 'princ/random', expected_code=1,
+          expected_msg='Principal does not exist')
+realm.run_kadmin('delprinc', 'princ/pw')
+realm.run(kadminl, 'getprinc', 'princ/pw', expected_code=1,
+          expected_msg='Principal does not exist')
+
+realm.run_kadmin('delpol', 'standardpol')
+realm.run(kadminl, 'getpol', 'standardpol', expected_code=1,
+          expected_msg='Policy does not exist')
+
+# Regression test for #2877 (fixed-sized GSSRPC buffers can't
+# accomodate large listprinc results).
+mark('large listprincs result')
+for i in range(200):
+    realm.run_kadmin('addprinc', '-randkey', 'foo%d' % i)
+realm.run_kadmin('listprincs', expected_msg='foo199')
+
+# Test kadmin -k with the default principal, with and without
+# fallback.  This operation requires canonicalization against the
+# keytab in krb5_get_init_creds_keytab() as the
+# krb5_sname_to_principal() result won't have a realm.  Try with and
+# without without fallback processing since the code paths are
+# different.
+mark('kadmin -k')
+realm.run(kadmin, '-k', 'getprinc', realm.host_princ)
+no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}}
+no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf)
+realm.run(kadmin, '-k', 'getprinc', realm.host_princ, env=no_canon)
+
+success('kadmin and kpasswd tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_keytab.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_keytab.py Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_kprop.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_kprop.py Changed

@@ -87,5 +87,39 @@
 realm.run(kprop, '-f', dumpfile, '-P', str(realm.kprop_port()), hostname)
 check_output(kpropd)
 realm.run(kadminl, 'listprincs', replica3, expected_msg='wakawaka')
+stop_daemon(kpropd)
+
+# This test is too resource-intensive to be included in "make check"
+# by default, but it can be enabled in the environment to test the
+# propagation of databases large enough to require a 12-byte encoding
+# of the database size.
+if 'KPROP_LARGE_DB_TEST' in os.environ:
+    output('Generating >4GB dumpfile\n')
+    with open(dumpfile, 'w') as f:
+        f.write('kdb5_util load_dump version 6\n')
+        f.write('princ\t38\t15\t3\t1\t0\tK/M@KRBTEST.COM\t64\t86400\t0\t0\t0'
+                '\t0\t0\t0\t8\t2\t0100\t9\t8\t0100010000000000\t2\t28'
+                '\tb93e105164625f6372656174696f6e404b5242544553542e434f4d00'
+                '\t1\t1\t18\t62\t2000408c027c250e8cc3b81476414f2214d57c1ce'
+                '38891e29792e87258247c73547df4d5756266931dd6686b62270e6568'
+                '95a31ec66bfe913b4f15226227\t-1;\n')
+        for i in range(1, 20000000):
+            f.write('princ\t38\t21\t1\t1\t0\tp%08d@KRBTEST.COM' % i)
+            f.write('\t0\t86400\t0\t0\t0\t0\t0\t0\t2\t27'
+                    '\td73e1051757365722f61646d696e404b5242544553542e434f4d00'
+                    '\t1\t1\t17\t46'
+                    '\t10009c8ab7b3f89ccf3ca3ad98352a461b7f4f1b0c49'
+                    '5605117591d9ad52ba4da0adef7a902126973ed2bdc3ffbf\t-1;\n')
+    assert os.path.getsize(dumpfile) > 4 * 1024 * 1024 * 1024
+    with open(dumpfile + '.dump_ok', 'w') as f:
+        f.write('\0')
+    conf_large = {'dbmodules': {'db': {'database_name': '$testdir/db.large'}},
+                  'realms': {'$realm': {'iprop_resync_timeout': '3600'}}}
+    large = realm.special_env('large', True, kdc_conf=conf_large)
+    kpropd = realm.start_kpropd(large, '-d')
+    realm.run(kprop, '-f', dumpfile, '-P', str(realm.kprop_port()), hostname)
+    check_output(kpropd)
+    realm.run(kadminl, 'getprinc', 'p19999999', env=large,
+              expected_msg='Principal: p19999999')
 
 success('kprop tests')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_pkinit.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_pkinit.py Changed

@@ -1,33 +1,27 @@
 from k5test import *
 
 # Skip this test if pkinit wasn't built.
-if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')):
+if not pkinit_enabled:
     skip_rest('PKINIT tests', 'PKINIT module not built')
 
 soft_pkcs11 = os.path.join(buildtop, 'tests', 'softpkcs11', 'softpkcs11.so')
 
 # Construct a krb5.conf fragment configuring pkinit.
-certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs')
-ca_pem = os.path.join(certs, 'ca.pem')
-kdc_pem = os.path.join(certs, 'kdc.pem')
-user_pem = os.path.join(certs, 'user.pem')
-privkey_pem = os.path.join(certs, 'privkey.pem')
-privkey_enc_pem = os.path.join(certs, 'privkey-enc.pem')
-user_p12 = os.path.join(certs, 'user.p12')
-user_enc_p12 = os.path.join(certs, 'user-enc.p12')
-user_upn_p12 = os.path.join(certs, 'user-upn.p12')
-user_upn2_p12 = os.path.join(certs, 'user-upn2.p12')
-user_upn3_p12 = os.path.join(certs, 'user-upn3.p12')
-generic_p12 = os.path.join(certs, 'generic.p12')
+user_pem = os.path.join(pkinit_certs, 'user.pem')
+privkey_pem = os.path.join(pkinit_certs, 'privkey.pem')
+privkey_enc_pem = os.path.join(pkinit_certs, 'privkey-enc.pem')
+user_p12 = os.path.join(pkinit_certs, 'user.p12')
+user_enc_p12 = os.path.join(pkinit_certs, 'user-enc.p12')
+user_upn_p12 = os.path.join(pkinit_certs, 'user-upn.p12')
+user_upn2_p12 = os.path.join(pkinit_certs, 'user-upn2.p12')
+user_upn3_p12 = os.path.join(pkinit_certs, 'user-upn3.p12')
+generic_p12 = os.path.join(pkinit_certs, 'generic.p12')
 path = os.path.join(os.getcwd(), 'testdir', 'tmp-pkinit-certs')
 path_enc = os.path.join(os.getcwd(), 'testdir', 'tmp-pkinit-certs-enc')
 
