import krb4-1.0.5

54 files changed, 2050 insertions, 327 deletions

diff --git a/crypto/kerberosIV/lib/acl/Makefile.in b/crypto/kerberosIV/lib/acl/Makefile.in
index 2a78190..96d7424 100644
--- a/crypto/kerberosIV/lib/acl/Makefile.in
+++ b/crypto/kerberosIV/lib/acl/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.29 1999/03/10 19:01:14 joda Exp $
+# $Id: Makefile.in,v 1.29.4.1 2000/06/23 03:20:00 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -48,7 +48,7 @@ Wall:
 
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
-	$(INSTALL_DATA) -m 0555 $(LIB) $(DESTDIR)$(libdir)/$(LIB)
+	$(INSTALL_DATA) $(LIB) $(DESTDIR)$(libdir)/$(LIB)
 
 uninstall:
 	rm -f $(DESTDIR)$(libdir)/$(LIB)
diff --git a/crypto/kerberosIV/lib/auth/afskauthlib/Makefile.in b/crypto/kerberosIV/lib/auth/afskauthlib/Makefile.in
index 2eb2576..5e073af 100644
--- a/crypto/kerberosIV/lib/auth/afskauthlib/Makefile.in
+++ b/crypto/kerberosIV/lib/auth/afskauthlib/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.25 1999/11/15 10:20:46 assar Exp $
+# $Id: Makefile.in,v 1.25.2.1 2000/06/23 03:20:05 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -54,7 +54,7 @@ Wall:
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
 	-if test "$(LIB)" != ""; then \
-	 $(INSTALL_DATA) -m 0555 $(LIB) $(DESTDIR)$(libdir)/$(LIB) ; \
+	 $(INSTALL_DATA) $(LIB) $(DESTDIR)$(libdir)/$(LIB) ; \
 	fi
 
 uninstall:
diff --git a/crypto/kerberosIV/lib/auth/pam/Makefile.in b/crypto/kerberosIV/lib/auth/pam/Makefile.in
index b012fcd..4369532 100644
--- a/crypto/kerberosIV/lib/auth/pam/Makefile.in
+++ b/crypto/kerberosIV/lib/auth/pam/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.25 1999/11/15 10:20:48 assar Exp $
+# $Id: Makefile.in,v 1.25.2.2 2000/12/07 16:44:11 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -31,8 +31,8 @@ LD_FLAGS = @REAL_LD_FLAGS@
 LIB_res_search = @LIB_res_search@
 LIB_dn_expand = @LIB_dn_expand@
  
-@lib_deps_yes@LIB_DEPS = -L../../kafs -L../../krb -L../../des \
-@lib_deps_yes@	   -lkafs -lkrb -ldes \
+@lib_deps_yes@LIB_DEPS = ../../kafs/libkafs_pic.a \
+@lib_deps_yes@	         ../../krb/libkrb_pic.a ../../des/libdes_pic.a \
 @lib_deps_yes@     $(LIB_res_search) $(LIB_dn_expand) -lpam -lc
 @lib_deps_no@LIB_DEPS =
 
@@ -54,7 +54,7 @@ Wall:
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
 	-if test "$(LIB)" != ""; then \
-	  $(INSTALL_DATA) -m 0555 $(LIB) $(DESTDIR)$(libdir)/$(LIB) ; \
+	  $(INSTALL_DATA) $(LIB) $(DESTDIR)$(libdir)/$(LIB) ; \
 	fi
 
 uninstall:
@@ -82,7 +82,6 @@ $(OBJECTS): ../../../include/config.h
 
 $(LIB): $(OBJECTS)
 	rm -f $@
-	$(LDSHARED) -o $@ $(OBJECTS) $(LD_FLAGS) $(LIB_DEPS)
-#	$(LINK) -shared -Wl,-x -o $(LIB) $(OBJECTS)  ../../kafs/libkafs.a ../../krb/libkrb.a ../../des/libdes.a
+	$(LDSHARED) -Wl,-Bsymbolic -o $@ $(OBJECTS) $(LD_FLAGS) $(LIB_DEPS)
 
 .PHONY: all Wall install uninstall check clean mostlyclean distclean realclean
diff --git a/crypto/kerberosIV/lib/auth/pam/pam.c b/crypto/kerberosIV/lib/auth/pam/pam.c
index d919bf8..22dfc74 100644
--- a/crypto/kerberosIV/lib/auth/pam/pam.c
+++ b/crypto/kerberosIV/lib/auth/pam/pam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -31,13 +31,9 @@
  * SUCH DAMAGE.
  */
 
-/* This code is extremely ugly, and would probably be better off
-   beeing completely rewritten */
-
-
 #ifdef HAVE_CONFIG_H
 #include<config.h>
-RCSID("$Id: pam.c,v 1.22 1999/12/02 16:58:37 joda Exp $");
+RCSID("$Id: pam.c,v 1.22.2.2 2000/10/13 15:41:09 assar Exp $");
 #endif
 
 #include <stdio.h>
@@ -46,198 +42,402 @@ RCSID("$Id: pam.c,v 1.22 1999/12/02 16:58:37 joda Exp $");
 #include <pwd.h>
 #include <unistd.h>
 #include <sys/types.h>
+#include <syslog.h>
 
-#define PAM_SM_AUTH
-#define PAM_SM_SESSION
 #include <security/pam_appl.h>
 #include <security/pam_modules.h>
+#ifndef PAM_AUTHTOK_RECOVERY_ERR /* Fix linsux typo. */
+#define PAM_AUTHTOK_RECOVERY_ERR PAM_AUTHTOK_RECOVER_ERR
+#endif
 
 #include <netinet/in.h>
 #include <krb.h>
 #include <kafs.h>
 
-static int
-cleanup(pam_handle_t *pamh, void *data, int error_code)
+#if 0
+/* Debugging PAM modules is a royal pain, truss helps. */
+#define DEBUG(msg) (access(msg " at line", __LINE__))
+#endif
+
+static void
+psyslog(int level, const char *format, ...)
 {
-    if(error_code != PAM_SUCCESS)
-	dest_tkt();
-    free(data);
-    return PAM_SUCCESS;
+  va_list args;
+  va_start(args, format);
+  openlog("pam_krb4", LOG_CONS|LOG_PID, LOG_AUTH);
+  vsyslog(level, format, args);
+  va_end(args);
+  closelog();
 }
 
-static int
-doit(pam_handle_t *pamh, char *name, char *inst, char *pwd, char *tkt)
+enum {
+  KRB4_DEBUG,
+  KRB4_USE_FIRST_PASS,
+  KRB4_TRY_FIRST_PASS,
+  KRB4_IGNORE_ROOT,
+  KRB4_NO_VERIFY,
+  KRB4_REAFSLOG,
+  KRB4_CTRLS			/* Number of ctrl arguments defined. */
+};
+
+#define KRB4_DEFAULTS  0
+
+static int ctrl_flags = KRB4_DEFAULTS;
+#define ctrl_on(x)  (krb4_args[x].flag & ctrl_flags)
+#define ctrl_off(x) (!ctrl_on(x))
+
+typedef struct
 {
-    char realm[REALM_SZ];
-    int ret;
-
-    pam_set_data(pamh, "KRBTKFILE", strdup(tkt), cleanup);
-    krb_set_tkt_string(tkt);
-	
-    krb_get_lrealm(realm, 1);
-    ret = krb_verify_user(name, inst, realm, pwd, KRB_VERIFY_SECURE, NULL);
-    memset(pwd, 0, strlen(pwd));
-    switch(ret){
-    case KSUCCESS:
-	return PAM_SUCCESS;
-    case KDC_PR_UNKNOWN:
-	return PAM_USER_UNKNOWN;
-    case SKDC_CANT:
-    case SKDC_RETRY:
-    case RD_AP_TIME:
-	return PAM_AUTHINFO_UNAVAIL;
-    default:
-	return PAM_AUTH_ERR;
+  const char *token;
+  unsigned int flag;
+} krb4_ctrls_t;
+
+static krb4_ctrls_t krb4_args[KRB4_CTRLS] =
+{
+  /* KRB4_DEBUG          */ { "debug",          0x01 },
+  /* KRB4_USE_FIRST_PASS */ { "use_first_pass", 0x02 },
+  /* KRB4_TRY_FIRST_PASS */ { "try_first_pass", 0x04 },
+  /* KRB4_IGNORE_ROOT    */ { "ignore_root",    0x08 },
+  /* KRB4_NO_VERIFY      */ { "no_verify",      0x10 },
+  /* KRB4_REAFSLOG       */ { "reafslog",       0x20 },
+};
+
+static void
+parse_ctrl(int argc, const char **argv)
+{
+  int i, j;
+
+  ctrl_flags = KRB4_DEFAULTS;
+  for (i = 0; i < argc; i++)
+    {
+      for (j = 0; j < KRB4_CTRLS; j++)
+	if (strcmp(argv[i], krb4_args[j].token) == 0)
+	  break;
+    
+      if (j >= KRB4_CTRLS)
+	psyslog(LOG_ALERT, "unrecognized option [%s]", *argv);
+      else
+	ctrl_flags |= krb4_args[j].flag;
     }
 }
 
-static int
-auth_login(pam_handle_t *pamh, int flags, char *user, struct pam_conv *conv)
+static void
+pdeb(const char *format, ...)
 {
-    int ret;
-    struct pam_message msg, *pmsg;
-    struct pam_response *resp;
-    char prompt[128];
-
-    pmsg = &msg;
-    msg.msg_style = PAM_PROMPT_ECHO_OFF;
-    snprintf(prompt, sizeof(prompt), "%s's Password: ", user);
-    msg.msg = prompt;
-
-    ret = conv->conv(1, (const struct pam_message**)&pmsg, 
-		     &resp, conv->appdata_ptr);
-    if(ret != PAM_SUCCESS)
-	return ret;
-    
+  va_list args;
+  if (ctrl_off(KRB4_DEBUG))
+    return;
+  va_start(args, format);
+  openlog("pam_krb4", LOG_CONS|LOG_PID, LOG_AUTH);
+  vsyslog(LOG_DEBUG, format, args);
+  va_end(args);
+  closelog();
+}
+
+#define ENTRY(func) pdeb("%s() flags = %d ruid = %d euid = %d", func, flags, getuid(), geteuid())
+
+static void
+set_tkt_string(uid_t uid)
+{
+  char buf[128];
+
+  snprintf(buf, sizeof(buf), "%s%u", TKT_ROOT, (unsigned)uid);
+  krb_set_tkt_string(buf);
+
+#if 0
+  /* pam_set_data+pam_get_data are not guaranteed to work, grr. */
+  pam_set_data(pamh, "KRBTKFILE", strdup(t), cleanup);
+  if (pam_get_data(pamh, "KRBTKFILE", (const void**)&tkt) == PAM_SUCCESS)
     {
-	char tkt[1024];
-	struct passwd *pw = getpwnam(user);
-
-	if(pw){
-	    snprintf(tkt, sizeof(tkt),
-		     "%s%u", TKT_ROOT, (unsigned)pw->pw_uid);
-	    ret = doit(pamh, user, "", resp->resp, tkt);
-	    if(ret == PAM_SUCCESS)
-		chown(tkt, pw->pw_uid, pw->pw_gid);
-	}else
-	    ret = PAM_USER_UNKNOWN;
-	memset(resp->resp, 0, strlen(resp->resp));
-	free(resp->resp);
-	free(resp);
+      pam_putenv(pamh, var);
+    }
+#endif
+
+  /* We don't want to inherit this variable.
+   * If we still do, it must have a sane value. */
+  if (getenv("KRBTKFILE") != 0)
+    {
+      char *var = malloc(sizeof(buf));
+      snprintf(var, sizeof(buf), "KRBTKFILE=%s", tkt_string());
+      putenv(var);
+      /* free(var); XXX */
     }
-    return ret;
 }
 
