Vendor import of Heimdal 0.2o

23 files changed, 588 insertions, 71 deletions

diff --git a/crypto/heimdal/lib/gssapi/ChangeLog b/crypto/heimdal/lib/gssapi/ChangeLog
index d8f80f4..ba765ba 100644
--- a/crypto/heimdal/lib/gssapi/ChangeLog
+++ b/crypto/heimdal/lib/gssapi/ChangeLog
@@ -1,3 +1,27 @@
+2000-02-13  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.am: set version to 1:0:1
+
+2000-02-12  Assar Westerlund  <assar@sics.se>
+
+	* gssapi_locl.h: add flags for import/export
+	* import_sec_context.c (import_sec_context: add flags for what
+	fields are included.  do not include the authenticator for now.
+	* export_sec_context.c (export_sec_context: add flags for what
+	fields are included.  do not include the authenticator for now.
+	* accept_sec_context.c (gss_accept_sec_context): set target in
+	context_handle
+
+2000-02-11  Assar Westerlund  <assar@sics.se>
+
+	* delete_sec_context.c (gss_delete_sec_context): set context to
+	GSS_C_NO_CONTEXT
+
+	* Makefile.am: add {export,import}_sec_context.c
+	* export_sec_context.c: new file
+	* import_sec_context.c: new file
+	* accept_sec_context.c (gss_accept_sec_context): set trans flag
+
 2000-02-07  Assar Westerlund  <assar@sics.se>
 
 	* Makefile.am: set version to 0:5:0
diff --git a/crypto/heimdal/lib/gssapi/Makefile.am b/crypto/heimdal/lib/gssapi/Makefile.am
index 72bdf45..07d4e65 100644
--- a/crypto/heimdal/lib/gssapi/Makefile.am
+++ b/crypto/heimdal/lib/gssapi/Makefile.am
@@ -1,11 +1,11 @@
-# $Id: Makefile.am,v 1.19 2000/02/07 04:00:51 assar Exp $
+# $Id: Makefile.am,v 1.21 2000/02/13 20:34:49 assar Exp $
 
 include $(top_srcdir)/Makefile.am.common
 
 INCLUDES += -I$(srcdir)/../krb5
 
 lib_LTLIBRARIES = libgssapi.la
-libgssapi_la_LDFLAGS = -version-info 0:5:0
+libgssapi_la_LDFLAGS = -version-info 1:0:1
 
 include_HEADERS = gssapi.h
 
@@ -24,12 +24,14 @@ libgssapi_la_SOURCES =		\
 	display_status.c	\
 	duplicate_name.c	\
 	encapsulate.c		\
+	export_sec_context.c	\
 	export_name.c		\
 	external.c		\
 	get_mic.c		\
 	gssapi.h		\
 	gssapi_locl.h		\
 	import_name.c		\
+	import_sec_context.c	\
 	indicate_mechs.c	\
 	init.c			\
 	init_sec_context.c	\
diff --git a/crypto/heimdal/lib/gssapi/Makefile.in b/crypto/heimdal/lib/gssapi/Makefile.in
index 2ecd970..31ea813 100644
--- a/crypto/heimdal/lib/gssapi/Makefile.in
+++ b/crypto/heimdal/lib/gssapi/Makefile.in
@@ -10,7 +10,7 @@
 # even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 # PARTICULAR PURPOSE.
 
-# $Id: Makefile.am,v 1.19 2000/02/07 04:00:51 assar Exp $
+# $Id: Makefile.am,v 1.21 2000/02/13 20:34:49 assar Exp $
 
 
 # $Id: Makefile.am.common,v 1.3 1999/04/01 14:58:43 joda Exp $
@@ -174,11 +174,11 @@ NROFF_MAN = groff -mandoc -Tascii
 CHECK_LOCAL = $(PROGRAMS)
 
 lib_LTLIBRARIES = libgssapi.la
-libgssapi_la_LDFLAGS = -version-info 0:5:0
+libgssapi_la_LDFLAGS = -version-info 1:0:1
 
 include_HEADERS = gssapi.h
 
-libgssapi_la_SOURCES =  	8003.c				accept_sec_context.c		acquire_cred.c			add_oid_set_member.c		canonicalize_name.c		compare_name.c			context_time.c			create_emtpy_oid_set.c		decapsulate.c			delete_sec_context.c		display_name.c			display_status.c		duplicate_name.c		encapsulate.c			export_name.c			external.c			get_mic.c			gssapi.h			gssapi_locl.h			import_name.c			indicate_mechs.c		init.c				init_sec_context.c		inquire_context.c		inquire_cred.c			release_buffer.c		release_cred.c			release_name.c			release_oid_set.c		test_oid_set_member.c		unwrap.c			v1.c				verify_mic.c			wrap.c
+libgssapi_la_SOURCES =  	8003.c				accept_sec_context.c		acquire_cred.c			add_oid_set_member.c		canonicalize_name.c		compare_name.c			context_time.c			create_emtpy_oid_set.c		decapsulate.c			delete_sec_context.c		display_name.c			display_status.c		duplicate_name.c		encapsulate.c			export_sec_context.c		export_name.c			external.c			get_mic.c			gssapi.h			gssapi_locl.h			import_name.c			import_sec_context.c		indicate_mechs.c		init.c				init_sec_context.c		inquire_context.c		inquire_cred.c			release_buffer.c		release_cred.c			release_name.c			release_oid_set.c		test_oid_set_member.c		unwrap.c			v1.c				verify_mic.c			wrap.c
 
 mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
 CONFIG_HEADER = ../../include/config.h
@@ -199,11 +199,12 @@ libgssapi_la_OBJECTS =  8003.lo accept_sec_context.lo acquire_cred.lo \
 add_oid_set_member.lo canonicalize_name.lo compare_name.lo \
 context_time.lo create_emtpy_oid_set.lo decapsulate.lo \
 delete_sec_context.lo display_name.lo display_status.lo \
-duplicate_name.lo encapsulate.lo export_name.lo external.lo get_mic.lo \
-import_name.lo indicate_mechs.lo init.lo init_sec_context.lo \
-inquire_context.lo inquire_cred.lo release_buffer.lo release_cred.lo \
-release_name.lo release_oid_set.lo test_oid_set_member.lo unwrap.lo \
-v1.lo verify_mic.lo wrap.lo
+duplicate_name.lo encapsulate.lo export_sec_context.lo export_name.lo \
+external.lo get_mic.lo import_name.lo import_sec_context.lo \
+indicate_mechs.lo init.lo init_sec_context.lo inquire_context.lo \
+inquire_cred.lo release_buffer.lo release_cred.lo release_name.lo \
+release_oid_set.lo test_oid_set_member.lo unwrap.lo v1.lo verify_mic.lo \
+wrap.lo
 CFLAGS = @CFLAGS@
 COMPILE = $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 LTCOMPILE = $(LIBTOOL) --mode=compile $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
diff --git a/crypto/heimdal/lib/gssapi/accept_sec_context.c b/crypto/heimdal/lib/gssapi/accept_sec_context.c
index 4d9a2b0..3f61ae1 100644
--- a/crypto/heimdal/lib/gssapi/accept_sec_context.c
+++ b/crypto/heimdal/lib/gssapi/accept_sec_context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "gssapi_locl.h"
 
-RCSID("$Id: accept_sec_context.c,v 1.15 1999/12/26 18:32:08 assar Exp $");
+RCSID("$Id: accept_sec_context.c,v 1.17 2000/02/12 21:24:08 assar Exp $");
 
 static krb5_keytab gss_keytab;
 
@@ -53,7 +53,8 @@ gsskrb5_register_acceptor_identity (char *identity)
     return GSS_S_COMPLETE;
 }
 
-OM_uint32 gss_accept_sec_context
+OM_uint32
+gss_accept_sec_context
            (OM_uint32 * minor_status,
             gss_ctx_id_t * context_handle,
             const gss_cred_id_t acceptor_cred_handle,
@@ -151,6 +152,14 @@ OM_uint32 gss_accept_sec_context
     goto failure;
   }
 
+  kret = krb5_copy_principal (gssapi_krb5_context,
+			      ticket->server,
+			      &(*context_handle)->target);
+  if (kret) {
+    ret = GSS_S_FAILURE;
+    goto failure;
+  }
+
   if (src_name) {
     kret = krb5_copy_principal (gssapi_krb5_context,
 				ticket->client,
@@ -182,6 +191,8 @@ OM_uint32 gss_accept_sec_context
       }
   }
 
+  flags |= GSS_C_TRANS_FLAG;
+
   if (ret_flags)
     *ret_flags = flags;
   (*context_handle)->flags = flags;
diff --git a/crypto/heimdal/lib/gssapi/delete_sec_context.c b/crypto/heimdal/lib/gssapi/delete_sec_context.c
index faa77e4..15e3cfa 100644
--- a/crypto/heimdal/lib/gssapi/delete_sec_context.c
+++ b/crypto/heimdal/lib/gssapi/delete_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "gssapi_locl.h"
 
-RCSID("$Id: delete_sec_context.c,v 1.6 2000/01/26 00:45:46 assar Exp $");
+RCSID("$Id: delete_sec_context.c,v 1.7 2000/02/11 23:00:48 assar Exp $");
 