-pkinit_krb5_conf = {'realms': {'$realm': {
-            'pkinit_anchors': 'FILE:%s' % ca_pem}}}
 pkinit_kdc_conf = {'realms': {'$realm': {
             'default_principal_flags': '+preauth',
             'pkinit_eku_checking': 'none',
-            'pkinit_identity': 'FILE:%s,%s' % (kdc_pem, privkey_pem),
             'pkinit_indicator': 'indpkinit1', 'indpkinit2'}}}
 restrictive_kdc_conf = {'realms': {'$realm': {
             'restrict_anonymous_to_tgt': 'true' }}}
@@ -41,7 +35,6 @@
             'default_principal_flags': '+preauth',
             'pkinit_eku_checking': 'none',
             'pkinit_allow_upn': 'true',
-            'pkinit_identity': 'FILE:%s,%s' % (kdc_pem, privkey_pem),
             'database_module': 'test'}},
                   'dbmodules': {'test': {
                       'db_library': 'test',
@@ -67,8 +60,7 @@
                       ':slotid=1:token=SoftToken (token)')
 
 # Start a realm with the test kdb module for the following UPN SAN tests.
-realm = K5Realm(krb5_conf=pkinit_krb5_conf, kdc_conf=alias_kdc_conf,
-                create_kdb=False)
+realm = K5Realm(kdc_conf=alias_kdc_conf, create_kdb=False, pkinit=True)
 realm.start_kdc()
 
 mark('UPN SANs')
@@ -104,8 +96,7 @@
           expected_code=1, expected_msg=msg)
 realm.stop()
 
-realm = K5Realm(krb5_conf=pkinit_krb5_conf, kdc_conf=pkinit_kdc_conf,
-                get_creds=False)
+realm = K5Realm(kdc_conf=pkinit_kdc_conf, get_creds=False, pkinit=True)
 
 # Sanity check - password-based preauth should still work.
 mark('password preauth sanity check')
@@ -177,9 +168,7 @@
         'PKINIT client verified DH reply',
         'PKINIT client found id-pkinit-san in KDC cert',
         'PKINIT client matched KDC principal krbtgt/')
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity,
-            expected_trace=msgs)
+realm.pkinit(realm.user_princ, expected_trace=msgs)
 realm.klist(realm.user_princ)
 realm.run(kvno, realm.host_princ)
 
@@ -192,11 +181,9 @@
 
 # Try again using RSA instead of DH.
 mark('FILE identity, no password, RSA')
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity,
-                   '-X', 'flag_RSA_PROTOCOL=yes',
-            expected_trace=('PKINIT client making RSA request',
-                            'PKINIT client verified RSA reply'))
+realm.pkinit(realm.user_princ, flags='-X', 'flag_RSA_PROTOCOL=yes',
+             expected_trace=('PKINIT client making RSA request',
+                             'PKINIT client verified RSA reply'))
 realm.klist(realm.user_princ)
 
 # Test a DH parameter renegotiation by temporarily setting a 4096-bit
@@ -217,25 +204,18 @@
         'trying again with KDC-provided parameters',
         'Preauth module pkinit (16) tryagain returned: 0/Success',
         ' preauth for next request: PA-PK-AS-REQ (16), PA-FX-COOKIE (133)')
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity,
-            expected_trace=msgs)
+realm.pkinit(realm.user_princ, expected_trace=msgs)
 
 # Test enforcement of required freshness tokens.  (We can leave
 # freshness tokens required after this test.)
 mark('freshness token enforcement')
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity,
-                   '-X', 'disable_freshness=yes')
+realm.pkinit(realm.user_princ, flags='-X', 'disable_freshness=yes')
 f_env = realm.special_env('freshness', True, kdc_conf=freshness_kdc_conf)
 realm.stop_kdc()
 realm.start_kdc(env=f_env)
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity)
-realm.kinit(realm.user_princ,
-            flags='-X', 'X509_user_identity=%s' % file_identity,
-                   '-X', 'disable_freshness=yes',
-            expected_code=1, expected_msg='Preauthentication failed')
+realm.pkinit(realm.user_princ)
+realm.pkinit(realm.user_princ, flags='-X', 'disable_freshness=yes',
+             expected_code=1, expected_msg='Preauthentication failed')
 # Anonymous should never require a freshness token.
 realm.kinit('@%s' % realm.realm, flags='-n', '-X', 'disable_freshness=yes')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_policy.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_policy.py Changed

@@ -25,6 +25,68 @@
 realm.run(kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser')
 realm.run(kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser')
 
+# Regression test for #929 (kadmind crash with more historical
+# passwords in a principal entry than current policy history setting).
+mark('password history (policy value reduced below current array size)')
+realm.run(kadminl, 'addpol', '-history', '5', 'histpol')
+realm.addprinc('histprinc', 'first')
+realm.run(kadminl, 'modprinc', '-policy', 'histpol', 'histprinc')
+realm.run(kadminl, 'cpw', '-pw', 'second', 'histprinc')
+realm.run(kadminl, 'cpw', '-pw', 'third', 'histprinc')
+realm.run(kadminl, 'cpw', '-pw', 'fourth', 'histprinc')
+realm.run(kadminl, 'modpol', '-history', '3', 'histpol')
+realm.run(kadminl, 'cpw', '-pw', 'fifth', 'histprinc')
+realm.run(kadminl, 'delprinc', 'histprinc')
+
+# Regression test for #2841 (heap buffer overflow when policy history
+# value is reduced to match the number of historical passwords for a
+# principal).
+mark('password history (policy value reduced to current array size)')
+def histfail(*pwlist):
+    for pw in pwlist:
+        realm.run(kadminl, 'cpw', '-pw', pw, 'histprinc', expected_code=1,
+                  expected_msg='Cannot reuse password')
+realm.run(kadminl, 'modpol', '-history', '3', 'histpol')
+realm.addprinc('histprinc', '1111')
+realm.run(kadminl, 'modprinc', '-policy', 'histpol', 'histprinc')
+realm.run(kadminl, 'cpw', '-pw', '2222', 'histprinc')
+histfail('2222', '1111')
+realm.run(kadminl, 'modpol', '-history', '2', 'histpol')
+realm.run(kadminl, 'cpw', '-pw', '3333', 'histprinc')
+
+# Test that the history array is properly resized if the policy
+# history value is increased after the array is filled.
+mark('password history (policy value increase)')
+realm.run(kadminl, 'delprinc', 'histprinc')
+realm.addprinc('histprinc', '1111')
+realm.run(kadminl, 'modprinc', '-policy', 'histpol', 'histprinc')
+realm.run(kadminl, 'cpw', '-pw', '2222', 'histprinc')
+histfail('2222', '1111')
+realm.run(kadminl, 'cpw', '-pw', '2222', 'histprinc', expected_code=1,
+          expected_msg='Cannot reuse password')
+realm.run(kadminl, 'cpw', '-pw', '1111', 'histprinc', expected_code=1,
+          expected_msg='Cannot reuse password')
+realm.run(kadminl, 'modpol', '-history', '3', 'histpol')
+realm.run(kadminl, 'cpw', '-pw', '3333', 'histprinc')
+histfail('3333', '2222', '1111')
+realm.run(kadminl, 'modpol', '-history', '4', 'histpol')
+histfail('3333', '2222', '1111')
+realm.run(kadminl, 'cpw', '-pw', '4444', 'histprinc')
+histfail('4444', '3333', '2222', '1111')
+
+# Test that when the policy history value is reduced, all currently
+# known old passwords still fail until the next password change, after
+# which the new number of old passwords fails (but no more).
+mark('password history (policy value reduction)')
+realm.run(kadminl, 'modpol', '-history', '3', 'histpol')
+histfail('4444', '3333', '2222', '1111')
+realm.run(kadminl, 'cpw', '-pw', '5555', 'histprinc')
+histfail('5555', '3333', '3333')
+realm.run(kadminl, 'cpw', '-pw', '2222', 'histprinc')
+realm.run(kadminl, 'modpol', '-history', '2', 'histpol')
+histfail('2222', '5555', '4444')
+realm.run(kadminl, 'cpw', '-pw', '3333', 'histprinc')
+
 # Test references to nonexistent policies.
 mark('nonexistent policy references')
 realm.run(kadminl, 'addprinc', '-randkey', '-policy', 'newpol', 'newuser')