 static int
-auth_su(pam_handle_t *pamh, int flags, char *user, struct pam_conv *conv)
+verify_pass(pam_handle_t *pamh,
+	    const char *name,
+	    const char *inst,
+	    const char *pass)
 {
-    int ret;
-    struct passwd *pw;
-    struct pam_message msg, *pmsg;
-    struct pam_response *resp;
-    char prompt[128];
-    krb_principal pr;
-    
-    pr.realm[0] = 0;
-    ret = pam_get_user(pamh, &user, "login: ");
-    if(ret != PAM_SUCCESS)
-	return ret;
-    
-    pw = getpwuid(getuid());
-    if(strcmp(user, "root") == 0){
-	strlcpy(pr.name, pw->pw_name, sizeof(pr.name));
-	strlcpy(pr.instance, "root", sizeof(pr.instance));
-    }else{
-	strlcpy(pr.name, user, sizeof(pr.name));
-	pr.instance[0] = 0;
+  char realm[REALM_SZ];
+  int ret, krb_verify, old_euid, old_ruid;
+
+  krb_get_lrealm(realm, 1);
+  if (ctrl_on(KRB4_NO_VERIFY))
+    krb_verify = KRB_VERIFY_SECURE_FAIL;
+  else
+    krb_verify = KRB_VERIFY_SECURE;
+  old_ruid = getuid();
+  old_euid = geteuid();
+  setreuid(0, 0);
+  ret = krb_verify_user(name, inst, realm, pass, krb_verify, NULL);
+  pdeb("krb_verify_user(`%s', `%s', `%s', pw, %d, NULL) returns %s",
+       name, inst, realm, krb_verify,
+       krb_get_err_text(ret));
+  setreuid(old_ruid, old_euid);
+  if (getuid() != old_ruid || geteuid() != old_euid)
+    {
+      psyslog(LOG_ALERT , "setreuid(%d, %d) failed at line %d",
+	      old_ruid, old_euid, __LINE__);
+      exit(1);
     }
-    pmsg = &msg;
-    msg.msg_style = PAM_PROMPT_ECHO_OFF;
-    snprintf(prompt, sizeof(prompt), "%s's Password: ", krb_unparse_name(&pr));
-    msg.msg = prompt;
-
-    ret = conv->conv(1, (const struct pam_message**)&pmsg, 
-		     &resp, conv->appdata_ptr);
-    if(ret != PAM_SUCCESS)
-	return ret;
     
+  switch(ret) {
+  case KSUCCESS:
+    return PAM_SUCCESS;
+  case KDC_PR_UNKNOWN:
+    return PAM_USER_UNKNOWN;
+  case SKDC_CANT:
+  case SKDC_RETRY:
+  case RD_AP_TIME:
+    return PAM_AUTHINFO_UNAVAIL;
+  default:
+    return PAM_AUTH_ERR;
+  }
+}
+
+static int
+krb4_auth(pam_handle_t *pamh,
+	  int flags,
+	  const char *name,
+	  const char *inst,
+	  struct pam_conv *conv)
+{
+  struct pam_response *resp;
+  char prompt[128];
+  struct pam_message msg, *pmsg = &msg;
+  int ret;
+
+  if (ctrl_on(KRB4_TRY_FIRST_PASS) || ctrl_on(KRB4_USE_FIRST_PASS))
     {
-	char tkt[1024];
-
-	snprintf(tkt, sizeof(tkt),"%s_%s_to_%s",
-		 TKT_ROOT, pw->pw_name, user);
-	ret = doit(pamh, pr.name, pr.instance, resp->resp, tkt);
-	if(ret == PAM_SUCCESS)
-	    chown(tkt, pw->pw_uid, pw->pw_gid);
-	memset(resp->resp, 0, strlen(resp->resp));
-	free(resp->resp);
-	free(resp);
+      char *pass = 0;
+      ret = pam_get_item(pamh, PAM_AUTHTOK, (void **) &pass);
+      if (ret != PAM_SUCCESS)
+        {
+          psyslog(LOG_ERR , "pam_get_item returned error to get-password");
+          return ret;
+        }
+      else if (pass != 0 && verify_pass(pamh, name, inst, pass) == PAM_SUCCESS)
+	return PAM_SUCCESS;
+      else if (ctrl_on(KRB4_USE_FIRST_PASS))
+	return PAM_AUTHTOK_RECOVERY_ERR;       /* Wrong password! */
+      else
+	/* We tried the first password but it didn't work, cont. */;
     }
+
+  msg.msg_style = PAM_PROMPT_ECHO_OFF;
+  if (*inst == 0)
+    snprintf(prompt, sizeof(prompt), "%s's Password: ", name);
+  else
+    snprintf(prompt, sizeof(prompt), "%s.%s's Password: ", name, inst);
+  msg.msg = prompt;
+
+  ret = conv->conv(1, &pmsg, &resp, conv->appdata_ptr);
+  if (ret != PAM_SUCCESS)
     return ret;
+
+  ret = verify_pass(pamh, name, inst, resp->resp);
+  if (ret == PAM_SUCCESS)
+    {
+      memset(resp->resp, 0, strlen(resp->resp)); /* Erase password! */
+      free(resp->resp);
+      free(resp);
+    }
+  else
+    {
+      pam_set_item(pamh, PAM_AUTHTOK, resp->resp); /* Save password. */
+      /* free(resp->resp); XXX */
+      /* free(resp); XXX */
+    }
+  
+  return ret;
 }
 
 int
-pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv)
+pam_sm_authenticate(pam_handle_t *pamh,
+		    int flags,
+		    int argc,
+		    const char **argv)
 {
-    char *user;
-    int ret;
-    struct pam_conv *conv;
-    ret = pam_get_user(pamh, &user, "login: ");
-    if(ret != PAM_SUCCESS)
-	return ret;
+  char *user;
+  int ret;
+  struct pam_conv *conv;
+  struct passwd *pw;
+  uid_t uid = -1;
+  const char *name, *inst;
+  char realm[REALM_SZ];
+  realm[0] = 0;
+
+  parse_ctrl(argc, argv);
+  ENTRY("pam_sm_authenticate");
+
+  ret = pam_get_user(pamh, &user, "login: ");
+  if (ret != PAM_SUCCESS)
+    return ret;
+
+  if (ctrl_on(KRB4_IGNORE_ROOT) && strcmp(user, "root") == 0)
+    return PAM_AUTHINFO_UNAVAIL;
 
-    ret = pam_get_item(pamh, PAM_CONV, (void*)&conv);
-    if(ret != PAM_SUCCESS)
-	return ret;
+  ret = pam_get_item(pamh, PAM_CONV, (void*)&conv);
+  if (ret != PAM_SUCCESS)
+    return ret;
 
+  pw = getpwnam(user);
+  if (pw != 0)
+    {
+      uid = pw->pw_uid;
+      set_tkt_string(uid);
+    }
     
-    if(getuid() != geteuid())
-	return auth_su(pamh, flags, user, conv);
-    else
-	return auth_login(pamh, flags, user, conv);
+  if (strcmp(user, "root") == 0 && getuid() != 0)
+    {
+      pw = getpwuid(getuid());
+      if (pw != 0)
+	{
+	  name = strdup(pw->pw_name);
+	  inst = "root";
+	}
+    }
+  else
+    {
+      name = user;
+      inst = "";
+    }
+
+  ret = krb4_auth(pamh, flags, name, inst, conv);
+
+  /*
+   * The realm was lost inside krb_verify_user() so we can't simply do
+   * a krb_kuserok() when inst != "".
+   */
+  if (ret == PAM_SUCCESS && inst[0] != 0)
+    {
+      uid_t old_euid = geteuid();
+      uid_t old_ruid = getuid();
+
+      setreuid(0, 0);		/* To read ticket file. */
+      if (krb_get_tf_fullname(tkt_string(), 0, 0, realm) != KSUCCESS)
+	ret = PAM_SERVICE_ERR;
+      else if (krb_kuserok(name, inst, realm, user) != KSUCCESS)
+	{
+	  setreuid(0, uid);	/*  To read ~/.klogin. */
+	  if (krb_kuserok(name, inst, realm, user) != KSUCCESS)
+	    ret = PAM_PERM_DENIED;
+	}
+
+      if (ret != PAM_SUCCESS)
+	{
+	  dest_tkt();		/* Passwd known, ok to kill ticket. */
+	  psyslog(LOG_NOTICE,
+		  "%s.%s@%s is not allowed to log in as %s",
+		  name, inst, realm, user);
+	}
+
+      setreuid(old_ruid, old_euid);
+      if (getuid() != old_ruid || geteuid() != old_euid)
+	{
+	  psyslog(LOG_ALERT , "setreuid(%d, %d) failed at line %d",
+		  old_ruid, old_euid, __LINE__);
+	  exit(1);
+	}
+    }
+
+  if (ret == PAM_SUCCESS)
+    {
+      psyslog(LOG_INFO,
+	      "%s.%s@%s authenticated as user %s",
+	      name, inst, realm, user);
+      if (chown(tkt_string(), uid, -1) == -1)
+	{
+	  dest_tkt();
+	  psyslog(LOG_ALERT , "chown(%s, %d, -1) failed", tkt_string(), uid);
+	  exit(1);
+	}
+    }
+
+  /*
+   * Kludge alert!!! Sun dtlogin unlock screen fails to call
+   * pam_setcred(3) with PAM_REFRESH_CRED after a successful
+   * authentication attempt, sic.
+   *
+   * This hack is designed as a workaround to that problem.
+   */
+  if (ctrl_on(KRB4_REAFSLOG))
+    if (ret == PAM_SUCCESS)
+      pam_sm_setcred(pamh, PAM_REFRESH_CRED, argc, argv);
+  
+  return ret;
 }
 
 int 
 pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
 {
-    return PAM_SUCCESS;
-}
+  parse_ctrl(argc, argv);
+  ENTRY("pam_sm_setcred");
 