 OM_uint32 gss_delete_sec_context
            (OM_uint32 * minor_status,
@@ -60,5 +60,6 @@ OM_uint32 gss_delete_sec_context
     krb5_free_ticket (gssapi_krb5_context,
 		      (*context_handle)->ticket);
   free (*context_handle);
+  *context_handle = GSS_C_NO_CONTEXT;
   return GSS_S_COMPLETE;
 }
diff --git a/crypto/heimdal/lib/gssapi/export_sec_context.c b/crypto/heimdal/lib/gssapi/export_sec_context.c
new file mode 100644
index 0000000..d982be7
--- /dev/null
+++ b/crypto/heimdal/lib/gssapi/export_sec_context.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "gssapi_locl.h"
+
+RCSID("$Id: export_sec_context.c,v 1.2 2000/02/12 21:25:24 assar Exp $");
+
+OM_uint32
+gss_export_sec_context (
+    OM_uint32 * minor_status,
+    gss_ctx_id_t * context_handle,
+    gss_buffer_t interprocess_token
+    )
+{
+    krb5_storage *sp;
+    krb5_auth_context ac;
+    unsigned char auth_buf[1024];
+    size_t sz;
+    int ret;
+    krb5_data data;
+    gss_buffer_desc buffer;
+    int flags;
+
+    gssapi_krb5_init ();
+    if (!((*context_handle)->flags & GSS_C_TRANS_FLAG))
+	return GSS_S_UNAVAILABLE;
+
+    sp = krb5_storage_emem ();
+    if (sp == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+    ac = (*context_handle)->auth_context;
+
+    /* flagging included fields */
+
+    flags = 0;
+    if (ac->local_address)
+	flags |= SC_LOCAL_ADDRESS;
+    if (ac->remote_address)
+	flags |= SC_REMOTE_ADDRESS;
+    if (ac->keyblock)
+	flags |= SC_KEYBLOCK;
+    if (ac->local_subkey)
+	flags |= SC_LOCAL_SUBKEY;
+    if (ac->remote_subkey)
+	flags |= SC_REMOTE_SUBKEY;
+
+    krb5_store_int32 (sp, flags);
+
+    /* marshall auth context */
+
+    krb5_store_int32 (sp, ac->flags);
+    if (ac->local_address)
+	krb5_store_address (sp, *ac->local_address);
+    if (ac->remote_address)
+	krb5_store_address (sp, *ac->remote_address);
+    krb5_store_int16 (sp, ac->local_port);
+    krb5_store_int16 (sp, ac->remote_port);
+    if (ac->keyblock)
+	krb5_store_keyblock (sp, *ac->keyblock);
+    if (ac->local_subkey)
+	krb5_store_keyblock (sp, *ac->local_subkey);
+    if (ac->remote_subkey)
+	krb5_store_keyblock (sp, *ac->remote_subkey);
+    krb5_store_int32 (sp, ac->local_seqnumber);
+    krb5_store_int32 (sp, ac->remote_seqnumber);
+
+#if 0
+    ret = encode_Authenticator (auth_buf, sizeof(auth_buf),
+				ac->authenticator, &sz);
+    if (ret) {
+	krb5_storage_free (sp);
+	*minor_status = ret;
+	return GSS_S_FAILURE;
+    }
+    data.data   = auth_buf;
+    data.length = sz;
+    krb5_store_data (sp, data);
+#endif
+    krb5_store_int32 (sp, ac->keytype);
+    krb5_store_int32 (sp, ac->cksumtype);
+
+    /* names */
+
+    gss_export_name (minor_status, (*context_handle)->source, &buffer);
+    data.data   = buffer.value;
+    data.length = buffer.length;
+    krb5_store_data (sp, data);
+
+    gss_export_name (minor_status, (*context_handle)->target, &buffer);
+    data.data   = buffer.value;
+    data.length = buffer.length;
+    krb5_store_data (sp, data);
+
+    krb5_store_int32 (sp, (*context_handle)->flags);
+    krb5_store_int32 (sp, (*context_handle)->more_flags);
+
+    ret = krb5_storage_to_data (sp, &data);
+    krb5_storage_free (sp);
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_FAILURE;
+    }
+    interprocess_token->length = data.length;
+    interprocess_token->value  = data.data;
+    ret = gss_delete_sec_context (minor_status, context_handle,
+				  GSS_C_NO_BUFFER);
+    if (ret != GSS_S_COMPLETE)
+	gss_release_buffer (NULL, interprocess_token);
+    return ret;
+}
diff --git a/crypto/heimdal/lib/gssapi/gssapi_locl.h b/crypto/heimdal/lib/gssapi/gssapi_locl.h
index f488a20..53f9cdc 100644
--- a/crypto/heimdal/lib/gssapi/gssapi_locl.h
+++ b/crypto/heimdal/lib/gssapi/gssapi_locl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: gssapi_locl.h,v 1.11 1999/12/02 17:05:03 joda Exp $ */
+/* $Id: gssapi_locl.h,v 1.12 2000/02/12 21:26:26 assar Exp $ */
 
 #ifndef GSSAPI_LOCL_H
 #define GSSAPI_LOCL_H
@@ -86,4 +86,12 @@ OM_uint32
 gss_krb5_getsomekey(const gss_ctx_id_t context_handle,
 		    des_cblock *key);
 