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/t_proxy.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/t_proxy.py Changed

@@ -10,17 +10,13 @@
 
 # Construct a krb5.conf fragment configuring the client to use a local proxy
 # server.
-proxysubjectpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
-                               'proxy-subject.pem')
-proxysanpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
-                           'proxy-san.pem')
-proxyidealpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
-                             'proxy-ideal.pem')
-proxywrongpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
-                             'proxy-no-match.pem')
-proxybadpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
-                           'proxy-badsig.pem')
-proxyca = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', 'ca.pem')
+proxycerts = os.path.join(srctop, 'tests', 'proxy-certs')
+proxysubjectpem = os.path.join(proxycerts, 'proxy-subject.pem')
+proxysanpem = os.path.join(proxycerts, 'proxy-san.pem')
+proxyidealpem = os.path.join(proxycerts, 'proxy-ideal.pem')
+proxywrongpem = os.path.join(proxycerts, 'proxy-no-match.pem')
+proxybadpem = os.path.join(proxycerts, 'proxy-badsig.pem')
+proxyca = os.path.join(proxycerts, 'ca.pem')
 proxyurl = 'https://localhost:$port5/KdcProxy'
 proxyurlupcase = 'https://LocalHost:$port5/KdcProxy'
 proxyurl4 = 'https://127.0.0.1:$port5/KdcProxy'

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/threads/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/threads/Makefile.in Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/tests/threads/t_rcache.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/tests/threads/t_rcache.c Changed

@@ -31,7 +31,7 @@
 
 krb5_context ctx;
 krb5_rcache rcache;
-krb5_data piece = { .data = "hello", .length = 5 };
+const char *rcname;
 time_t end_time;
 const char *prog;
 
@@ -60,19 +60,45 @@
     } while (now == next);
 }
 
+/* Encrypt data into out (preallocated by the caller) with a random key. */
+static krb5_error_code encrypt_data (krb5_data *data, krb5_enc_data *out)
+{
+    krb5_keyblock kb;
+    krb5_error_code err;
+
+    err = krb5_c_make_random_key(ctx, ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+                                 &kb);
+    if (err)
+        return err;
+    err = krb5_c_encrypt(ctx, &kb, KRB5_KEYUSAGE_TGS_REQ_AUTH, NULL, data,
+                         out);
+    krb5_free_keyblock_contents(ctx, &kb);
+    return err;
+}
+
 static void try_one (struct tinfo *t)
 {
-    krb5_donot_replay r;
     krb5_error_code err;
-    char buf100, buf2100, tag8;
+    char buf256, buf2512;
     krb5_rcache my_rcache;
+    krb5_data d;
+    krb5_enc_data enc;
 
     snprintf(buf, sizeof(buf), "host/all-in-one.mit.edu/%p@ATHENA.MIT.EDU",
              buf);
-    r.server = buf;
-    r.client = (t->my_cusec & 7) + "abcdefgh@ATHENA.MIT.EDU";
-    r.msghash = NULL;
-    r.tag = empty_data();
+
+    /* k5_rc_store() requires a ciphertext.  Create one by encrypting a dummy
+     * value in a random key. */
+    d = string2data(buf);
+    enc.ciphertext = make_data(buf2, sizeof(buf2));
+    err = encrypt_data(&d, &enc);
+    if (err != 0) {
+        const char *msg = krb5_get_error_message(ctx, err);
+        fprintf(stderr, "%s: encrypting authenticator: %s\n", prog, msg);
+        krb5_free_error_message(ctx, msg);
+        exit(1);
+    }
+
     if (t->now != t->my_ctime) {
         if (t->my_ctime != 0) {
             snprintf(buf2, sizeof(buf2), "%3d: %ld %5d\n", t->idx,
@@ -83,13 +109,8 @@
         t->my_cusec = 1;
     } else
         t->my_cusec++;
-    r.ctime = t->my_ctime;
-    r.cusec = t->my_cusec;
-    store_32_be(r.ctime, tag);
-    store_32_be(r.cusec, tag + 4);
-    r.tag = make_data(tag, 8);
     if (!init_once) {
-        err = krb5_get_server_rcache(ctx, &piece, &my_rcache);
+        err = k5_rc_resolve(ctx, rcname, &my_rcache);
         if (err) {
             const char *msg = krb5_get_error_message(ctx, err);
             fprintf(stderr, "%s: %s while initializing replay cache\n", prog, msg);
@@ -98,13 +119,13 @@
         }
     } else
         my_rcache = rcache;
-    err = krb5_rc_store(ctx, my_rcache, &r);
+    err = k5_rc_store(ctx, my_rcache, &enc);
     if (err) {
         com_err(prog, err, "storing in replay cache");
         exit(1);
     }
     if (!init_once)
-        krb5_rc_close(ctx, my_rcache);
+        k5_rc_close(ctx, my_rcache);
 }
 
 static void *run_a_loop (void *x)
@@ -127,7 +148,7 @@
 
 static void usage(void)
 {
-    fprintf (stderr, "usage: %s  options \n", prog);
+    fprintf (stderr, "usage: %s  options  rcname\n", prog);
     fprintf (stderr, "options:\n");
     fprintf (stderr, "\t-1\tcreate one rcache handle for process\n");
     fprintf (stderr, "\t-t N\tnumber of threads to create (default: %d)\n",
@@ -166,6 +187,12 @@
             break;
         }
     }
+
+    argc -= optind;
+    argv += optind;
+    if (argc != 1)
+        usage ();
+    rcname = argv0;
 }
 