+  switch (flags & ~PAM_SILENT) {
+  case 0:
+  case PAM_ESTABLISH_CRED:
+    if (k_hasafs())
+      k_setpag();
+    /* Fall through, fill PAG with credentials below. */
+  case PAM_REINITIALIZE_CRED:
+  case PAM_REFRESH_CRED:
+    if (k_hasafs())
+      {
+	void *user = 0;
+
+	if (pam_get_item(pamh, PAM_USER, &user) == PAM_SUCCESS)
+	  {
+	    struct passwd *pw = getpwnam((char *)user);
+	    if (pw != 0)
+	      krb_afslog_uid_home(/*cell*/ 0,/*realm_hint*/ 0,
+				  pw->pw_uid, pw->pw_dir);
+	  }
+      }
+    break;
+  case PAM_DELETE_CRED:
+    dest_tkt();
+    if (k_hasafs())
+      k_unlog();
+    break;
+  default:
+    psyslog(LOG_ALERT , "pam_sm_setcred: unknown flags 0x%x", flags);
+    break;
+  }
+  
+  return PAM_SUCCESS;
+}
 
 int
 pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv)
 {
-    char *tkt, *var;
-    void *user;
-    const char *homedir = NULL;
-
-    if(pam_get_item (pamh, PAM_USER, &user) == PAM_SUCCESS) {
-	struct passwd *pwd;
+  parse_ctrl(argc, argv);
+  ENTRY("pam_sm_open_session");
 
-	pwd = getpwnam ((char *)user);
-	if (pwd != NULL)
-	    homedir = pwd->pw_dir;
-    }
-
-    pam_get_data(pamh, "KRBTKFILE", (const void**)&tkt);
-    var = malloc(strlen("KRBTKFILE=") + strlen(tkt) + 1);
-    strcpy(var, "KRBTKFILE=");
-    strcat(var, tkt);
-    putenv(var);
-    pam_putenv(pamh, var);
-    if(k_hasafs()){
-	k_setpag();
-	krb_afslog_home(0, 0, homedir);
-    }
-    return PAM_SUCCESS;
+  return PAM_SUCCESS;
 }
 
 
 int
-pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, const char **argv)
+pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, const char**argv)
 {
-    dest_tkt();
-    if(k_hasafs())
-	k_unlog();
-    return PAM_SUCCESS;
+  parse_ctrl(argc, argv);
+  ENTRY("pam_sm_close_session");
+
+  /* This isn't really kosher, but it's handy. */
+  pam_sm_setcred(pamh, PAM_DELETE_CRED, argc, argv);
+
+  return PAM_SUCCESS;
 }
diff --git a/crypto/kerberosIV/lib/auth/pam/pam.conf.add b/crypto/kerberosIV/lib/auth/pam/pam.conf.add
index 42497d2..64a4915 100644
--- a/crypto/kerberosIV/lib/auth/pam/pam.conf.add
+++ b/crypto/kerberosIV/lib/auth/pam/pam.conf.add
@@ -1,8 +1,8 @@
 To enable PAM in dtlogin and /bin/login under SunOS 5.6 apply this patch:
 
 --- /etc/pam.conf.DIST	Mon Jul 20 15:37:46 1998
-+++ /etc/pam.conf	Tue Nov 30 18:47:22 1999
-@@ -4,12 +4,14 @@
++++ /etc/pam.conf	Tue Feb 15 19:39:12 2000
+@@ -4,15 +4,19 @@
  #
  # Authentication management
  #
@@ -17,12 +17,17 @@ To enable PAM in dtlogin and /bin/login under SunOS 5.6 apply this patch:
  dtlogin	auth required 	/usr/lib/security/pam_unix.so.1 
  #
  rsh	auth required	/usr/lib/security/pam_rhosts_auth.so.1
-@@ -24,6 +26,8 @@
++# Reafslog is for dtlogin lock display
++other	auth sufficient	/usr/athena/lib/pam_krb4.so reafslog
+ other	auth required	/usr/lib/security/pam_unix.so.1
+ #
+ # Account management
+@@ -24,6 +28,8 @@
  #
  # Session management
  #
-+dtlogin	session	required	/usr/athena/lib/pam_krb4.so
-+login	session	required	/usr/athena/lib/pam_krb4.so
++dtlogin	session required	/usr/athena/lib/pam_krb4.so
++login	session required	/usr/athena/lib/pam_krb4.so
  other	session required	/usr/lib/security/pam_unix.so.1 
  #
  # Password management
diff --git a/crypto/kerberosIV/lib/auth/sia/Makefile.in b/crypto/kerberosIV/lib/auth/sia/Makefile.in
index 69858bd..a17c341 100644
--- a/crypto/kerberosIV/lib/auth/sia/Makefile.in
+++ b/crypto/kerberosIV/lib/auth/sia/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.30 1999/11/15 10:20:50 assar Exp $
+# $Id: Makefile.in,v 1.30.2.1 2000/06/23 03:20:06 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -57,7 +57,7 @@ Wall:
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
 	-if test "$(LIB)" != ""; then \
-	  $(INSTALL_DATA) -m 0555 $(LIB) $(DESTDIR)$(libdir)/$(LIB) ; \
+	  $(INSTALL_DATA) $(LIB) $(DESTDIR)$(libdir)/$(LIB) ; \
 	fi
 
 uninstall:
diff --git a/crypto/kerberosIV/lib/auth/sia/sia.c b/crypto/kerberosIV/lib/auth/sia/sia.c
index 73cd53e..979bb58 100644
--- a/crypto/kerberosIV/lib/auth/sia/sia.c
+++ b/crypto/kerberosIV/lib/auth/sia/sia.c
@@ -33,7 +33,7 @@
 
 #include "sia_locl.h"
 
-RCSID("$Id: sia.c,v 1.32 1999/10/03 15:49:36 joda Exp $");
+RCSID("$Id: sia.c,v 1.32.2.1 1999/12/20 09:49:30 joda Exp $");
 
 int 
 siad_init(void)
@@ -145,7 +145,7 @@ doauth(SIAENTITY *entity, int pkgind, char *name)
 	
 #ifdef SIA_KRB4
     snprintf(s->ticket, sizeof(s->ticket),
-	     TKT_ROOT "%u_%u", (unsigned)pwd->pw_uid, (unsigned)getpid());
+	     "%s%u_%u", TKT_ROOT, (unsigned)pwd->pw_uid, (unsigned)getpid());
     krb_get_lrealm(realm, 1);
     toname = name;
     toinst = "";
@@ -160,8 +160,8 @@ doauth(SIAENTITY *entity, int pkgind, char *name)
 	    SIA_DEBUG(("DEBUG", "failed to getpwuid(%u)", ouid));
 	    return SIADFAIL;
 	}
-	snprintf(s->ticket, sizeof(s->ticket), TKT_ROOT "_%s_to_%s_%d", 
-		 fpwd->pw_name, pwd->pw_name, getpid());
+	snprintf(s->ticket, sizeof(s->ticket), "%s_%s_to_%s_%d", 
+		 TKT_ROOT, fpwd->pw_name, pwd->pw_name, getpid());
 	if(strcmp(pwd->pw_name, "root") == 0){
 	    toname = fpwd->pw_name;
 	    toinst = pwd->pw_name;
@@ -454,7 +454,7 @@ init_change(sia_collect_func_t *collect, krb_principal *princ)
     if(ret != SIACOLSUCCESS)
 	return SIADFAIL;
     snprintf(tktstring, sizeof(tktstring), 
-	     TKT_ROOT "_cpw_%u", (unsigned)getpid());
+	     "%s_cpw_%u", TKT_ROOT, (unsigned)getpid());
     krb_set_tkt_string(tktstring);
     