+/* sec_context flags */
+
+#define SC_LOCAL_ADDRESS  0x01
+#define SC_REMOTE_ADDRESS 0x02
+#define SC_KEYBLOCK	  0x04
+#define SC_LOCAL_SUBKEY	  0x08
+#define SC_REMOTE_SUBKEY  0x10
+
 #endif
diff --git a/crypto/heimdal/lib/gssapi/import_sec_context.c b/crypto/heimdal/lib/gssapi/import_sec_context.c
new file mode 100644
index 0000000..2667637
--- /dev/null
+++ b/crypto/heimdal/lib/gssapi/import_sec_context.c
@@ -0,0 +1,180 @@
+/*
+ * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "gssapi_locl.h"
+
+RCSID("$Id: import_sec_context.c,v 1.2 2000/02/12 21:26:00 assar Exp $");
+
+OM_uint32
+gss_import_sec_context (
+    OM_uint32 * minor_status,
+    const gss_buffer_t interprocess_token,
+    gss_ctx_id_t * context_handle
+    )
+{
+    OM_uint32 ret = GSS_S_FAILURE;
+    krb5_error_code kret;
+    krb5_storage *sp;
+    krb5_auth_context ac;
+    krb5_address local, remote;
+    krb5_address *localp, *remotep;
+    krb5_data data;
+    gss_buffer_desc buffer;
+    krb5_keyblock keyblock;
+    size_t sz;
+    int32_t tmp;
+    int32_t flags;
+
+    gssapi_krb5_init ();
+
+    sp = krb5_storage_from_mem (interprocess_token->value,
+				interprocess_token->length);
+    if (sp == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+
+    *context_handle = malloc(sizeof(**context_handle));
+    if (*context_handle == NULL) {
+	*minor_status = ENOMEM;
+	krb5_storage_free (sp);
+	return GSS_S_FAILURE;
+    }
+
+    kret = krb5_auth_con_init (gssapi_krb5_context,
+			       &(*context_handle)->auth_context);
+    if (kret) {
+	*minor_status = kret;
+	ret = GSS_S_FAILURE;
+	goto failure;
+    }
+
+    /* flags */
+
+    krb5_ret_int32 (sp, &flags);
+
+    /* retrieve the auth context */
+
+    ac = (*context_handle)->auth_context;
+    krb5_ret_int32 (sp, &ac->flags);
+    if (flags & SC_LOCAL_ADDRESS)
+	krb5_ret_address (sp, localp = &local);
+    else
+	localp = NULL;
+    if (flags & SC_REMOTE_ADDRESS)
+	krb5_ret_address (sp, remotep  = &remote);
+    else
+	remotep = NULL;
+    krb5_auth_con_setaddrs (gssapi_krb5_context, ac, localp, remotep);
+    if (localp)
+	krb5_free_address (gssapi_krb5_context, localp);
+    if (remotep)
+	krb5_free_address (gssapi_krb5_context, remotep);
+    krb5_ret_int16 (sp, &ac->local_port);
+    krb5_ret_int16 (sp, &ac->remote_port);
+    if (flags & SC_KEYBLOCK) {
+	krb5_ret_keyblock (sp, &keyblock);
+	krb5_auth_con_setkey (gssapi_krb5_context, ac, &keyblock);
+	krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock);
+    }
+    if (flags & SC_LOCAL_SUBKEY) {
+	krb5_ret_keyblock (sp, &keyblock);
+	krb5_auth_con_setlocalsubkey (gssapi_krb5_context, ac, &keyblock);
+	krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock);
+    }
+    if (flags & SC_REMOTE_SUBKEY) {
+	krb5_ret_keyblock (sp, &keyblock);
+	krb5_auth_con_setremotesubkey (gssapi_krb5_context, ac, &keyblock);
+	krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock);
+    }
+    krb5_ret_int32 (sp, &ac->local_seqnumber);
+    krb5_ret_int32 (sp, &ac->remote_seqnumber);
+
+#if 0
+    krb5_ret_data (sp, &data);
+    ac->authenticator = malloc (sizeof (*ac->authenticator));
+    if (ac->authenticator == NULL) {
+	*minor_status = ENOMEM;
+	ret = GSS_S_FAILURE;
+	goto failure;
+    }
+
+    kret = decode_Authenticator (data.data, data.length,
+				 ac->authenticator, &sz);
+    krb5_data_free (&data);
+    if (kret) {
+	*minor_status = kret;
+	ret = GSS_S_FAILURE;
+	goto failure;
+    }
+#endif
+
+    krb5_ret_int32 (sp, &tmp);
+    ac->keytype = tmp;
+    krb5_ret_int32 (sp, &tmp);
+    ac->cksumtype = tmp;
+
+    /* names */
+
+    krb5_ret_data (sp, &data);
+    buffer.value  = data.data;
+    buffer.length = data.length;
+
+    gss_import_name (minor_status, &buffer, GSS_C_NO_OID,
+		     &(*context_handle)->source);
+    krb5_data_free (&data);
+
+    krb5_ret_data (sp, &data);
+    buffer.value  = data.data;
+    buffer.length = data.length;
+
+    gss_import_name (minor_status, &buffer, GSS_C_NO_OID,
+		     &(*context_handle)->target);
+    krb5_data_free (&data);
+
+    krb5_ret_int32 (sp, &tmp);
+    (*context_handle)->flags = tmp;
+    krb5_ret_int32 (sp, &tmp);
+    (*context_handle)->more_flags = tmp;
+
+    (*context_handle)->ticket = NULL;
+
+    return GSS_S_COMPLETE;
+
+failure:
+    krb5_auth_con_free (gssapi_krb5_context,
+			(*context_handle)->auth_context);
+    free (*context_handle);
+    *context_handle = GSS_C_NO_CONTEXT;
+    return ret;
+}
diff --git a/crypto/heimdal/lib/krb5/Makefile.am b/crypto/heimdal/lib/krb5/Makefile.am
index ab2182c..a5f60c0 100644
--- a/crypto/heimdal/lib/krb5/Makefile.am
+++ b/crypto/heimdal/lib/krb5/Makefile.am
@@ -1,4 +1,4 @@
-# $Id: Makefile.am,v 1.96 2000/02/07 03:26:21 assar Exp $
+# $Id: Makefile.am,v 1.97 2000/02/13 20:35:49 assar Exp $
 
 include $(top_srcdir)/Makefile.am.common
 
@@ -119,7 +119,7 @@ libkrb5_la_SOURCES = \
 
 EXTRA_libkrb5_la_SOURCES = keytab_krb4.c
 
-libkrb5_la_LDFLAGS = -version-info 8:0:0
+libkrb5_la_LDFLAGS = -version-info 9:0:0
 
 $(libkrb5_la_OBJECTS): $(srcdir)/krb5-protos.h $(srcdir)/krb5-private.h
 
diff --git a/crypto/heimdal/lib/krb5/Makefile.in b/crypto/heimdal/lib/krb5/Makefile.in
index 33429d4..da4a0fb 100644
--- a/crypto/heimdal/lib/krb5/Makefile.in
+++ b/crypto/heimdal/lib/krb5/Makefile.in
@@ -10,7 +10,7 @@
 # even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 # PARTICULAR PURPOSE.
 
-# $Id: Makefile.am,v 1.96 2000/02/07 03:26:21 assar Exp $
+# $Id: Makefile.am,v 1.97 2000/02/13 20:35:49 assar Exp $
 
 
 # $Id: Makefile.am.common,v 1.3 1999/04/01 14:58:43 joda Exp $
@@ -195,7 +195,7 @@ libkrb5_la_SOURCES =  	add_et_list.c 	addr_families.c 	address.c 	aname_to_local
 