 int main (int argc, char *argv)
@@ -181,31 +208,8 @@
         return 1;
     }
 
-    /*
-     * For consistency, run the tests without an existing replay
-     * cache.  Since there isn't a way to ask the library for the
-     * pathname that would be used for the rcache, we create an rcache
-     * object and then destroy it.
-     */
-    err = krb5_get_server_rcache(ctx, &piece, &rcache);
-    if (err) {
-        const char *msg = krb5_get_error_message(ctx, err);
-        fprintf(stderr, "%s: %s while initializing replay cache\n", prog, msg);
-        krb5_free_error_message(ctx, msg);
-        return 1;
-    }
-    err = krb5_rc_destroy(ctx, rcache);
-    if (err) {
-        const char *msg = krb5_get_error_message(ctx, err);
-        fprintf(stderr, "%s: %s while destroying old replay cache\n",
-                prog, msg);
-        krb5_free_error_message(ctx, msg);
-        return 1;
-    }
-    rcache = NULL;
-
     if (init_once) {
-        err = krb5_get_server_rcache(ctx, &piece, &rcache);
+        err = k5_rc_resolve(ctx, rcname, &rcache);
         if (err) {
             const char *msg = krb5_get_error_message(ctx, err);
             fprintf(stderr, "%s: %s while initializing new replay cache\n",
@@ -250,7 +254,7 @@
     free(ip);
 
     if (init_once)
-        krb5_rc_close(ctx, rcache);
+        k5_rc_close(ctx, rcache);
     krb5_free_context(ctx);
     return 0;
 }

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/k5test.py -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/k5test.py Changed

@@ -81,6 +81,7 @@
     - $buildtop: The root of the build directory
     - $srctop:   The root of the source directory
     - $plugins:  The plugin directory in the build tree
+    - $certs:    The PKINIT certificate directory in the source tree
     - $hostname: The FQDN of the host
     - $port0:    The first listener port (portbase)
     - ...
@@ -121,6 +122,8 @@
 * bdb_only=True: Use the DB2 KDB module even if K5TEST_LMDB is set in
   the environment.
 
+* pkinit=True: Configure a PKINIT anchor and KDC certificate.
+
 Scripts may use the following functions and variables:
 
 * fail(message): Display message (plus leading marker and trailing
@@ -155,6 +158,10 @@
 * password(name): Return a weakly random password based on name.  The
   password will be consistent across calls with the same name.
 
+* canonicalize_hostname(name, rdns=True): Return the DNS
+  canonicalization of name, optionally using reverse DNS.  On error,
+  return name converted to lowercase.
+
 * stop_daemon(proc): Stop a daemon process started with
   realm.start_server() or realm.start_in_inetd().  Only necessary if
   the port needs to be reused; daemon processes will be stopped
@@ -193,6 +200,11 @@
 
 * plugins: The plugin directory in the build tree (absolute path).
 
+* pkinit_enabled: True if the PKINIT plugin module is present in the
+  build directory.
+
+* pkinit_certs: The directory containing test PKINIT certificates.
+
 * hostname: The local hostname as it will initially appear in
   krb5_sname_to_principal() results.  (Shortname qualification is
   turned off in the test environment to make this value easy to
@@ -298,6 +310,10 @@
   flags must cause kinit not to need a password (e.g. by specifying a
   keytab).
 
+* realm.pkinit(princ, **keywords): Acquire credentials for princ,
+  supplying a PKINIT identity of the basic user test certificate
+  (matching user@KRBTEST.COM).
+
 * realm.klist(client_princ, service_princ=None, ccache=None): Using
   klist, list the credentials cache ccache (must be a filename;
   self.ccache if not specified) and verify that the output shows
@@ -458,6 +474,24 @@
     return name + str(os.getpid())
 
 
+def canonicalize_hostname(name, rdns=True):
+    """Canonicalize name using DNS, optionally with reverse DNS."""
+    try:
+        ai = socket.getaddrinfo(name, None, 0, 0, 0, socket.AI_CANONNAME)
+    except socket.gaierror as e:
+        return name.lower()
+    (family, socktype, proto, canonname, sockaddr) = ai0
+
+    if not rdns:
+        return canonname.lower()
+
+    try:
+        rname = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD)
+    except socket.gaierror:
+        return canonname.lower()
+    return rname0.lower()
+
+
 # Exit handler which ensures processes are cleaned up and, on failure,
 # prints messages to help developers debug the problem.
 def _onexit():
@@ -541,8 +575,7 @@
     parser.add_option('--debug', dest='debug', metavar='NUM',
                       help='Debug numbered command (or "all")')
     parser.add_option('--debugger', dest='debugger', metavar='COMMAND',
-                      help='Debugger command (default is gdb --args)',
-                      default='gdb --args')
+                      help='Debugger command (default is gdb --args)')
     parser.add_option('--stop-before', dest='stopb', metavar='NUM',
                       help='Stop before numbered command (or "all")')
     parser.add_option('--stop-after', dest='stopa', metavar='NUM',
@@ -555,12 +588,21 @@
     verbose = options.verbose
     testpass = options.testpass
     _debug = _parse_cmdnum('--debug', options.debug)
-    _debugger_command = shlex.split(options.debugger)
     _stop_before = _parse_cmdnum('--stop-before', options.stopb)
     _stop_after = _parse_cmdnum('--stop-after', options.stopa)
     _shell_before = _parse_cmdnum('--shell-before', options.shellb)
     _shell_after = _parse_cmdnum('--shell-after', options.shella)
 
+    if options.debugger is not None:
+        _debugger_command = shlex.split(options.debugger)
+    elif which('gdb') is not None:
+        _debugger_command = 'gdb', '--args'
+    elif which('lldb') is not None:
+        _debugger_command = 'lldb', '--'
+    elif options.debug is not None:
+        print('Cannot find a debugger; use --debugger=COMMAND')
+        sys.exit(1)
+
 
 # Translate a command number spec.  -1 means all, None means none.
 def _parse_cmdnum(optname, str):
@@ -845,6 +887,13 @@
         _daemons.remove(proc)
 
 
+def await_daemon_exit(proc):
+    code = proc.wait()
+    _daemons.remove(proc)
+    if code != 0:
+        fail('Daemon process %d exited with status %d' % (proc.pid, code))
+
+
 class K5Realm(object):
     """An object representing a functional krb5 test realm."""
 