     ret = krb_get_pw_in_tkt(princ->name, princ->instance, princ->realm, 
diff --git a/crypto/kerberosIV/lib/com_err/ChangeLog b/crypto/kerberosIV/lib/com_err/ChangeLog
new file mode 100644
index 0000000..ea7a5f6
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/ChangeLog
@@ -0,0 +1,106 @@
+1999-07-03  Assar Westerlund  <assar@sics.se>
+
+	* parse.y (statement): use asprintf
+
+1999-06-13  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.in: make it solaris make vpath-safe
+
+Thu Apr  1 11:13:53 1999  Johan Danielsson  <joda@hella.pdc.kth.se>
+
+	* compile_et.c: use getargs
+
+Sat Mar 20 00:16:30 1999  Assar Westerlund  <assar@sics.se>
+
+	* compile_et.c: static-ize
+
+Thu Mar 18 11:22:13 1999  Johan Danielsson  <joda@hella.pdc.kth.se>
+
+	* Makefile.am: include Makefile.am.common
+
+Tue Mar 16 22:30:05 1999  Assar Westerlund  <assar@sics.se>
+
+	* parse.y: use YYACCEPT instead of return
+
+Sat Mar 13 22:22:56 1999  Assar Westerlund  <assar@sics.se>
+
+	* compile_et.c (generate_h): cast when calling is* to get rid of a
+ 	warning
+
+Thu Mar 11 15:00:51 1999  Johan Danielsson  <joda@hella.pdc.kth.se>
+
+	* parse.y: prototype for error_message
+
+Sun Nov 22 10:39:02 1998  Assar Westerlund  <assar@sics.se>
+
+	* compile_et.h: include ctype and roken
+
+	* compile_et.c: include err.h
+	(generate_h): remove unused variable
+
+	* Makefile.in (WFLAGS): set
+
+Fri Nov 20 06:58:59 1998  Assar Westerlund  <assar@sics.se>
+
+	* lex.l: undef ECHO to work around AIX lex bug
+
+Sun Sep 27 02:23:59 1998  Johan Danielsson  <joda@hella.pdc.kth.se>
+
+	* com_err.c (error_message): try to pass code to strerror, to see
+ 	if it might be an errno code (this if broken, but some MIT code
+ 	seems to expect this behaviour)
+
+Sat Sep 26 17:42:39 1998  Johan Danielsson  <joda@hella.pdc.kth.se>
+
+	* compile_et.c: <foo_err.h> -> "foo_err.h"
+
+Tue Jun 30 17:17:36 1998  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.in: add str{cpy,cat}_truncate
+
+Mon May 25 05:24:39 1998  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.in (clean): try to remove shared library debris
+
+Sun Apr 19 09:50:17 1998  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.in: add symlink magic for linux
+
+Sun Apr  5 09:22:11 1998  Assar Westerlund  <assar@sics.se>
+
+	* parse.y: define alloca to malloc in case we're using bison but
+ 	don't have alloca
+
+Tue Mar 24 05:13:01 1998  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.in: link with snprintf (From Derrick J Brashear
+ 	<shadow@dementia.org>)
+
+Fri Feb 27 05:01:42 1998  Assar Westerlund  <assar@sics.se>
+
+	* parse.y: initialize ec->next
+
+Thu Feb 26 02:22:25 1998  Assar Westerlund  <assar@sics.se>
+
+	* Makefile.am: @LEXLIB@
+
+Sat Feb 21 15:18:54 1998  assar westerlund  <assar@sics.se>
+
+	* Makefile.in: set YACC and LEX
+
+Tue Feb 17 22:20:27 1998  Bjoern Groenvall  <bg@sics.se>
+
+	* com_right.h: Change typedefs so that one may mix MIT compile_et
+ 	generated code with krb4 dito.
+
+Tue Feb 17 16:30:55 1998  Johan Danielsson  <joda@emma.pdc.kth.se>
+
+	* compile_et.c (generate): Always return a value.
+
+	* parse.y: Files don't have to end with `end'.
+
+Mon Feb 16 16:09:20 1998  Johan Danielsson  <joda@emma.pdc.kth.se>
+
+	* lex.l (getstring): Replace getc() with input().
+
+	* Makefile.am: Fixes for new compile_et.
diff --git a/crypto/kerberosIV/lib/com_err/Makefile.am b/crypto/kerberosIV/lib/com_err/Makefile.am
new file mode 100644
index 0000000..2c7525b
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/Makefile.am
@@ -0,0 +1,24 @@
+# $Id: Makefile.am,v 1.23 1999/04/09 18:26:55 assar Exp $
+
+include $(top_srcdir)/Makefile.am.common
+
+YFLAGS = -d
+
+lib_LTLIBRARIES = libcom_err.la
+libcom_err_la_LDFLAGS = -version-info 1:0:0
+
+bin_PROGRAMS = compile_et
+
+include_HEADERS = com_err.h com_right.h
+
+compile_et_SOURCES = compile_et.c compile_et.h parse.y lex.l
+
+libcom_err_la_SOURCES = error.c com_err.c roken_rename.h
+
+CLEANFILES = lex.c parse.c parse.h
+
+$(compile_et_OBJECTS): parse.h
+
+compile_et_LDADD = \
+	$(LIB_roken) \
+	$(LEXLIB)
diff --git a/crypto/kerberosIV/lib/com_err/Makefile.in b/crypto/kerberosIV/lib/com_err/Makefile.in
new file mode 100644
index 0000000..883b522
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/Makefile.in
@@ -0,0 +1,151 @@
+#
+# $Id: Makefile.in,v 1.30.2.1 2000/10/10 14:34:33 assar Exp $
+#
+
+SHELL = /bin/sh
+
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+CC = @CC@
+LINK = @LINK@
+AR = ar
+RANLIB = @RANLIB@
+LN_S = @LN_S@
+DEFS = @DEFS@ -DROKEN_RENAME
+CFLAGS = @CFLAGS@ $(WFLAGS)
+WFLAGS = @WFLAGS@
+LD_FLAGS = @LD_FLAGS@
+EXECSUFFIX=@EXECSUFFIX@
+
+YACC = @YACC@
+LEX = @LEX@
+
+INSTALL = @INSTALL@
+INSTALL_DATA	= @INSTALL_DATA@
+MKINSTALLDIRS = @top_srcdir@/mkinstalldirs
+
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+libdir = @libdir@
+bindir = @bindir@
+includedir = @includedir@
+
+PICFLAGS = @PICFLAGS@
+ 
+LIB_DEPS = @lib_deps_yes@ -lc
+build_symlink_command   = @build_symlink_command@
+#install_symlink_command = @install_symlink_command@
+install_symlink_command = @true
+
+LIBNAME = $(LIBPREFIX)com_err
+#LIBEXT = @LIBEXT@ Always build archive library!
+LIBEXT = a
+SHLIBEXT = @SHLIBEXT@
+LIBPREFIX = @LIBPREFIX@
+LDSHARED = @LDSHARED@
+LIB = $(LIBNAME).$(LIBEXT)
+lib_LIBRARIES = $(LIBNAME).$(LIBEXT)
+bin_PROGRAMS = compile_et$(EXECSUFFIX)
+include_HEADERS = com_right.h com_err.h
+
+SOURCES = error.c com_err.c compile_et.c
+OBJECTS = error.o com_err.o $(LIBADD)
+EXTRA_SOURCES =
+LIBADD =
+
+all: $(lib_LIBRARIES) $(bin_PROGRAMS) $(include_HEADERS)
+
+Wall:
+	make CFLAGS="-g -Wall -Wno-comment -Wmissing-prototypes -Wmissing-declarations -D__USE_FIXED_PROTOTYPES__"
+
+.c.o:
+	$(CC) -c $(DEFS) -I../../include -I. -I$(srcdir) $(CFLAGS) $(CPPFLAGS) $(PICFLAGS) $<
+
+install: all
+	$(MKINSTALLDIRS) $(DESTDIR)$(includedir)
+	@for i in $(include_HEADERS); do \
+	f=`basename $$i`; \
+	if test -f "$(srcdir)/$$f" ; then x="$(srcdir)/$$f"; \
+	else x="$$f"; fi ;\
+	echo "$(INSTALL_DATA) $$x $(DESTDIR)$(includedir)/$$f" ;\
+	$(INSTALL_DATA) $$x $(DESTDIR)$(includedir)/$$f ; done
+
+	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
+	@for i in $(lib_LIBRARIES); do \
+	echo "$(INSTALL) -m 0555 $$i $(DESTDIR)$(libdir)/$$i" ;\
+	$(INSTALL) -m 0555 $$i $(DESTDIR)$(libdir)/$$i ; done
+	@install_symlink_command@
+
+	$(MKINSTALLDIRS) $(DESTDIR)$(bindir)
+	@for i in $(bin_PROGRAMS); do \
+	echo "$(INSTALL) -m 0555 $$i $(DESTDIR)$(bindir)/$$i" ;\
+	$(INSTALL) -m 0555 $$i $(DESTDIR)$(bindir)/$$i ; done
+
+uninstall:
+	@for i in $(include_HEADERS); do \
+	f=`basename $$i`; \
+	echo "rm -f $(DESTDIR)$(includedir)/$$f" ;\
+	rm -f $(DESTDIR)$(includedir)/$$f ; done
+
+	@for i in $(lib_LIBRARIES); do \
+	echo "rm -f $(DESTDIR)$(libdir)/$$i" ;\
+	rm -f $(DESTDIR)$(libdir)/$$i ; done
+
+	@for i in $(bin_PROGRAMS); do \
+	echo "rm -f $(DESTDIR)$(bindir)/$$i" ;\
+	rm -f $(DESTDIR)$(bindir)/$$i ; done
+
+TAGS: $(SOURCES)
+	etags $(SOURCES)
+
+clean:
+	rm -f $(LIB) *.o *.a *.so *.so.* so_locations \
+	krb_err.c krb_err.h parse.h parse.c lex.c \
+	$(lib_LIBRARIES) $(bin_PROGRAMS) $(EXTRA_SOURCES)
+
+mostlyclean: clean
+
+distclean: clean
+	rm -f Makefile *.tab.c *~
+
+realclean: distclean
+	rm -f TAGS
+
+$(LIBNAME).a: $(OBJECTS)
+	rm -f $@
+	$(AR) cr $@ $(OBJECTS)
+	-$(RANLIB) $@
+
+$(LIBNAME).$(SHLIBEXT): $(OBJECTS)
+	rm -f $@
+	$(LDSHARED) -o $@ $(OBJECTS) $(LIB_DEPS)
+	@build_symlink_command@
+
+COBJ = compile_et.o parse.o lex.o
+
+$(COBJ): parse.h
+
+compile_et$(EXECSUFFIX): $(COBJ)
+	$(LINK) $(CFLAGS) -o $@ $(COBJ) -L../roken -lroken
+
+parse.c: parse.h
+parse.h: $(srcdir)/parse.y
+	$(YACC) -d $(srcdir)/parse.y
+	mv -f y.tab.h parse.h
+	mv -f y.tab.c parse.c
+
+lex.c: $(srcdir)/lex.l
+	$(LEX) $(srcdir)/lex.l
+	mv -f lex.yy.c lex.c
+
+snprintf.c:
+	$(LN_S) $(srcdir)/../roken/snprintf.c .
+
+strlcat.c:
+	$(LN_S) $(srcdir)/../roken/strlcat.c .
+
+strlcpy.c:
+	$(LN_S) $(srcdir)/../roken/strlcpy.c .
+
+.PHONY: all Wall install uninstall clean mostlyclean distclean realclean
diff --git a/crypto/kerberosIV/lib/com_err/com_err.c b/crypto/kerberosIV/lib/com_err/com_err.c
new file mode 100644
index 0000000..d945d12
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/com_err.c
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+RCSID("$Id: com_err.c,v 1.14.2.1 2000/06/23 03:22:13 assar Exp $");
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <roken.h>
+#include "com_err.h"
+
+struct et_list *_et_list = NULL;
+
+
+const char *
+error_message (long code)
+{
+    static char msg[128];
+    const char *p = com_right(_et_list, code);
+    if (p == NULL)
+	p = strerror(code);
+    if (p != NULL && *p != '\0') {
+	strncpy(msg, p, sizeof(msg) - 1);
+	msg[sizeof(msg) - 1] = 0;
+    } else 
+	sprintf(msg, "Unknown error %ld", code);
+    return msg;
+}
+
+int
+init_error_table(const char **msgs, long base, int count)
+{
+    initialize_error_table_r(&_et_list, msgs, count, base);
+    return 0;
+}
+
+static void
+default_proc (const char *whoami, long code, const char *fmt, va_list args)
+{
+    if (whoami)
+      fprintf(stderr, "%s: ", whoami);
+    if (code)
+      fprintf(stderr, "%s ", error_message(code));
+    if (fmt)
+      vfprintf(stderr, fmt, args);
+    fprintf(stderr, "\r\n");	/* ??? */
+}
+
+static errf com_err_hook = default_proc;
+
+void 
+com_err_va (const char *whoami, 
+	    long code, 
+	    const char *fmt, 
+	    va_list args)
+{
+    (*com_err_hook) (whoami, code, fmt, args);
+}
+
+void
+com_err (const char *whoami,
+	 long code,
+	 const char *fmt, 
+	 ...)
+{
+    va_list ap;
+    va_start(ap, fmt);
+    com_err_va (whoami, code, fmt, ap);
+    va_end(ap);
+}
+
+errf
+set_com_err_hook (errf new)
+{
+    errf old = com_err_hook;
+
+    if (new)
+	com_err_hook = new;
+    else
+	com_err_hook = default_proc;
+    
+    return old;
+}
+
+errf
+reset_com_err_hook (void) 
+{
+    return set_com_err_hook(NULL);
+}
+
+#define ERRCODE_RANGE   8       /* # of bits to shift table number */
+#define BITS_PER_CHAR   6       /* # bits to shift per character in name */
+
+static const char char_set[] =
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
+
+static char buf[6];
+
+const char *
+error_table_name(int num)
+{
+    int ch;
+    int i;
+    char *p;
+
+    /* num = aa aaa abb bbb bcc ccc cdd ddd d?? ??? ??? */
+    p = buf;
+    num >>= ERRCODE_RANGE;
+    /* num = ?? ??? ??? aaa aaa bbb bbb ccc ccc ddd ddd */
+    num &= 077777777;
+    /* num = 00 000 000 aaa aaa bbb bbb ccc ccc ddd ddd */
+    for (i = 4; i >= 0; i--) {
+        ch = (num >> BITS_PER_CHAR * i) & ((1 << BITS_PER_CHAR) - 1);
+        if (ch != 0)
+            *p++ = char_set[ch-1];
+    }
+    *p = '\0';
+    return(buf);
+}
diff --git a/crypto/kerberosIV/lib/com_err/com_err.h b/crypto/kerberosIV/lib/com_err/com_err.h
new file mode 100644
index 0000000..06373de
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/com_err.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+/* $Id: com_err.h,v 1.4.2.1 2000/06/23 03:23:05 assar Exp $ */
+
+/* MIT compatible com_err library */
+
+#ifndef __COM_ERR_H__
+#define __COM_ERR_H__
+
+#include <com_right.h>
+
+typedef void (*errf) __P((const char *, long, const char *, va_list));
+
+const char * error_message __P((long));
+int init_error_table __P((const char**, long, int));
+
+void com_err_va __P((const char *, long, const char *, va_list));
+void com_err __P((const char *, long, const char *, ...));
+
+errf set_com_err_hook __P((errf));
+errf reset_com_err_hook __P((void));
+
+const char *error_table_name  __P((int num));
+
+#endif /* __COM_ERR_H__ */
diff --git a/crypto/kerberosIV/lib/com_err/com_right.h b/crypto/kerberosIV/lib/com_err/com_right.h
new file mode 100644
index 0000000..e8c7488
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/com_right.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+/* $Id: com_right.h,v 1.9.2.1 2000/06/23 03:23:44 assar Exp $ */
+
+#ifndef __COM_RIGHT_H__
+#define __COM_RIGHT_H__
+
+#ifdef __STDC__
+#include <stdarg.h>
+#endif
+
+#ifndef __P
+#ifdef __STDC__
+#define __P(X) X
+#else
+#define __P(X) ()
+#endif
+#endif
+
+struct error_table {
+    char const * const * msgs;
+    long base;
+    int n_msgs;
+};
+struct et_list {
+    struct et_list *next;
+    struct error_table *table;
+};
+extern struct et_list *_et_list;
+
+const char *com_right __P((struct et_list *list, long code));
+void initialize_error_table_r __P((struct et_list **, const char **, int, long);)
+void free_error_table __P((struct et_list *));
+
+#endif /* __COM_RIGHT_H__ */
diff --git a/crypto/kerberosIV/lib/com_err/compile_et.c b/crypto/kerberosIV/lib/com_err/compile_et.c
new file mode 100644
index 0000000..f982dcd
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/compile_et.c
@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#undef ROKEN_RENAME