 EXTRA_libkrb5_la_SOURCES = keytab_krb4.c
 
-libkrb5_la_LDFLAGS = -version-info 8:0:0
+libkrb5_la_LDFLAGS = -version-info 9:0:0
 
 libkrb5_la_LIBADD = ../com_err/error.lo ../com_err/com_err.lo
 
diff --git a/crypto/heimdal/lib/krb5/changepw.c b/crypto/heimdal/lib/krb5/changepw.c
index fd94440..56c89a0 100644
--- a/crypto/heimdal/lib/krb5/changepw.c
+++ b/crypto/heimdal/lib/krb5/changepw.c
@@ -33,21 +33,17 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: changepw.c,v 1.19 1999/12/11 23:14:51 assar Exp $");
+RCSID("$Id: changepw.c,v 1.20 2000/02/07 13:40:18 joda Exp $");
 
 static krb5_error_code
 get_kdc_address (krb5_context context,
 		 krb5_realm realm,
 		 struct addrinfo **ai)
 {
-    struct addrinfo hints;
     krb5_error_code ret;
     char **hostlist;
     int port = 0;
-    char portstr[NI_MAXSERV];
     int error;
-    char *host;
-    char *dot;
 
     ret = krb5_get_krb_changepw_hst (context,
 				     &realm,
@@ -55,24 +51,9 @@ get_kdc_address (krb5_context context,
     if (ret)
 	return ret;
 
-    host = *hostlist;
+    port = ntohs(krb5_getportbyname (context, "kpasswd", "udp", KPASSWD_PORT));
+    error = roken_getaddrinfo_hostspec(*hostlist, port, ai);
 
-    dot = strchr (host, ':');
-    if (dot != NULL) {
-	char *end;
-
-	*dot++ = '\0';
-	port = strtol (dot, &end, 0);
-    }
-    if (port == 0)
-	port = krb5_getportbyname (context, "kpasswd", "udp", KPASSWD_PORT);
-    snprintf (portstr, sizeof(portstr), "%u", ntohs(port));
-
-    memset (&hints, 0, sizeof(hints));
-    hints.ai_socktype = SOCK_DGRAM;
-    hints.ai_protocol = IPPROTO_UDP;
-
-    error = getaddrinfo (host, portstr, &hints, ai);
     krb5_free_krbhst (context, hostlist);
     return error;
 }
diff --git a/crypto/heimdal/lib/krb5/context.c b/crypto/heimdal/lib/krb5/context.c
index 1a7e941..fb3fb61 100644
--- a/crypto/heimdal/lib/krb5/context.c
+++ b/crypto/heimdal/lib/krb5/context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: context.c,v 1.52 2000/02/04 17:10:26 joda Exp $");
+RCSID("$Id: context.c,v 1.53 2000/02/11 17:43:43 assar Exp $");
 
 #define INIT_FIELD(C, T, E, D, F)					\
     (C)->E = krb5_config_get_ ## T ## _default ((C), NULL, (D), 	\
@@ -318,7 +318,7 @@ krb5_add_extra_addresses(krb5_context context, krb5_addresses *addresses)
 }
 
 krb5_error_code
-krb5_set_extra_addresses(krb5_context context, krb5_addresses *addresses)
+krb5_set_extra_addresses(krb5_context context, const krb5_addresses *addresses)
 {
     if(context->extra_addresses) {
 	krb5_free_addresses(context, context->extra_addresses);
@@ -329,7 +329,7 @@ krb5_set_extra_addresses(krb5_context context, krb5_addresses *addresses)
 	if(context->extra_addresses == NULL)
 	    return ENOMEM;
     }
-    return copy_HostAddresses(addresses, context->extra_addresses);
+    return krb5_copy_addresses(context, addresses, context->extra_addresses);
 }
 
 krb5_error_code
diff --git a/crypto/heimdal/lib/krb5/krb5-protos.h b/crypto/heimdal/lib/krb5/krb5-protos.h
index 1b0abdb..59402a7 100644
--- a/crypto/heimdal/lib/krb5/krb5-protos.h
+++ b/crypto/heimdal/lib/krb5/krb5-protos.h
@@ -449,6 +449,13 @@ krb5_change_password __P((
 	krb5_data *result_code_string,
 	krb5_data *result_string));
 
+krb5_error_code
+krb5_check_transited_realms __P((
+	krb5_context context,
+	const char *const *realms,
+	int num_realms,
+	int *bad_realm));
+
 krb5_boolean
 krb5_checksum_is_collision_proof __P((
 	krb5_context context,
@@ -1948,7 +1955,7 @@ krb5_set_default_realm __P((
 krb5_error_code
 krb5_set_extra_addresses __P((
 	krb5_context context,
-	krb5_addresses *addresses));
+	const krb5_addresses *addresses));
 
 krb5_error_code
 krb5_set_fcache_version __P((
diff --git a/crypto/heimdal/lib/krb5/krb5_err.et b/crypto/heimdal/lib/krb5/krb5_err.et
index e8779df..895ae66 100644
--- a/crypto/heimdal/lib/krb5/krb5_err.et
+++ b/crypto/heimdal/lib/krb5/krb5_err.et
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: krb5_err.et,v 1.7 1999/02/11 21:03:40 joda Exp $"
+id "$Id: krb5_err.et,v 1.8 2000/02/07 12:54:17 joda Exp $"
 
 error_table krb5
 
@@ -51,7 +51,7 @@ error_code ERR_BADVERSION,	"Protocol version mismatch"
 error_code ERR_MSG_TYPE,	"Invalid message type"
 error_code ERR_MODIFIED,	"Message stream modified"
 error_code ERR_BADORDER,	"Message out of order"
-error_code ERR_ILL_CR_TKT,	"Illegal cross-realm ticket"
+error_code ERR_ILL_CR_TKT,	"Invalid cross-realm ticket"
 error_code ERR_BADKEYVER,	"Key version is not available"
 error_code ERR_NOKEY,		"Service key not available"
 error_code ERR_MUT_FAIL,	"Mutual authentication failed"
@@ -71,14 +71,14 @@ error_code FIELD_TOOLONG,	"Field is too long for this implementation"
 # 62-127 are reserved
 index 128
 prefix
-error_code KRB5_ERR_RCSID,	"$Id: krb5_err.et,v 1.7 1999/02/11 21:03:40 joda Exp $"
+error_code KRB5_ERR_RCSID,	"$Id: krb5_err.et,v 1.8 2000/02/07 12:54:17 joda Exp $"
 
 error_code KRB5_LIBOS_BADLOCKFLAG,	"Invalid flag for file lock mode"
 error_code KRB5_LIBOS_CANTREADPWD,	"Cannot read password"
 error_code KRB5_LIBOS_BADPWDMATCH,	"Password mismatch"
 error_code KRB5_LIBOS_PWDINTR,		"Password read interrupted"
 