@@ -852,7 +901,7 @@
                  krb5_conf=None, kdc_conf=None, create_kdb=True,
                  krbtgt_keysalt=None, create_user=True, get_creds=True,
                  create_host=True, start_kdc=True, start_kadmind=False,
-                 start_kpropd=False, bdb_only=False):
+                 start_kpropd=False, bdb_only=False, pkinit=False):
         global hostname, _default_krb5_conf, _default_kdc_conf
         global _lmdb_kdc_conf, _current_db
 
@@ -869,11 +918,15 @@
         self.ccache = os.path.join(self.testdir, 'ccache')
         self.gss_mech_config = os.path.join(self.testdir, 'mech.conf')
         self.kadmin_ccache = os.path.join(self.testdir, 'kadmin_ccache')
-        self._krb5_conf = _cfg_merge(_default_krb5_conf, krb5_conf)
+        base_krb5_conf = _default_krb5_conf
         base_kdc_conf = _default_kdc_conf
         if (os.getenv('K5TEST_LMDB') is not None and
             not bdb_only and not _current_db):
             base_kdc_conf = _cfg_merge(base_kdc_conf, _lmdb_kdc_conf)
+        if pkinit:
+            base_krb5_conf = _cfg_merge(base_krb5_conf, _pkinit_krb5_conf)
+            base_kdc_conf = _cfg_merge(base_kdc_conf, _pkinit_kdc_conf)
+        self._krb5_conf = _cfg_merge(base_krb5_conf, krb5_conf)
         self._kdc_conf = _cfg_merge(base_kdc_conf, kdc_conf)
         self._kdc_proc = None
         self._kadmind_proc = None
@@ -950,6 +1003,7 @@
                                     buildtop=buildtop,
                                     srctop=srctop,
                                     plugins=plugins,
+                                    certs=pkinit_certs,
                                     hostname=hostname,
                                     port0=self.portbase,
                                     port1=self.portbase + 1,
@@ -1012,12 +1066,12 @@
             port = self.server_port()
         if env is None:
             env = self.env
-        inetd_args = t_inetd, str(port) + args
+        inetd_args = t_inetd, str(port), args0 + args
         return _start_daemon(inetd_args, env, 'Ready!')
 
     def create_kdb(self):
         global kdb5_util
-        self.run(kdb5_util, 'create', '-W', '-s', '-P', 'master')
+        self.run(kdb5_util, 'create', '-s', '-P', 'master')
 
     def start_kdc(self, args=, env=None):
         global krb5kdc
@@ -1038,7 +1092,7 @@
             env = self.env
         assert(self._kadmind_proc is None)
         dump_path = os.path.join(self.testdir, 'dump')
-        self._kadmind_proc = _start_daemon(kadmind, '-nofork', '-W',
+        self._kadmind_proc = _start_daemon(kadmind, '-nofork',
                                             '-p', kdb5_util, '-K', kprop,
                                             '-F', dump_path, env,
                                            'starting...')
@@ -1091,6 +1145,12 @@
             input = None
         return self.run(kinit + flags + princname, input=input, **keywords)
 
+    def pkinit(self, princ, flags=, **kw):
+        id = 'FILE:%s,%s' % (os.path.join(pkinit_certs, 'user.pem'),
+                             os.path.join(pkinit_certs, 'privkey.pem'))
+        flags = flags + '-X', 'X509_user_identity=%s' % id
+        self.kinit(princ, flags=flags, **kw)
+
     def klist(self, client_princ, service_princ=None, ccache=None, **keywords):
         if service_princ is None:
             service_princ = self.krbtgt_princ
@@ -1255,7 +1315,7 @@
             'iprop_port': '$port4',
             'key_stash_file': '$testdir/stash',
             'acl_file': '$testdir/acl',
-            'dictfile': '$testdir/dictfile',
+            'dict_file': '$testdir/dictfile',
             'kadmind_port': '$port1',
             'kpasswd_port': '$port2',
             'kdc_listen': '$port0',
@@ -1273,6 +1333,12 @@
                                        'nosync': 'true'}}}
 
 
+_pkinit_krb5_conf = {'realms': {'$realm': {
+    'pkinit_anchors': 'FILE:$certs/ca.pem'}}}
+_pkinit_kdc_conf = {'realms': {'$realm': {
+    'pkinit_identity': 'FILE:$certs/kdc.pem,$certs/privkey.pem'}}}
+
+
 # A pass is a tuple of: name, krbtgt_keysalt, krb5_conf, kdc_conf.
 _passes = 
     # No special settings; exercises AES256.
@@ -1341,6 +1407,8 @@
 buildtop = _find_buildtop()
 srctop = _find_srctop()
 plugins = os.path.join(buildtop, 'plugins')
+pkinit_enabled = os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so'))
+pkinit_certs = os.path.join(srctop, 'tests', 'pkinit-certs')
 hostname = socket.gethostname().lower()
 null_input = open(os.devnull, 'r')
 
@@ -1368,7 +1436,7 @@
 kvno = os.path.join(buildtop, 'clients', 'kvno', 'kvno')
 kdestroy = os.path.join(buildtop, 'clients', 'kdestroy', 'kdestroy')
 kpasswd = os.path.join(buildtop, 'clients', 'kpasswd', 'kpasswd')
-t_inetd = os.path.join(buildtop, 'tests', 'dejagnu', 't_inetd')
+t_inetd = os.path.join(buildtop, 'tests', 't_inetd')
 kproplog = os.path.join(buildtop, 'kprop', 'kproplog')
 kpropd = os.path.join(buildtop, 'kprop', 'kpropd')
 kprop = os.path.join(buildtop, 'kprop', 'kprop')

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/profile/Makefile.in -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/profile/Makefile.in Changed

@@ -1,14 +1,12 @@
 mydir=util$(S)profile
 BUILDTOP=$(REL)..$(S)..
 SUBDIRS=testmod
-PROG_LIBPATH=-L$(TOPLIBD) $(TCL_LIBPATH) -L.
-PROG_RPATH=$(KRB5_LIBDIR)$(TCL_RPATH)
+PROG_LIBPATH=-L$(TOPLIBD) -L.
 ##DOS##BUILDTOP = ..\..
 ##DOS##OBJFILE=$(OUTPRE)profile.lst
 ##DOS##LIBNAME=$(OUTPRE)profile.lib
 
-LOCALINCLUDES=-I. $(TCL_INCLUDES)
-# for tcl.h
+LOCALINCLUDES=-I.
 DEFINES=-DHAS_STDARG -DLIBDIR=\"$(KRB5_LIBDIR)\"
 
 STLIBOBJS = \
@@ -37,8 +35,7 @@
 	$(srcdir)/prof_init.c
 
 EXTRADEPSRCS=$(srcdir)/test_load.c $(srcdir)/test_parse.c \
-	$(srcdir)/test_profile.c $(srcdir)/test_vtable.c \
-	$(srcdir)/profile_tcl.c
+	$(srcdir)/test_profile.c $(srcdir)/test_vtable.c $(srcdir)/t_profile.c
 