+#include "compile_et.h"
+#include <getarg.h>
+
+RCSID("$Id: compile_et.c,v 1.13 1999/12/02 16:58:38 joda Exp $");
+
+#include <roken.h>
+#include <err.h>
+#include "parse.h"
+
+int numerror;
+extern FILE *yyin;
+
+extern void yyparse(void);
+
+long base;
+int number;
+char *prefix;
+char *id_str;
+
+char name[128];
+char Basename[128];
+
+#ifdef YYDEBUG
+extern int yydebug = 1;
+#endif
+
+char *filename;
+char hfn[128];
+char cfn[128];
+
+struct error_code *codes = NULL;
+
+static int
+generate_c(void)
+{
+    int n;
+    struct error_code *ec;
+
+    FILE *c_file = fopen(cfn, "w");
+    if(c_file == NULL)
+	return 1;
+
+    fprintf(c_file, "/* Generated from %s */\n", filename);
+    if(id_str) 
+	fprintf(c_file, "/* %s */\n", id_str);
+    fprintf(c_file, "\n");
+    fprintf(c_file, "#include <stddef.h>\n");
+    fprintf(c_file, "#include <com_err.h>\n");
+    fprintf(c_file, "#include \"%s\"\n", hfn);
+    fprintf(c_file, "\n");
+
+    fprintf(c_file, "static const char *text[] = {\n");
+
+    for(ec = codes, n = 0; ec; ec = ec->next, n++) {
+	while(n < ec->number) {
+	    fprintf(c_file, "\t/* %03d */ \"Reserved %s error (%d)\",\n",
+		    n, name, n);
+	    n++;
+	    
+	}
+	fprintf(c_file, "\t/* %03d */ \"%s\",\n", ec->number, ec->string);
+    }
+
+    fprintf(c_file, "\tNULL\n");
+    fprintf(c_file, "};\n");
+    fprintf(c_file, "\n");
+    fprintf(c_file, 
+	    "void initialize_%s_error_table_r(struct et_list **list)\n", 
+	    name);
+    fprintf(c_file, "{\n");
+    fprintf(c_file, 
+	    "    initialize_error_table_r(list, text, "
+	    "%s_num_errors, ERROR_TABLE_BASE_%s);\n", name, name);
+    fprintf(c_file, "}\n");
+    fprintf(c_file, "\n");
+    fprintf(c_file, "void initialize_%s_error_table(void)\n", name);
+    fprintf(c_file, "{\n");
+    fprintf(c_file,
+	    "    init_error_table(text, ERROR_TABLE_BASE_%s, "
+	    "%s_num_errors);\n", name, name);
+    fprintf(c_file, "}\n");
+
+    fclose(c_file);
+    return 0;
+}
+
+static int
+generate_h(void)
+{
+    struct error_code *ec;
+    char fn[128];
+    FILE *h_file = fopen(hfn, "w");
+    char *p;
+
+    if(h_file == NULL)
+	return 1;
+
+    snprintf(fn, sizeof(fn), "__%s__", hfn);
+    for(p = fn; *p; p++)
+	if(!isalnum((unsigned char)*p))
+	    *p = '_';
+    
+    fprintf(h_file, "/* Generated from %s */\n", filename);
+    if(id_str) 
+	fprintf(h_file, "/* %s */\n", id_str);
+    fprintf(h_file, "\n");
+    fprintf(h_file, "#ifndef %s\n", fn);
+    fprintf(h_file, "#define %s\n", fn);
+    fprintf(h_file, "\n");
+    fprintf(h_file, "#include <com_right.h>\n");
+    fprintf(h_file, "\n");
+    fprintf(h_file, 
+	    "void initialize_%s_error_table_r(struct et_list **);\n",
+	    name);
+    fprintf(h_file, "\n");
+    fprintf(h_file, "void initialize_%s_error_table(void);\n", name);
+    fprintf(h_file, "#define init_%s_err_tbl initialize_%s_error_table\n", 
+	    name, name);
+    fprintf(h_file, "\n");
+    fprintf(h_file, "typedef enum %s_error_number{\n", name);
+    fprintf(h_file, "\tERROR_TABLE_BASE_%s = %ld,\n", name, base);
+    fprintf(h_file, "\t%s_err_base = %ld,\n", name, base);
+
+    for(ec = codes; ec; ec = ec->next) {
+	fprintf(h_file, "\t%s = %ld,\n", ec->name, base + ec->number);
+    }
+
+    fprintf(h_file, "\t%s_num_errors = %d\n", name, number);
+    fprintf(h_file, "} %s_error_number;\n", name);
+    fprintf(h_file, "\n");
+    fprintf(h_file, "#endif /* %s */\n", fn);
+
+
+    fclose(h_file);
+    return 0;
+}
+
+static int
+generate(void)
+{
+    return generate_c() || generate_h();
+}
+
+int version_flag;
+int help_flag;
+struct getargs args[] = {
+    { "version", 0, arg_flag, &version_flag },
+    { "help", 0, arg_flag, &help_flag }
+};
+int num_args = sizeof(args) / sizeof(args[0]);
+
+static void
+usage(int code)
+{
+    arg_printusage(args, num_args, NULL, "error-table");
+    exit(code);
+}
+
+int
+main(int argc, char **argv)
+{
+    char *p;
+    int optind = 0;
+
+    set_progname(argv[0]);
+    if(getarg(args, num_args, argc, argv, &optind))
+	usage(1);
+    if(help_flag)
+	usage(0);
+    if(version_flag) {
+	print_version(NULL);
+	exit(0);
+    }
+
+    if(optind == argc) 
+	usage(1);
+    filename = argv[optind];
+    yyin = fopen(filename, "r");
+    if(yyin == NULL)
+	err(1, "%s", filename);
+	
+    
+    p = strrchr(filename, '/');
+    if(p)
+	p++;
+    else
+	p = filename;
+    strncpy(Basename, p, sizeof(Basename));
+    Basename[sizeof(Basename) - 1] = '\0';
+    
+    Basename[strcspn(Basename, ".")] = '\0';
+    
+    snprintf(hfn, sizeof(hfn), "%s.h", Basename);
+    snprintf(cfn, sizeof(cfn), "%s.c", Basename);
+    
+    yyparse();
+    if(numerror)
+	return 1;
+
+    return generate();
+}
diff --git a/crypto/kerberosIV/lib/com_err/compile_et.h b/crypto/kerberosIV/lib/com_err/compile_et.h
new file mode 100644
index 0000000..e9c5e7b
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/compile_et.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 1998 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+/* $Id: compile_et.h,v 1.4 1999/12/02 16:58:38 joda Exp $ */
+
+#ifndef __COMPILE_ET_H__
+#define __COMPILE_ET_H__
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <ctype.h>
+
+#include <roken.h>
+
+extern long base;
+extern int number;
+extern char *prefix;
+extern char name[128];
+extern char *id_str;
+extern char *filename;
+extern int numerror;
+
+struct error_code {
+    unsigned number;
+    char *name;
+    char *string;
+    struct error_code *next, **tail;
+};
+
+extern struct error_code *codes;
+
+#define APPEND(L, V) 				\
+do {						\
+    if((L) == NULL) {				\
+	(L) = (V);				\
+	(L)->tail = &(V)->next;			\
+	(L)->next = NULL;			\
+    }else{					\
+	*(L)->tail = (V);			\
+	(L)->tail = &(V)->next;			\
+    }						\
+}while(0)
+
+#endif /* __COMPILE_ET_H__ */
diff --git a/crypto/kerberosIV/lib/com_err/error.c b/crypto/kerberosIV/lib/com_err/error.c
new file mode 100644
index 0000000..d122007
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/error.c
@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 1997, 1998 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+RCSID("$Id: error.c,v 1.14 1999/12/02 16:58:38 joda Exp $");
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <com_right.h>
+
+const char *
+com_right(struct et_list *list, long code)
+{
+    struct et_list *p;
+    for (p = list; p; p = p->next) {
+	if (code >= p->table->base && code < p->table->base + p->table->n_msgs)
+	    return p->table->msgs[code - p->table->base];
+    }
+    return NULL;
+}
+
+struct foobar {
+    struct et_list etl;
+    struct error_table et;
+};
+
+void
+initialize_error_table_r(struct et_list **list, 
+			 const char **messages, 
+			 int num_errors,
+			 long base)
+{
+    struct et_list *et;
+    struct foobar *f;
+    for (et = *list; et; et = et->next)
+        if (et->table->msgs == messages)
+            return;
+    f = malloc(sizeof(*f));
+    if (f == NULL)
+        return;
+    et = &f->etl;
+    et->table = &f->et;
+    et->table->msgs = messages;
+    et->table->n_msgs = num_errors;
+    et->table->base = base;
+    et->next = *list;
+    *list = et;
+}
+			
+
+void
+free_error_table(struct et_list *et)
+{
+    while(et){
+	struct et_list *p = et;
+	et = et->next;
+	free(p);
+    }
+}
diff --git a/crypto/kerberosIV/lib/com_err/lex.l b/crypto/kerberosIV/lib/com_err/lex.l
new file mode 100644
index 0000000..f5ee60c
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/lex.l
@@ -0,0 +1,122 @@
+%{
+/*
+ * Copyright (c) 1998 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+/*
+ * This is to handle the definition of this symbol in some AIX
+ * headers, which will conflict with the definition that lex will
+ * generate for it.  It's only a problem for AIX lex.
+ */
+
+#undef ECHO
+
+#include "compile_et.h"
+#include "parse.h"
+
+RCSID("$Id: lex.l,v 1.5 1999/12/02 16:58:38 joda Exp $");
+
+static unsigned lineno = 1;
+void error_message(char *, ...);
+int getstring(void);
+
+%}
+
+
+%%
+et			{ return ET; }
+error_table		{ return ET; }
+ec			{ return EC; }
+error_code		{ return EC; }
+prefix			{ return PREFIX; }
+index			{ return INDEX; }
+id			{ return ID; }
+end			{ return END; }
+[0-9]+			{ yylval.number = atoi(yytext); return NUMBER; }
+#[^\n]*			;
+[ \t]			;
+\n			{ lineno++; }
+\"			{ return getstring(); }
+[a-zA-Z0-9_]+		{ yylval.string = strdup(yytext); return STRING; }
+.			{ return *yytext; }
+%%
+
+#ifndef yywrap /* XXX */
+int
+yywrap () 
+{
+     return 1;
+}
+#endif
+
+int
+getstring(void)
+{
+    char x[128];
+    int i = 0;
+    int c;
+    int quote = 0;
+    while((c = input()) != EOF){
+	if(quote) {
+	    x[i++] = c;
+	    quote = 0;
+	    continue;
+	}
+	if(c == '\n'){
+	    error_message("unterminated string");
+	    lineno++;
+	    break;
+	}
+	if(c == '\\'){
+	    quote++;
+	    continue;
+	}
+	if(c == '\"')
+	    break;
+	x[i++] = c;
+    }
+    x[i] = '\0';
+    yylval.string = strdup(x);
+    return STRING;
+}
+
+void
+error_message (char *format, ...)
+{
+     va_list args;
+
+     va_start (args, format);
+     fprintf (stderr, "%s:%d:", filename, lineno);
+     vfprintf (stderr, format, args);
+     va_end (args);
+     numerror++;
+}
diff --git a/crypto/kerberosIV/lib/com_err/parse.y b/crypto/kerberosIV/lib/com_err/parse.y
new file mode 100644
index 0000000..addf772
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/parse.y
@@ -0,0 +1,166 @@
+%{
+/*
+ * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "compile_et.h"
+RCSID("$Id: parse.y,v 1.10 1999/12/02 16:58:38 joda Exp $");
+
+void yyerror (char *s);
+long name2number(const char *str);
+void error_message(char *, ...);
+
+extern char *yytext;
+
+/* This is for bison */
+
+#if !defined(alloca) && !defined(HAVE_ALLOCA)
+#define alloca(x) malloc(x)
+#endif
+
+%}
+
+%union {
+  char *string;
+  int number;
+}
+
+%token ET INDEX PREFIX EC ID END
+%token <string> STRING
+%token <number> NUMBER
+
+%%
+
+file		: /* */ 
+		| header statements
+		;
+
+header		: id et
+		| et
+		;
+
+id		: ID STRING
+		{
+		    id_str = $2;
+		}
+		;
+
+et		: ET STRING
+		{
+		    base = name2number($2);
+		    strncpy(name, $2, sizeof(name));
+		    name[sizeof(name) - 1] = '\0';
+		    free($2);
+		}
+		| ET STRING STRING
+		{
+		    base = name2number($2);
+		    strncpy(name, $3, sizeof(name));
+		    name[sizeof(name) - 1] = '\0';
+		    free($2);
+		    free($3);
+		}
+		;
+
+statements	: statement
+		| statements statement
+		;
+
+statement	: INDEX NUMBER 
+		{
+			number = $2;
+		}
+		| PREFIX STRING
+		{
+		    prefix = realloc(prefix, strlen($2) + 2);
+		    strcpy(prefix, $2);
+		    strcat(prefix, "_");
+		    free($2);
+		}
+		| PREFIX
+		{
+		    prefix = realloc(prefix, 1);
+		    *prefix = '\0';
+		}
+		| EC STRING ',' STRING
+		{
+		    struct error_code *ec = malloc(sizeof(*ec));
+
+		    ec->next = NULL;
+		    ec->number = number;
+		    if(prefix && *prefix != '\0') {
+			asprintf (&ec->name, "%s%s", prefix, $2);
+			free($2);
+		    } else
+			ec->name = $2;
+		    ec->string = $4;
+		    APPEND(codes, ec);
+		    number++;
+		}
+		| END
+		{
+			YYACCEPT;
+		}
+		;
+
+%%
+
+long
+name2number(const char *str)
+{
+    const char *p;
+    long base = 0;
+    const char *x = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+	"abcdefghijklmnopqrstuvwxyz0123456789_";
+    if(strlen(str) > 4) {
+	yyerror("table name too long");
+	return 0;
+    }
+    for(p = str; *p; p++){
+	char *q = strchr(x, *p);
+	if(q == NULL) {
+	    yyerror("invalid character in table name");
+	    return 0;
+	}
+	base = (base << 6) + (q - x) + 1;
+    }
+    base <<= 8;
+    if(base > 0x7fffffff)
+	base = -(0xffffffff - base + 1);
+    return base;
+}
+
+void
+yyerror (char *s)
+{
+     error_message ("%s\n", s);
+}
diff --git a/crypto/kerberosIV/lib/com_err/roken_rename.h b/crypto/kerberosIV/lib/com_err/roken_rename.h
new file mode 100644
index 0000000..173c9a7
--- /dev/null
+++ b/crypto/kerberosIV/lib/com_err/roken_rename.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 1998 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+/* $Id: roken_rename.h,v 1.3 1999/12/02 16:58:38 joda Exp $ */
+
+#ifndef __roken_rename_h__
+#define __roken_rename_h__
+
+#endif /* __roken_rename_h__ */
diff --git a/crypto/kerberosIV/lib/kadm/Makefile.in b/crypto/kerberosIV/lib/kadm/Makefile.in
index ba97c5d..7f610c0 100644
--- a/crypto/kerberosIV/lib/kadm/Makefile.in
+++ b/crypto/kerberosIV/lib/kadm/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.47 1998/10/13 16:50:44 joda Exp $
+# $Id: Makefile.in,v 1.47.4.1 2000/06/23 03:20:01 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -11,6 +11,7 @@ CC = @CC@
 LINK = @LINK@
 AR = ar
 RANLIB = @RANLIB@
+CP = cp
 LN_S = @LN_S@
 DEFS = @DEFS@ -DROKEN_RENAME
 CFLAGS = @CFLAGS@ $(WFLAGS)
@@ -66,7 +67,7 @@ Wall:
 