-error_code KRB5_PARSE_ILLCHAR,		"Illegal character in component name"
+error_code KRB5_PARSE_ILLCHAR,		"Invalid character in component name"
 error_code KRB5_PARSE_MALFORMED,	"Malformed representation of principal"
 
 error_code KRB5_CONFIG_CANTOPEN,	"Can't open/find configuration file"
diff --git a/crypto/heimdal/lib/krb5/rd_req.c b/crypto/heimdal/lib/krb5/rd_req.c
index 236ecb4..bcf4ecf 100644
--- a/crypto/heimdal/lib/krb5/rd_req.c
+++ b/crypto/heimdal/lib/krb5/rd_req.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_req.c,v 1.40 2000/02/06 05:20:31 assar Exp $");
+RCSID("$Id: rd_req.c,v 1.41 2000/02/07 13:31:55 joda Exp $");
 
 static krb5_error_code
 decrypt_tkt_enc_part (krb5_context context,
@@ -188,6 +188,30 @@ out:
     return ret;
 }
 
+#if 0
+static krb5_error_code
+check_transited(krb5_context context,
+		krb5_ticket *ticket)
+{
+    char **realms;
+    int num_realms;
+    krb5_error_code ret;
+
+    if(ticket->ticket.transited.tr_type != DOMAIN_X500_COMPRESS)
+	return KRB5KDC_ERR_TRTYPE_NOSUPP;
+
+    ret = krb5_domain_x500_decode(ticket->ticket.transited.contents, 
+				  &realms, &num_realms, 
+				  ticket->client->realm,
+				  ticket->server->realm);
+    if(ret)
+	return ret;
+    ret = krb5_check_transited_realms(context, realms, num_realms, NULL);
+    free(realms);
+    return ret;
+}
+#endif
+
 krb5_error_code
 krb5_verify_ap_req(krb5_context context,
 		   krb5_auth_context *auth_context,
diff --git a/crypto/heimdal/lib/krb5/transited.c b/crypto/heimdal/lib/krb5/transited.c
index 2295551..1faf378 100644
--- a/crypto/heimdal/lib/krb5/transited.c
+++ b/crypto/heimdal/lib/krb5/transited.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: transited.c,v 1.6 2000/02/07 03:19:43 assar Exp $");
+RCSID("$Id: transited.c,v 1.7 2000/02/07 13:30:41 joda Exp $");
 
 /* this is an attempt at one of the most horrible `compression'
    schemes that has ever been invented; it's so amazingly brain-dead
@@ -363,6 +363,35 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     return 0;
 }
 
+krb5_error_code
+krb5_check_transited_realms(krb5_context context,
+			    const char *const *realms, 
+			    int num_realms, 
+			    int *bad_realm)
+{
+    int i;
+    int ret = 0;
+    char **bad_realms = krb5_config_get_strings(context, NULL, 
+						"libdefaults", 
+						"transited_realms_reject", 
+						NULL);
+    if(bad_realms == NULL)
+	return 0;
+
+    for(i = 0; i < num_realms; i++) {
+	char **p;
+	for(p = bad_realms; *p; p++)
+	    if(strcmp(*p, realms[i]) == 0) {
+		ret = KRB5KRB_AP_ERR_ILL_CR_TKT;
+		if(bad_realm)
+		    *bad_realm = i;
+		break;
+	    }
+    }
+    krb5_config_free_strings(bad_realms);
+    return ret;
+}
+
 #if 0
 int
 main(int argc, char **argv)
diff --git a/crypto/heimdal/lib/roken/ChangeLog b/crypto/heimdal/lib/roken/ChangeLog
index 4e7cd27..b157494 100644
--- a/crypto/heimdal/lib/roken/ChangeLog
+++ b/crypto/heimdal/lib/roken/ChangeLog
@@ -1,3 +1,11 @@
+2000-02-13  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.am: bump version to 7:0:2
+
+	* getarg.c (mandoc_template): also fix no- prefix in .Sh OPTIONS
+	* getarg.c (mandoc_template): better man-stuff for negative
+	options
+
 2000-02-07  Assar Westerlund  <assar@sics.se>
 
 	* Makefile.am: set version to 6:0:1
diff --git a/crypto/heimdal/lib/roken/Makefile.am b/crypto/heimdal/lib/roken/Makefile.am
index aea5099..d23fcb3 100644
--- a/crypto/heimdal/lib/roken/Makefile.am
+++ b/crypto/heimdal/lib/roken/Makefile.am
@@ -1,11 +1,11 @@
-# $Id: Makefile.am,v 1.67 2000/02/07 03:32:15 assar Exp $
+# $Id: Makefile.am,v 1.69 2000/02/13 20:34:03 assar Exp $
 
 include $(top_srcdir)/Makefile.am.common
 
 CLEANFILES = roken.h make-roken.c print_version.h
 
 lib_LTLIBRARIES = libroken.la
-libroken_la_LDFLAGS = -version-info 6:0:1
+libroken_la_LDFLAGS = -version-info 7:0:2
 
 noinst_PROGRAMS = make-roken make-print-version
 
@@ -32,6 +32,7 @@ libroken_la_SOURCES =		\
 	erealloc.c		\
 	estrdup.c		\
 	ewrite.c		\
+	getaddrinfo_hostspec.c	\
 	get_default_username.c	\
 	get_window_size.c	\
 	getarg.c		\
diff --git a/crypto/heimdal/lib/roken/Makefile.in b/crypto/heimdal/lib/roken/Makefile.in
index 3743418..65c3f99 100644
--- a/crypto/heimdal/lib/roken/Makefile.in
+++ b/crypto/heimdal/lib/roken/Makefile.in
@@ -10,7 +10,7 @@
 # even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 # PARTICULAR PURPOSE.
 