 DEPLIBS = $(COM_ERR_DEPLIB) $(SUPPORT_DEPLIB)
 MLIBS = $(COM_ERR_LIB) $(SUPPORT_LIB) $(LIBS)
@@ -65,7 +62,7 @@
 includes: $(PROFILE_HDR)
 
 clean-unix::
-	$(RM) $(BUILDTOP)/include/profile.h test2.ini test3.ini test2.ini.bak
+	$(RM) $(BUILDTOP)/include/profile.h
 
 ##DOS##LIBOBJS = $(OBJS)
 
@@ -89,6 +86,9 @@
 test_load: test_load.$(OBJEXT) $(OBJS) $(DEPLIBS)
 	$(CC_LINK) -o test_load test_load.$(OBJEXT) $(OBJS) $(MLIBS)
 
+t_profile: t_profile.$(OBJEXT) $(OBJS) $(DEPLIBS)
+	$(CC_LINK) -o $@ t_profile.$(OBJEXT) $(OBJS) $(MLIBS)
+
 modtest.conf:
 	echo "module `pwd`/testmod/proftest$(DYNOBJEXT):teststring" > $@
 
@@ -117,30 +117,23 @@
 
 prof_err.o: prof_err.c
 
-# not built by default, but may be useful for testing
-$(srcdir)/profile_tcl.c: profile.swg
-#	(cd $(srcdir) && swig -tcl8 -nosafe -o profile_tcl.c profile.swg)
-profile_tcl.o: $(srcdir)/profile_tcl.c profile.h
-profile_tcl: profile_tcl.o $(PROF_DEPLIB) $(COM_ERR_DEPLIB) $(SUPPORT_DEPLIB)
-	$(CC_LINK) -o profile_tcl profile_tcl.o \
-		$(TCL_MAYBE_RPATH) \
-		-L../et -L../.. -lprofile $(TCL_LIBS) $(MLIBS)
-
 clean-unix:: clean-libs clean-libobjs
 	$(RM) $(PROGS) *.o *~ core prof_err.h profile.h prof_err.c
-	$(RM) test_load test_parse test_profile test_vtable profile_tcl
-	$(RM) modtest.conf testinc.ini testinc2.ini final.out
+	$(RM) test_load test_parse test_profile test_vtable t_profile
+	$(RM) modtest.conf testinc.ini testinc2.ini final.out test2* test3*
 	$(RM) -r test_include_dir
 
 clean-windows::
 	$(RM) $(PROFILE_HDR)
 
-check-unix: test_parse test_profile test_vtable test_load modtest.conf
+check-unix: test_parse test_profile modtest.conf
+check-unix: test_vtable test_load t_profile
 	$(RUN_TEST) ./test_vtable
 	$(RUN_TEST) ./test_load
+	cp $(srcdir)/test.ini test2.ini
+	$(RUN_TEST) ./t_profile
 
-DO_TCL=@DO_TCL@
-check-unix: check-unix-final check-unix-tcl-$(DO_TCL)
+check-unix: check-unix-final
 
 F1=$(srcdir)/final1.ini
 F2=$(srcdir)/final2.ini
@@ -158,15 +151,6 @@
 	cmp final.out $(srcdir)/final.expected
 	$(RM) final.out
 
-check-unix-tcl-:
-	@echo "+++"
-	@echo "+++ Tcl not available, some profile tests not run."
-	@echo "+++"
-
-check-unix-tcl-ok: profile_tcl
-	cp $(srcdir)/test.ini test2.ini
-	$(RUN_TEST) ./profile_tcl $(srcdir)/prof_test1
-
 check-windows: $(OUTPRE)test_profile.exe $(OUTPRE)test_parse.exe
 	$(RM) $(OUTPRE)*.obj
 	$(OUTPRE)test_parse test.ini

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/profile/deps -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/profile/deps Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/profile/prof_get.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/profile/prof_get.c Changed