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
-	$(INSTALL_DATA) -m 0555 $(LIB) $(DESTDIR)$(libdir)/$(LIB)
+	$(INSTALL_DATA)  $(LIB) $(DESTDIR)$(libdir)/$(LIB)
 	@install_symlink_command@
 	$(MKINSTALLDIRS) $(DESTDIR)$(includedir)
 	@for i in $(inc_DATA); do \
@@ -117,8 +118,8 @@ roken_rename.h:
 all-local: $(inc_DATA)
 	@for i in $(inc_DATA); do \
 		if cmp -s  $$i $(idir)/$$i 2> /dev/null ; then :; else\
-			echo " $(INSTALL_DATA) $$i $(idir)/$$i"; \
-			$(INSTALL_DATA) $$i $(idir)/$$i; \
+			echo " $(CP) $$i $(idir)/$$i"; \
+			$(CP) $$i $(idir)/$$i; \
 		fi ; \
 	done
 
diff --git a/crypto/kerberosIV/lib/kafs/ChangeLog b/crypto/kerberosIV/lib/kafs/ChangeLog
index c9cd032..43e93f6 100644
--- a/crypto/kerberosIV/lib/kafs/ChangeLog
+++ b/crypto/kerberosIV/lib/kafs/ChangeLog
@@ -1,3 +1,13 @@
+2000-03-20  Assar Westerlund  <assar@sics.se>
+
+	* afssysdefs.h: make versions later than 5.7 of solaris also use
+	73
+
+2000-03-13  Assar Westerlund  <assar@sics.se>
+
+	* afssysdefs.h: add 230 for MacOS X per information from
+	<warner.c@apple.com>
+
 1999-11-22  Assar Westerlund  <assar@sics.se>
 
 	* afskrb5.c (afslog_uid_int): handle d->realm == NULL
diff --git a/crypto/kerberosIV/lib/kafs/Makefile.in b/crypto/kerberosIV/lib/kafs/Makefile.in
index cefca29..1a60bf7 100644
--- a/crypto/kerberosIV/lib/kafs/Makefile.in
+++ b/crypto/kerberosIV/lib/kafs/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.50 1999/09/16 20:41:46 assar Exp $
+# $Id: Makefile.in,v 1.50.2.2 2000/12/07 16:44:12 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -58,8 +58,8 @@ Wall:
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
 	@for i in $(LIB); do \
-	echo "$(INSTALL) -m 0555 $$i $(DESTDIR)$(libdir)/$$i" ;\
-	$(INSTALL) -m 0555 $$i $(DESTDIR)$(libdir)/$$i ; done
+	echo "$(INSTALL)  $$i $(DESTDIR)$(libdir)/$$i" ;\
+	$(INSTALL)  $$i $(DESTDIR)$(libdir)/$$i ; done
 	@install_symlink_command@
 
 uninstall:
@@ -83,13 +83,17 @@ distclean: clean
 realclean: distclean
 	rm -f TAGS
 
-$(LIBNAME).a: $(OBJECTS)
+$(LIBNAME)_pic.a: $(OBJECTS)
 	rm -f $@
 	$(AR) cr $@ $(OBJECTS)
 	-$(RANLIB) $@
 
+$(LIBNAME).a: $(OBJECTS)
+	rm -f $@
+	$(AR) cr $@ $(OBJECTS)
+	-$(RANLIB) $@
 
-$(LIBNAME).$(SHLIBEXT): $(OBJECTS)
+$(LIBNAME).$(SHLIBEXT): $(OBJECTS) $(LIBNAME)_pic.a
 	rm -f $@
 	$(LDSHARED) -o $@ $(OBJECTS) $(LIB_DEPS)
 	@build_symlink_command@
diff --git a/crypto/kerberosIV/lib/kafs/afskrb.c b/crypto/kerberosIV/lib/kafs/afskrb.c
index 805750d..ccfecb7 100644
--- a/crypto/kerberosIV/lib/kafs/afskrb.c
+++ b/crypto/kerberosIV/lib/kafs/afskrb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,7 @@
 
 #include "kafs_locl.h"
 
-RCSID("$Id: afskrb.c,v 1.13 1999/12/02 16:58:39 joda Exp $");
+RCSID("$Id: afskrb.c,v 1.13.2.1 2000/06/23 03:26:53 assar Exp $");
 
 struct krb_kafs_data {
     const char *realm;
@@ -69,13 +69,9 @@ afslog_uid_int(kafs_data *data,
 	return _kafs_afslog_all_local_cells (data, uid, homedir);
 