-# $Id: Makefile.am,v 1.67 2000/02/07 03:32:15 assar Exp $
+# $Id: Makefile.am,v 1.69 2000/02/13 20:34:03 assar Exp $
 
 
 # $Id: Makefile.am.common,v 1.3 1999/04/01 14:58:43 joda Exp $
@@ -176,7 +176,7 @@ CHECK_LOCAL = $(PROGRAMS)
 CLEANFILES = roken.h make-roken.c print_version.h
 
 lib_LTLIBRARIES = libroken.la
-libroken_la_LDFLAGS = -version-info 6:0:1
+libroken_la_LDFLAGS = -version-info 7:0:2
 
 noinst_PROGRAMS = make-roken make-print-version
 
@@ -189,7 +189,7 @@ strpftime_test_SOURCES = strpftime-test.c strftime.c strptime.c snprintf.c
 
 @KRB4_TRUE@@KRB5_TRUE@make_print_version_LDADD =  $(LIB_krb4) -ldes
 
-libroken_la_SOURCES =  	base64.c			concat.c			emalloc.c			eread.c				erealloc.c			estrdup.c			ewrite.c			get_default_username.c		get_window_size.c		getarg.c			getnameinfo_verified.c		issuid.c			k_getpwnam.c			k_getpwuid.c			mini_inetd.c			net_read.c			net_write.c			parse_bytes.c			parse_time.c			parse_units.c			print_version.c			resolve.c			roken_gethostby.c		signal.c			simple_exec.c			snprintf.c			socket.c			strcollect.c			tm2time.c			verify.c			warnerr.c			xdbm.h
+libroken_la_SOURCES =  	base64.c			concat.c			emalloc.c			eread.c				erealloc.c			estrdup.c			ewrite.c			getaddrinfo_hostspec.c		get_default_username.c		get_window_size.c		getarg.c			getnameinfo_verified.c		issuid.c			k_getpwnam.c			k_getpwuid.c			mini_inetd.c			net_read.c			net_write.c			parse_bytes.c			parse_time.c			parse_units.c			print_version.c			resolve.c			roken_gethostby.c		signal.c			simple_exec.c			snprintf.c			socket.c			strcollect.c			tm2time.c			verify.c			warnerr.c			xdbm.h
 