_service:tar_scm:krb5-1.20.1.tar.gz/src/util/profile/t_profile.c Added

@@ -0,0 +1,389 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/* util/profile/t_profile.c - profile library regression tests */
+/*
+ * Copyright (C) 2021 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#include <utime.h>
+#include "profile.h"
+
+static void
+check(long code)
+{
+    assert(code == 0);
+}
+
+static void
+check_fail(long code, long expected)
+{
+    assert(code == expected);
+}
+
+static void
+write_file(const char *name, int nlines, ...)
+{
+    FILE *f;
+    va_list ap;
+    int i;
+
+    (void)unlink(name);
+    f = fopen(name, "w");
+    assert(f != NULL);
+    va_start(ap, nlines);
+    for (i = 0; i < nlines; i++)
+        fprintf(f, "%s\n", va_arg(ap, char *));
+    va_end(ap);
+    fclose(f);
+}
+
+/* Regression test for #2685 (profile iterator breaks when modifications
+ * made) */
+static void
+test_iterate()
+{
+    profile_t p;
+    void *iter;
+    const char *names = { "test section 1", "child_section", "child", NULL };
+    const char *values = { "slick", "harry", "john", NULL };
+    char *name, *value;
+    int i;
+
+    check(profile_init_path("test2.ini", &p));
+
+    /* Iterate and check for the expected values. */
+    check(profile_iterator_create(p, names, 0, &iter));
+    for (i = 0;; i++) {
+        check(profile_iterator(&iter, &name, &value));
+        if (name == NULL && value == NULL)
+            break;
+        assert(strcmp(name, names2) == 0);
+        assert(valuesi != NULL);
+        assert(strcmp(value, valuesi) == 0);
+        profile_release_string(name);
+        profile_release_string(value);
+    }
+    assert(valuesi == NULL);
+    profile_iterator_free(&iter);
+
+    /* Iterate again, deleting each value as we go.  Flush the result to a
+     * separate file. */
+    check(profile_iterator_create(p, names, 0, &iter));
+    for (;;) {
+        check(profile_iterator(&iter, NULL, &value));
+        if (value == NULL)
+            break;
+        check(profile_update_relation(p, names, value, NULL));
+        profile_release_string(value);
+    }
+    profile_iterator_free(&iter);
+    (void)unlink("test3.ini");
+    profile_flush_to_file(p, "test3.ini");
+
+    profile_abandon(p);
+
+    /* Check that no values for the section are found in the resulting file. */
+    check(profile_init_path("test3.ini", &p));
+    check(profile_iterator_create(p, names, 0, &iter));
+    check(profile_iterator(&iter, &name, &value));
+    assert(name == NULL && value == NULL);
+    profile_iterator_free(&iter);
+    profile_abandon(p);
+}
+
+/*
+ * Regression test for a 1.4-era bug where updating the underlying file data of
+ * a profile object lost track of the flag indicating that it was part of the
+ * global shared profiles list.
+ */
+static void
+test_shared()
+{
+    profile_t a, b;
+    struct utimbuf times;
+
+    system("cp test2.ini test3.ini");
+
+    /* Create an entry in the shared table. */
+    check(profile_init_path("test3.ini", &a));
+
+    /*
+     * Force an update of the underlying data.  With the bug present, the
+     * shared flag is erroneously cleared.  The easiest way to force an update
+     * is to reopen the file (since we don't enforce the one-stat-per-second
+     * limit during open) after changing the timestamp.
+     */
+    times.actime = time(NULL) + 2;
+    times.modtime = times.actime;
+    utime("test3.ini", &times);
+    check(profile_init_path("test3.ini", &b));
+    profile_release(b);
+
+    /* Release the profile.  With the bug present, a dangling reference is left
+     * behind in the shared table. */
+    profile_release(a);
+
+    /* Open the profile again to dereference the dangling pointer if one was
+     * created. */
+    check(profile_init_path("test3.ini", &a));
+    profile_release(a);
+}
+
+/* Regression test for #2950 (profile_clear_relation not reflected within
+ * handle where deletion is performed) */
+static void
+test_clear()
+{
+    profile_t p;
+    const char *names = { "test section 1", "quux", NULL };
+    char **values, **dummy;
+
+    check(profile_init_path("test2.ini", &p));
+    check(profile_get_values(p, names, &values));
+    check(profile_clear_relation(p, names));
+    check_fail(profile_get_values(p, names, &dummy), PROF_NO_RELATION);
+    check(profile_add_relation(p, names, values0));
+    profile_free_list(values);
+    check(profile_get_values(p, names, &values));
+    assert(values0 != NULL && values1 == NULL);
+    profile_free_list(values);
+    profile_abandon(p);
+}
+
+static void
+test_include()
+{
+    profile_t p;
+    const char *names = { "test section 1", "bar", NULL };
+    char **values;
+
+    /* Test expected error code when including nonexistent file. */
+    write_file("testinc.ini", 1, "include does-not-exist");
+    check_fail(profile_init_path("testinc.ini", &p), PROF_FAIL_INCLUDE_FILE);
+
+    /* Test expected error code when including nonexistent directory. */
+    write_file("testinc.ini", 1, "includedir does-not-exist");
+    check_fail(profile_init_path("testinc.ini", &p), PROF_FAIL_INCLUDE_DIR);
+
+    /* Test including a file. */
+    write_file("testinc.ini", 1, "include test2.ini");
+    check(profile_init_path("testinc.ini", &p));
+    check(profile_get_values(p, names, &values));
+    assert(strcmp(values0, "foo") == 0 && values1 == NULL);
+    profile_free_list(values);
+    profile_release(p);
+
+    /*
+     * Test including a directory.  Put four copies of test2.ini inside the
+     * directory, two with invalid names.  Check that we get two values for one
+     * of the variables.
+     */
+    system("rm -rf test_include_dir");
+    system("mkdir test_include_dir");
+    system("cp test2.ini test_include_dir/a");
+    system("cp test2.ini test_include_dir/a~");
+    system("cp test2.ini test_include_dir/b.conf");
+    system("cp test2.ini test_include_dir/b.conf.rpmsave");
+    write_file("testinc.ini", 1, "includedir test_include_dir");
+    check(profile_init_path("testinc.ini", &p));
+    check(profile_get_values(p, names, &values));
+    assert(strcmp(values0, "foo") == 0);
+    assert(strcmp(values1, "foo") == 0);
+    assert(values2 == NULL);
+    profile_free_list(values);
+    profile_release(p);
+
+    /* Directly list the directory in the profile path and try again. */
+    check(profile_init_path("test_include_dir", &p));
+    check(profile_get_values(p, names, &values));
+    assert(strcmp(values0, "foo") == 0);
+    assert(strcmp(values1, "foo") == 0);
+    assert(values2 == NULL);
+    profile_free_list(values);
+    profile_release(p);
+}
+
+/* Test syntactic independence of included profile files. */
+static void
+test_independence()
+{
+    profile_t p;
+    const char *names1 = { "sec1", "var", "a", NULL };
+    const char *names2 = { "sec2", "b", NULL };
+    const char *names3 = { "sec1", "var", "c", NULL };
+    char **values;
+
+    write_file("testinc.ini", 6, "sec1", "var = {", "a = 1",
+               "include testinc2.ini", "c = 3", "}");
+    write_file("testinc2.ini", 2, "sec2", "b = 2");
+
+    check(profile_init_path("testinc.ini", &p));
+    check(profile_get_values(p, names1, &values));
+    assert(strcmp(values0, "1") == 0 && values1 == NULL);
+    profile_free_list(values);
+    check(profile_get_values(p, names2, &values));
+    assert(strcmp(values0, "2") == 0 && values1 == NULL);
+    profile_free_list(values);
+    check(profile_get_values(p, names3, &values));
+    assert(strcmp(values0, "3") == 0 && values1 == NULL);
+    profile_free_list(values);
+    profile_release(p);
+}
+
+/* Regression test for #7971 (deleted sections should not be iterable) */
+static void
+test_delete_section()
+{
+    profile_t p;
+    const char *sect = { "test section 1", NULL };
+    const char *newrel = { "test section 1", "testkey", NULL };
+    const char *oldrel = { "test section 1", "child", NULL };
+    char **values;
+
+    check(profile_init_path("test2.ini", &p));
+
+    /* Remove and replace a section. */
+    check(profile_rename_section(p, sect, NULL));
+    check(profile_add_relation(p, sect, NULL));
+    check(profile_add_relation(p, newrel, "6"));
+
+    /* Check that we can read the new relation but not the old one. */
+    check(profile_get_values(p, newrel, &values));
+    assert(strcmp(values0, "6") == 0 && values1 == NULL);
+    profile_free_list(values);
+    check_fail(profile_get_values(p, oldrel, &values), PROF_NO_RELATION);
+    profile_abandon(p);
+}
+
+/* Regression test for #7971 (profile_clear_relation() error with deleted node
+ * at end of value set) */
+static void
+test_delete_clear_relation()
+{
+    profile_t p;
+    const char *names = { "test section 1", "testkey", NULL };
+
+    check(profile_init_path("test2.ini", &p));
+    check(profile_add_relation(p, names, "1"));
+    check(profile_add_relation(p, names, "2"));
+    check(profile_update_relation(p, names, "2", NULL));
+    check(profile_clear_relation(p, names));
+    profile_abandon(p);
+}
+
+/* Test that order of relations is preserved if some relations are deleted. */
+static void
+test_delete_ordering()
+{
+    profile_t p;
+    const char *names = { "test section 1", "testkey", NULL };
+    char **values;
+
+    check(profile_init_path("test2.ini", &p));
+    check(profile_add_relation(p, names, "1"));
+    check(profile_add_relation(p, names, "2"));
+    check(profile_add_relation(p, names, "3"));
+    check(profile_update_relation(p, names, "2", NULL));
+    check(profile_add_relation(p, names, "4"));
+    check(profile_get_values(p, names, &values));
+    assert(strcmp(values0, "1") == 0);
+    assert(strcmp(values1, "3") == 0);
+    assert(strcmp(values2, "4") == 0);
+    assert(values3 == NULL);
+    profile_free_list(values);
+    profile_abandon(p);
+}
+
+/* Regression test for #8431 (profile_flush_to_file erroneously changes flag
+ * state on source object) */
+static void
+test_flush_to_file()
+{
+    profile_t p;
+
+    /* Flush a profile object to a file without making any changes, so that the
+     * source object is still within g_shared_trees. */
+    check(profile_init_path("test2.ini", &p));
+    unlink("test3.ini");
+    check(profile_flush_to_file(p, "test3.ini"));
+    profile_release(p);
+
+    /* Check for a dangling reference in g_shared_trees by creating another
+     * profile object. */
+    profile_init_path("test2.ini", &p);
+    profile_release(p);
+}
+
+/* Regression test for #7863 (multiply-specified subsections should
+ * be merged) */
+static void
+test_merge_subsections()
+{
+    profile_t p;
+    const char *n1 = { "test section 2", "child_section2", "child", NULL };
+    const char *n2 = { "test section 2", "child_section2", "chores", NULL };
+    char **values;
+
+    check(profile_init_path("test2.ini", &p));
+
+    check(profile_get_values(p, n1, &values));
+    assert(strcmp(values0, "slick") == 0);
+    assert(strcmp(values1, "harry") == 0);
+    assert(strcmp(values2, "john\tb ") == 0);
+    assert(strcmp(values3, "ron") == 0);
+    assert(values4 == NULL);
+    profile_free_list(values);
+
+    check(profile_get_values(p, n2, &values));
+    assert(strcmp(values0, "cleaning") == 0 && values1 == NULL);
+    profile_free_list(values);
+
+    profile_release(p);
+}
+
+int
+main()
+{
+    test_iterate();
+    test_shared();
+    test_clear();
+    test_include();
+    test_independence();
+    test_delete_section();
+    test_delete_clear_relation();
+    test_delete_ordering();
+    test_flush_to_file();
+    test_merge_subsections();
+}