     /* Extract realm from ticket file. */
-    {
-        char name[ANAME_SZ], inst[INST_SZ];
-
-	ret = krb_get_default_principal(name, inst, realm);
-	if (ret != KSUCCESS)
-	    return ret;
-    }
+    ret = krb_get_tf_fullname(tkt_string(), NULL, NULL, realm);
+    if (ret != KSUCCESS)
+	return ret;
 
     ret = _kafs_get_cred(data, cell, realm_hint, realm, &c);
     
diff --git a/crypto/kerberosIV/lib/kafs/afssys.c b/crypto/kerberosIV/lib/kafs/afssys.c
index d49a65a..a45f445 100644
--- a/crypto/kerberosIV/lib/kafs/afssys.c
+++ b/crypto/kerberosIV/lib/kafs/afssys.c
@@ -33,7 +33,7 @@
 
 #include "kafs_locl.h"
 
-RCSID("$Id: afssys.c,v 1.65 1999/12/02 16:58:40 joda Exp $");
+RCSID("$Id: afssys.c,v 1.65.2.1 2000/06/23 03:27:23 assar Exp $");
 
 int _kafs_debug; /* this should be done in a better way */
 
@@ -113,6 +113,9 @@ map_syscall_name_to_number (const char *str, int *res)
     if (f == NULL)
 	return -1;
     while (fgets (buf, sizeof(buf), f) != NULL) {
+	if (buf[0] == '#')
+	    continue;
+
 	if (strncmp (str, buf, str_len) == 0) {
 	    char *begptr = buf + str_len;
 	    char *endptr;
diff --git a/crypto/kerberosIV/lib/kafs/afssysdefs.h b/crypto/kerberosIV/lib/kafs/afssysdefs.h
index 574b33f..685e375 100644
--- a/crypto/kerberosIV/lib/kafs/afssysdefs.h
+++ b/crypto/kerberosIV/lib/kafs/afssysdefs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: afssysdefs.h,v 1.21 1999/12/02 16:58:40 joda Exp $ */
+/* $Id: afssysdefs.h,v 1.21.2.2 2000/03/26 20:10:11 assar Exp $ */
 
 /*
  * This section is for machines using single entry point AFS syscalls!
@@ -50,7 +50,7 @@
 #define AFS_SYSCALL	105
 #endif
 
-#if SunOS == 57
+#if SunOS >= 57
 #define AFS_SYSCALL	73
 #endif
 
@@ -82,6 +82,10 @@
 #define AFS_SYSCALL 210
 #endif
 
+#ifdef __APPLE__		/* MacOS X */
+#define AFS_SYSCALL 230
+#endif
+
 #ifdef SYS_afs_syscall
 #define AFS_SYSCALL3	SYS_afs_syscall
 #endif
diff --git a/crypto/kerberosIV/lib/kafs/dlfcn.c b/crypto/kerberosIV/lib/kafs/dlfcn.c
index e664fe3..728cf5c 100644
--- a/crypto/kerberosIV/lib/kafs/dlfcn.c
+++ b/crypto/kerberosIV/lib/kafs/dlfcn.c
@@ -115,12 +115,12 @@ void *dlopen(const char *path, int mode)
 		}
 	if ((mp = (ModulePtr)calloc(1, sizeof(*mp))) == NULL) {
 		errvalid++;
-		snprintf (errbuf, "calloc: %s", strerror(errno));
+		snprintf (errbuf, sizeof(errbuf), "calloc: %s", strerror(errno));
 		return NULL;
 	}
 	if ((mp->name = strdup(path)) == NULL) {
 		errvalid++;
-		snprintf (errbuf, "strdup: %s", strerror(errno));
+		snprintf (errbuf, sizeof(errbuf), "strdup: %s", strerror(errno));
 		free(mp);
 		return NULL;
 	}
diff --git a/crypto/kerberosIV/lib/kdb/Makefile.in b/crypto/kerberosIV/lib/kdb/Makefile.in
index ac90e05..119ff6b 100644
--- a/crypto/kerberosIV/lib/kdb/Makefile.in
+++ b/crypto/kerberosIV/lib/kdb/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.40 1999/03/10 19:01:15 joda Exp $
+# $Id: Makefile.in,v 1.40.4.1 2000/06/23 03:20:00 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -54,7 +54,7 @@ Wall:
 
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
-	$(INSTALL_DATA) -m 0555 $(LIB) $(DESTDIR)$(libdir)/$(LIB)
+	$(INSTALL_DATA)  $(LIB) $(DESTDIR)$(libdir)/$(LIB)
 	@install_symlink_command@
 
 uninstall:
diff --git a/crypto/kerberosIV/lib/krb/Makefile.in b/crypto/kerberosIV/lib/krb/Makefile.in
index 301a9af..2196db2 100644
--- a/crypto/kerberosIV/lib/krb/Makefile.in
+++ b/crypto/kerberosIV/lib/krb/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.113 1999/11/25 05:26:26 assar Exp $
+# $Id: Makefile.in,v 1.113.2.2 2000/12/07 16:44:12 assar Exp $
 #
 SHELL = /bin/sh
 
@@ -10,6 +10,7 @@ CC = @CC@
 LINK = @LINK@
 AR = ar
 RANLIB = @RANLIB@
+CP = cp
 LN_S = @LN_S@
 DEFS = @DEFS@ -DROKEN_RENAME
 CFLAGS = @CFLAGS@ $(WFLAGS)
@@ -254,7 +255,7 @@ Wall:
 
 install: all
 	$(MKINSTALLDIRS) $(DESTDIR)$(libdir)
-	$(INSTALL_DATA) -m 0555 $(LIB) $(DESTDIR)$(libdir)/$(LIB)
+	$(INSTALL_DATA)  $(LIB) $(DESTDIR)$(libdir)/$(LIB)
 	@install_symlink_command@
 	$(MKINSTALLDIRS) $(DESTDIR)$(includedir)
 	@for i in $(inc_DATA); do \
@@ -291,12 +292,17 @@ distclean: clean
 realclean: distclean
 	rm -f TAGS
 
+$(LIBNAME)_pic.a: $(OBJECTS) $(SHLIB_LIBADD)
+	rm -f $@
+	$(AR) cr $@ $(OBJECTS) $(SHLIB_LIBADD)
+	-$(RANLIB) $@
+
 $(LIBNAME).a: $(OBJECTS)
 	rm -f $@
 	$(AR) cr $@ $(OBJECTS)
 	-$(RANLIB) $@
 
-$(LIBNAME).$(SHLIBEXT): $(OBJECTS) $(SHLIB_LIBADD)
+$(LIBNAME).$(SHLIBEXT): $(OBJECTS) $(SHLIB_LIBADD) $(LIBNAME)_pic.a
 	rm -f $@
 	$(LDSHARED) -o $@ $(OBJECTS) $(SHLIB_LIBADD) $(LIB_DEPS)
 	@build_symlink_command@
@@ -359,8 +365,8 @@ rw.o: ../../include/version.h
 all-local: $(inc_DATA)
 	@for i in $(inc_DATA); do \
 		if cmp -s  $$i $(idir)/$$i 2> /dev/null ; then :; else\
-			echo " $(INSTALL_DATA) $$i $(idir)/$$i"; \
-			$(INSTALL_DATA) $$i $(idir)/$$i; \
+			echo " $(CP) $$i $(idir)/$$i"; \
+			$(CP) $$i $(idir)/$$i; \
 		fi ; \
 	done
 
diff --git a/crypto/kerberosIV/lib/krb/dest_tkt.c b/crypto/kerberosIV/lib/krb/dest_tkt.c
index 0487e6b..4330df2 100644
--- a/crypto/kerberosIV/lib/krb/dest_tkt.c
+++ b/crypto/kerberosIV/lib/krb/dest_tkt.c
@@ -21,7 +21,11 @@ or implied warranty.
 
 #include "krb_locl.h"
 
-RCSID("$Id: dest_tkt.c,v 1.11 1997/05/19 03:03:40 assar Exp $");
+RCSID("$Id: dest_tkt.c,v 1.11.14.2 2000/10/18 20:26:42 assar Exp $");
+
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
 
 /*
  * dest_tkt() is used to destroy the ticket store upon logout.
@@ -35,48 +39,70 @@ RCSID("$Id: dest_tkt.c,v 1.11 1997/05/19 03:03:40 assar Exp $");
 int
 dest_tkt(void)
 {
-    char *file = TKT_FILE;
-    int i,fd;
-    struct stat statb;
+    const char *filename = TKT_FILE;
+    int i, fd;
+    struct stat sb1, sb2;
     char buf[BUFSIZ];
+    int error = 0;
 
-    errno = 0;
-    if (
-#ifdef HAVE_LSTAT
-    lstat
-#else
-    stat
-#endif
-    (file, &statb) < 0)      
+    if (lstat (filename, &sb1) < 0) {
+	error = errno;
 	goto out;
+    }
 
-    if (!(statb.st_mode & S_IFREG)
-#ifdef notdef
-	|| statb.st_mode & 077
-#endif
-	)
+    fd = open (filename, O_RDWR | O_BINARY);
+    if (fd < 0) {
+	error = errno;
+	goto out;
+    }
+
+    if (unlink (filename) < 0) {
+	error = errno;
+	close(fd);
 	goto out;
+    }
 
-    if ((fd = open(file, O_RDWR, 0)) < 0)
+    if (fstat (fd, &sb2) < 0) {
+	error = errno;
+	close(fd);
 	goto out;
+    }
 
-    memset(buf, 0, BUFSIZ);
+    if (sb1.st_dev != sb2.st_dev || sb1.st_ino != sb2.st_ino) {
+	close (fd);
+	error = EPERM;
+	goto out;
+    }
+
+    if (sb2.st_nlink != 0) {
+	close (fd);
+	error = EPERM;
+	goto out;
+    }
 
-    for (i = 0; i < statb.st_size; i += sizeof(buf))
-	if (write(fd, buf, sizeof(buf)) != sizeof(buf)) {
+    for (i = 0; i < sb2.st_size; i += sizeof(buf)) {
+	int ret;
+	
+	ret = write(fd, buf, sizeof(buf));
+	if (ret != sizeof(buf)) {
+	    if (ret < 0)
+		error = errno;
+	    else
+		error = EINVAL;
 	    fsync(fd);
 	    close(fd);
 	    goto out;
 	}
-	
+    }
 
     fsync(fd);
     close(fd);
     
-    unlink(file);
-
 out:
-    if (errno == ENOENT) return RET_TKFIL;
-    else if (errno != 0) return KFAILURE;
-    return(KSUCCESS);
+    if (error == ENOENT)
+	return RET_TKFIL;
+    else if (error != 0)
+	return KFAILURE;
+    else
+	return(KSUCCESS);
 }
diff --git a/crypto/kerberosIV/lib/krb/extra.c b/crypto/kerberosIV/lib/krb/extra.c
index 0668e17..17193a4 100644
--- a/crypto/kerberosIV/lib/krb/extra.c
+++ b/crypto/kerberosIV/lib/krb/extra.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998 Kungliga Tekniska Högskolan
+ * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: extra.c,v 1.7 1999/12/02 16:58:41 joda Exp $");
+RCSID("$Id: extra.c,v 1.7.2.1 2000/12/07 16:06:09 assar Exp $");
 
 struct value {
     char *variable;
diff --git a/crypto/kerberosIV/lib/krb/get_default_principal.c b/crypto/kerberosIV/lib/krb/get_default_principal.c
index 47ad6b3..860f237 100644
--- a/crypto/kerberosIV/lib/krb/get_default_principal.c
+++ b/crypto/kerberosIV/lib/krb/get_default_principal.c
@@ -33,7 +33,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: get_default_principal.c,v 1.14 1999/12/02 16:58:41 joda Exp $");
+RCSID("$Id: get_default_principal.c,v 1.14.2.1 2000/06/23 03:29:10 assar Exp $");
 
 int
 krb_get_default_principal(char *name, char *instance, char *realm)
@@ -42,8 +42,7 @@ krb_get_default_principal(char *name, char *instance, char *realm)
   int ret;
   char *p;
 