 
 EXTRA_libroken_la_SOURCES =  	chown.c				copyhostent.c			daemon.c			err.c				err.h				errx.c				fchown.c			flock.c				fnmatch.c			fnmatch.h			freeaddrinfo.c			freehostent.c			gai_strerror.c			getaddrinfo.c			getdtablesize.c			getegid.c			geteuid.c			getgid.c			gethostname.c			getipnodebyaddr.c		getipnodebyname.c		getnameinfo.c			getopt.c			gettimeofday.c			getuid.c			getusershell.c			glob.h				hstrerror.c			inet_aton.c			inet_ntop.c			inet_pton.c			initgroups.c			innetgr.c			iruserok.c			lstat.c				memmove.c			mkstemp.c			putenv.c			rcmd.c				readv.c				recvmsg.c			sendmsg.c			setegid.c			setenv.c			seteuid.c			strcasecmp.c			strdup.c			strerror.c			strftime.c			strlcat.c			strlcpy.c			strlwr.c			strncasecmp.c			strndup.c			strnlen.c			strptime.c			strsep.c			strtok_r.c			strupr.c			swab.c				unsetenv.c			verr.c				verrx.c				vsyslog.c			vwarn.c				vwarnx.c			warn.c				warnx.c				writev.c
@@ -226,12 +226,13 @@ X_EXTRA_LIBS = @X_EXTRA_LIBS@
 X_PRE_LIBS = @X_PRE_LIBS@
 libroken_la_DEPENDENCIES =  @LTLIBOBJS@
 libroken_la_OBJECTS =  base64.lo concat.lo emalloc.lo eread.lo \
-erealloc.lo estrdup.lo ewrite.lo get_default_username.lo \
-get_window_size.lo getarg.lo getnameinfo_verified.lo issuid.lo \
-k_getpwnam.lo k_getpwuid.lo mini_inetd.lo net_read.lo net_write.lo \
-parse_bytes.lo parse_time.lo parse_units.lo print_version.lo resolve.lo \
-roken_gethostby.lo signal.lo simple_exec.lo snprintf.lo socket.lo \
-strcollect.lo tm2time.lo verify.lo warnerr.lo
+erealloc.lo estrdup.lo ewrite.lo getaddrinfo_hostspec.lo \
+get_default_username.lo get_window_size.lo getarg.lo \
+getnameinfo_verified.lo issuid.lo k_getpwnam.lo k_getpwuid.lo \
+mini_inetd.lo net_read.lo net_write.lo parse_bytes.lo parse_time.lo \
+parse_units.lo print_version.lo resolve.lo roken_gethostby.lo signal.lo \
+simple_exec.lo snprintf.lo socket.lo strcollect.lo tm2time.lo verify.lo \
+warnerr.lo
 check_PROGRAMS =  parse_bytes-test$(EXEEXT) strpftime-test$(EXEEXT) \
 getaddrinfo-test$(EXEEXT)
 noinst_PROGRAMS =  make-roken$(EXEEXT) make-print-version$(EXEEXT)
diff --git a/crypto/heimdal/lib/roken/getaddrinfo_hostspec.c b/crypto/heimdal/lib/roken/getaddrinfo_hostspec.c
new file mode 100644
index 0000000..76e5d2b
--- /dev/null
+++ b/crypto/heimdal/lib/roken/getaddrinfo_hostspec.c
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2000 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+RCSID("$Id: getaddrinfo_hostspec.c,v 1.1 2000/02/07 13:38:22 joda Exp $");
+#endif
+
+#include "roken.h"
+
+/* getaddrinfo via string specifying host and port */
+
+int
+roken_getaddrinfo_hostspec(const char *hostspec, 
+			   int port,
+			   struct addrinfo **ai)
+{
+    const char *p;
+    char portstr[NI_MAXSERV];
+    char host[MAXHOSTNAMELEN];
+    struct addrinfo hints;
+
+    struct hst {
+	const char *prefix;
+	int socktype;
+	int protocol;
+	int port;
+    } *hstp, hst[] = {
+	{ "http://", SOCK_STREAM, IPPROTO_TCP, 80 },
+	{ "http/", SOCK_STREAM, IPPROTO_TCP, 80 },
+	{ "tcp/", SOCK_STREAM, IPPROTO_TCP },
+	{ "udp/", SOCK_DGRAM, IPPROTO_UDP },
+	{ NULL }
+    };
+
+    memset(&hints, 0, sizeof(hints));
+	
+    for(hstp = hst; hstp->prefix; hstp++) {
+	if(strncmp(hostspec, hstp->prefix, strlen(hstp->prefix)) == 0) {
+	    hints.ai_socktype = hstp->socktype;
+	    hints.ai_protocol = hstp->protocol;
+	    if(port == 0)
+		port = hstp->port;
+	    hostspec += strlen(hstp->prefix);
+	    break;
+	}
+    }
+    
+    p = strchr (hostspec, ':');
+    if (p != NULL) {
+	char *end;
+
+	port = strtol (p + 1, &end, 0);
+    }
+    snprintf (portstr, sizeof(portstr), "%u", port);
+    
+    snprintf (host, sizeof(host), "%.*s", p - hostspec, hostspec);
+    return getaddrinfo (host, portstr, &hints, ai);
+}
diff --git a/crypto/heimdal/lib/roken/getarg.c b/crypto/heimdal/lib/roken/getarg.c
index 505e418..d9a03a5 100644
--- a/crypto/heimdal/lib/roken/getarg.c
+++ b/crypto/heimdal/lib/roken/getarg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: getarg.c,v 1.32 1999/12/02 16:58:46 joda Exp $");
+RCSID("$Id: getarg.c,v 1.34 2000/02/13 21:06:43 assar Exp $");
 #endif
 
 #include <stdio.h>
@@ -125,7 +125,9 @@ mandoc_template(struct getargs *args,
 	    }
 	    if(args[i].long_name) {
 		print_arg(buf, sizeof(buf), 1, 1, args + i);
-		printf("Fl -%s%s", args[i].long_name, buf);
+		printf("Fl -%s%s%s",
+		       args[i].type == arg_negative_flag ? "no-" : "",
+		       args[i].long_name, buf);
 	    }
 	    printf("\n");
 	} else {
@@ -155,7 +157,9 @@ mandoc_template(struct getargs *args,
 	    printf("\n");
 	}
 	if(args[i].long_name){
-	    printf(".Fl -%s", args[i].long_name);
+	    printf(".Fl -%s%s",
+		   args[i].type == arg_negative_flag ? "no-" : "",
+		   args[i].long_name);
 	    print_arg(buf, sizeof(buf), 1, 1, args + i);
 	    printf("%s\n", buf);
 	}
diff --git a/crypto/heimdal/lib/roken/roken-common.h b/crypto/heimdal/lib/roken/roken-common.h
index b972024..8bdc986 100644
--- a/crypto/heimdal/lib/roken/roken-common.h
+++ b/crypto/heimdal/lib/roken/roken-common.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: roken-common.h,v 1.25 2000/01/09 10:58:34 assar Exp $ */
+/* $Id: roken-common.h,v 1.27 2000/02/14 02:24:44 assar Exp $ */
 
 #ifndef __ROKEN_COMMON_H__
 #define __ROKEN_COMMON_H__
@@ -290,4 +290,5 @@ vstrcollect(va_list *ap);
 char **
 strcollect(char *first, ...);
 
+
 #endif /* __ROKEN_COMMON_H__ */
diff --git a/crypto/heimdal/lib/roken/roken.h.in b/crypto/heimdal/lib/roken/roken.h.in
index 03cfce4..3abe6eb 100644
--- a/crypto/heimdal/lib/roken/roken.h.in
+++ b/crypto/heimdal/lib/roken/roken.h.in
@@ -1,6 +1,6 @@
 /* -*- C -*- */
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: roken.h.in,v 1.133 1999/12/30 02:22:54 assar Exp $ */
+/* $Id: roken.h.in,v 1.135 2000/02/14 02:24:20 assar Exp $ */
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -521,6 +521,9 @@ getnameinfo_verified(const struct sockaddr *sa, socklen_t salen,
 		     char *serv, size_t servlen,
 		     int flags);
 
+int
+roken_getaddrinfo_hostspec(const char *, int, struct addrinfo **);
+
 #ifndef HAVE_STRFTIME
 size_t
 strftime (char *buf, size_t maxsize, const char *format,