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/ss/list_rqs.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/ss/list_rqs.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/ss/listen.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/ss/listen.c Changed

@@ -54,7 +54,7 @@
 }
 #endif
 
-static RETSIGTYPE listen_int_handler(signo)
+static void listen_int_handler(signo)
     int signo;
 {
     putc('\n', stdout);
@@ -74,8 +74,8 @@
     struct sigaction isig, csig, nsig, osig;
     sigset_t nmask, omask;
 #else
-    RETSIGTYPE (*sig_cont)();
-    RETSIGTYPE (*sig_int)(), (*old_sig_cont)();
+    void (*sig_cont)();
+    void (*sig_int)(), (*old_sig_cont)();
     int mask;
 #endif
 
@@ -83,12 +83,12 @@
     info->abort = 0;
 
 #ifdef POSIX_SIGNALS
-    csig.sa_handler = (RETSIGTYPE (*)())0;
+    csig.sa_handler = (void (*)())0;
     sigemptyset(&nmask);
     sigaddset(&nmask, SIGINT);
     sigprocmask(SIG_BLOCK, &nmask, &omask);
 #else
-    sig_cont = (RETSIGTYPE (*)())0;
+    sig_cont = (void (*)())0;
     mask = sigblock(sigmask(SIGINT));
 #endif
 
@@ -115,7 +115,7 @@
         nsig.sa_handler = listen_int_handler;   /* fgets is not signal-safe */
         osig = csig;
         sigaction(SIGCONT, &nsig, &csig);
-        if ((RETSIGTYPE (*)())csig.sa_handler==(RETSIGTYPE (*)())listen_int_handler)
+        if ((void (*)())csig.sa_handler==(void (*)())listen_int_handler)
             csig = osig;
 #else
         old_sig_cont = sig_cont;

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/support/gmt_mktime.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/support/gmt_mktime.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/util/support/plugins.c -> _service:tar_scm:krb5-1.20.1.tar.gz/src/util/support/plugins.c Changed

_service:tar_scm:krb5-1.19.2.tar.gz/src/windows/leash/KrbListTickets.cpp -> _service:tar_scm:krb5-1.20.1.tar.gz/src/windows/leash/KrbListTickets.cpp Changed

@@ -73,19 +73,15 @@
 }
 
 
-static char *
-etype_string(krb5_enctype enctype)
+static void
+etype_string(krb5_enctype enctype, char *buf, size_t buflen)
 {
-    static char buf100;
-
     krb5_error_code retval;
 
-    if ((retval = pkrb5_enctype_to_name(enctype, FALSE, buf, sizeof(buf)))) {
+    if ((retval = pkrb5_enctype_to_name(enctype, FALSE, buf, buflen))) {
         /* XXX if there's an error != EINVAL, I should probably report it */
-        sprintf_s(buf, "etype %d", enctype);
+        sprintf_s(buf, buflen, "etype %d", enctype);
     }
-
-    return buf;
 }
 
 
@@ -110,7 +106,7 @@
     krb5_error_code code = 0;
     krb5_ticket *tkt=NULL;
     char *sServerName = NULL;
-    char Buffer256;
+    char Buffer256, sestype100, tkttype100;
     char *functionName = NULL;
     TicketList *list = NULL;
 
@@ -144,15 +140,14 @@
     else
         list->renew_until = 0;
 
+    etype_string(KRBv5Credentials.keyblock.enctype, sestype, sizeof(sestype));
     if (!pkrb5_decode_ticket(&KRBv5Credentials.ticket, &tkt)) {
-        wsprintf(Buffer, "Session Key: %s  Ticket: %s",
-            etype_string(KRBv5Credentials.keyblock.enctype),
-            etype_string(tkt->enc_part.enctype));
+        etype_string(tkt->enc_part.enctype, tkttype, sizeof(tkttype));
+        wsprintf(Buffer, "Session Key: %s  Ticket: %s", sestype, tkttype);
         pkrb5_free_ticket(ctx, tkt);
         tkt = NULL;
     } else {
-        wsprintf(Buffer, "Session Key: %s",
-            etype_string(KRBv5Credentials.keyblock.enctype));
+        wsprintf(Buffer, "Session Key: %s", sestype);
     }
 
     list->encTypes = (char *)calloc(1, strlen(Buffer)+1);

_service:tar_scm:krb5-1.19.2.tar.gz/src/windows/version.rc -> _service:tar_scm:krb5-1.20.1.tar.gz/src/windows/version.rc Changed

Changes of Revision 3