-  if ((file = getenv("KRBTKFILE")) == NULL)
-      file = TKT_FILE;  
+  file = tkt_string ();
   
   ret = krb_get_tf_fullname(file, name, instance, realm);
   if(ret == KSUCCESS)
diff --git a/crypto/kerberosIV/lib/krb/getaddrs.c b/crypto/kerberosIV/lib/krb/getaddrs.c
index d157690..80b7238 100644
--- a/crypto/kerberosIV/lib/krb/getaddrs.c
+++ b/crypto/kerberosIV/lib/krb/getaddrs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: getaddrs.c,v 1.28 1999/12/02 16:58:42 joda Exp $");
+RCSID("$Id: getaddrs.c,v 1.28.2.1 2000/06/23 03:29:53 assar Exp $");
 
 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
 #include <sys/ioctl.h>
@@ -100,7 +100,11 @@ k_get_all_addrs (struct in_addr **l)
 	 ifconf.ifc_len = in_len;
 	 ifconf.ifc_buf = inbuf;
 
-	 if(ioctl(fd, SIOCGIFCONF, &ifconf) < 0)
+	 /*
+	  * Solaris returns EINVAL when the buffer is too small.
+	  */
+
+	 if(ioctl(fd, SIOCGIFCONF, &ifconf) < 0 && errno != EINVAL)
 	     goto fail;
 	 if(ifconf.ifc_len + sizeof(ifreq) < in_len)
 	     break;
diff --git a/crypto/kerberosIV/lib/krb/getfile.c b/crypto/kerberosIV/lib/krb/getfile.c
index 99d0c3f..7684aee 100644
--- a/crypto/kerberosIV/lib/krb/getfile.c
+++ b/crypto/kerberosIV/lib/krb/getfile.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: getfile.c,v 1.5 1999/12/02 16:58:42 joda Exp $");
+RCSID("$Id: getfile.c,v 1.5.2.1 2000/12/07 17:04:48 assar Exp $");
 
 static int
 is_suid(void)
@@ -53,7 +53,7 @@ get_file(const char **files, int num, const char *file, char *buf, size_t len)
 {
     const char *p, **q;
     int i = 0;
-    if(!is_suid() && (p = getenv("KRBCONFDIR"))){
+    if(getuid() != 0 && !is_suid() && (p = getenv("KRBCONFDIR"))){
 	if(num == i){
 	    snprintf(buf, len, "%s/%s", p, file);
 	    return 0;
diff --git a/crypto/kerberosIV/lib/krb/kdc_reply.c b/crypto/kerberosIV/lib/krb/kdc_reply.c
index 2c940ec..888ab16 100644
--- a/crypto/kerberosIV/lib/krb/kdc_reply.c
+++ b/crypto/kerberosIV/lib/krb/kdc_reply.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: kdc_reply.c,v 1.12 1999/12/02 16:58:42 joda Exp $");
+RCSID("$Id: kdc_reply.c,v 1.12.2.2 2000/12/04 14:34:28 assar Exp $");
 
 static int little_endian; /* XXX ugly */
 
@@ -115,7 +115,10 @@ kdc_reply_cipher(KTEXT reply, KTEXT cip)
     if(type != AUTH_MSG_KDC_REPLY)
 	return INTK_PROT;
 
-    p += krb_get_nir(p, aname, inst, realm);
+    p += krb_get_nir(p,
+		     aname, sizeof(aname),
+		     inst, sizeof(inst),
+		     realm, sizeof(realm));
     p += krb_get_int(p, &kdc_time, 4, little_endian);
     p++; /* number of tickets */
     p += krb_get_int(p, &exp_date, 4, little_endian);
diff --git a/crypto/kerberosIV/lib/krb/krb-protos.h b/crypto/kerberosIV/lib/krb/krb-protos.h
index bb385d6..0fbf46a 100644
--- a/crypto/kerberosIV/lib/krb/krb-protos.h
+++ b/crypto/kerberosIV/lib/krb/krb-protos.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb-protos.h,v 1.24 1999/12/02 16:58:42 joda Exp $ */
+/* $Id: krb-protos.h,v 1.24.2.1 2000/06/23 03:32:04 assar Exp $ */
 
 #ifndef __krb_protos_h__
 #define __krb_protos_h__
@@ -328,9 +328,9 @@ krb_get_lrealm __P((
 int KRB_LIB_FUNCTION
 krb_get_nir __P((
 	void *from,
-	char *name,
-	char *instance,
-	char *realm));
+	char *name, size_t name_len,
+	char *instance, size_t instance_len,
+	char *realm, size_t realm_len));
 
 char * KRB_LIB_FUNCTION
 krb_get_phost __P((const char *alias));
diff --git a/crypto/kerberosIV/lib/krb/logging.c b/crypto/kerberosIV/lib/krb/logging.c
index bac1c18..1044fac 100644
--- a/crypto/kerberosIV/lib/krb/logging.c
+++ b/crypto/kerberosIV/lib/krb/logging.c
@@ -34,7 +34,7 @@
 #include "krb_locl.h"
 #include <klog.h>
 
-RCSID("$Id: logging.c,v 1.18 1999/12/02 16:58:42 joda Exp $");
+RCSID("$Id: logging.c,v 1.18.2.1 2000/10/13 15:57:34 assar Exp $");
 
 struct krb_log_facility {
     char filename[MaxPathLen]; 
@@ -53,6 +53,9 @@ krb_vlogger(struct krb_log_facility *f, const char *format, va_list args)
     else if (f->filename && f->filename[0])
 	file = fopen(f->filename, "a");
 
+    if (file == NULL)
+      return KFAILURE;
+
     ret = f->func(file, format, args);
 
     if (file != f->file)
diff --git a/crypto/kerberosIV/lib/krb/mk_safe.c b/crypto/kerberosIV/lib/krb/mk_safe.c
index 2e8c5c2..c0bbc9a 100644
--- a/crypto/kerberosIV/lib/krb/mk_safe.c
+++ b/crypto/kerberosIV/lib/krb/mk_safe.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,11 +33,20 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: mk_safe.c,v 1.25 1999/12/02 16:58:43 joda Exp $");
+RCSID("$Id: mk_safe.c,v 1.25.2.1 2000/10/10 13:19:25 assar Exp $");
 
 /* application include files */
 #include "krb-archaeology.h"
 
+#ifndef DES_QUAD_GUESS
+/* Temporary fixes for krb_{rd,mk}_safe */
+#define DES_QUAD_GUESS 0
+#define DES_QUAD_NEW 1
+#define DES_QUAD_OLD 2
+
+#define DES_QUAD_DEFAULT DES_QUAD_GUESS
+
+#endif /* DES_QUAD_GUESS */
 
 /* from rd_safe.c */
 extern int dqc_type;
diff --git a/crypto/kerberosIV/lib/krb/rd_req.c b/crypto/kerberosIV/lib/krb/rd_req.c
index 91b27a5..4dca78e 100644
--- a/crypto/kerberosIV/lib/krb/rd_req.c
+++ b/crypto/kerberosIV/lib/krb/rd_req.c
@@ -33,7 +33,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: rd_req.c,v 1.27.2.1 1999/12/06 22:04:36 assar Exp $");
+RCSID("$Id: rd_req.c,v 1.27.2.2 2000/06/23 04:00:20 assar Exp $");
 
 static struct timeval t_local = { 0, 0 };
 
@@ -141,7 +141,7 @@ krb_rd_req(KTEXT authent,	/* The received message */
 	   char *instance,	/* Service instance */
 	   int32_t from_addr,	/* Net address of originating host */
 	   AUTH_DAT *ad,	/* Structure to be filled in */
-	   char *fn)		/* Filename to get keys from */
+	   char *a_fn)		/* Filename to get keys from */
 {
     static KTEXT_ST ticket;     /* Temp storage for ticket */
     static KTEXT tkt = &ticket;
@@ -169,6 +169,8 @@ krb_rd_req(KTEXT authent,	/* The received message */
     int type;
     int little_endian;
 
+    const char *fn = a_fn;
+
     unsigned char *p;
 
     if (authent->length <= 0)
@@ -262,7 +264,10 @@ krb_rd_req(KTEXT authent,	/* The received message */
     /* cast req_id->length to int? */
 #define check_ptr() if ((ptr - (char *) req_id->dat) > req_id->length) return(RD_AP_MODIFIED);
 
-    p += krb_get_nir(p, r_aname, r_inst, r_realm); /* XXX no rangecheck */
+    p += krb_get_nir(p,
+		     r_aname, sizeof(r_aname),
+		     r_inst, sizeof(r_inst),
+		     r_realm, sizeof(r_realm));
 
     p += krb_get_int(p, &ad->checksum, 4, little_endian);
 
diff --git a/crypto/kerberosIV/lib/krb/rd_safe.c b/crypto/kerberosIV/lib/krb/rd_safe.c
index fd8f35e..1d536ab 100644
--- a/crypto/kerberosIV/lib/krb/rd_safe.c
+++ b/crypto/kerberosIV/lib/krb/rd_safe.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,11 +33,21 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: rd_safe.c,v 1.26 1999/12/02 16:58:43 joda Exp $");
+RCSID("$Id: rd_safe.c,v 1.26.2.1 2000/10/10 13:20:36 assar Exp $");
 
 /* application include files */
 #include "krb-archaeology.h"
 
+#ifndef DES_QUAD_GUESS
+/* Temporary fixes for krb_{rd,mk}_safe */
+#define DES_QUAD_GUESS 0
+#define DES_QUAD_NEW 1
+#define DES_QUAD_OLD 2
+
+#define DES_QUAD_DEFAULT DES_QUAD_GUESS
+
+#endif /* DES_QUAD_GUESS */
+
 /* Generate two checksums in the given byteorder of the data, one
  * new-form and one old-form. It has to be done this way to be
  * compatible with the old version of des_quad_cksum.
diff --git a/crypto/kerberosIV/lib/krb/roken_rename.h b/crypto/kerberosIV/lib/krb/roken_rename.h
index bae1098..7bd86e2 100644
--- a/crypto/kerberosIV/lib/krb/roken_rename.h
+++ b/crypto/kerberosIV/lib/krb/roken_rename.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998 Kungliga Tekniska Högskolan
+ * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: roken_rename.h,v 1.8 1999/12/02 16:58:44 joda Exp $ */
+/* $Id: roken_rename.h,v 1.8.2.1 2000/06/23 03:35:31 assar Exp $ */
 
 #ifndef __roken_rename_h__
 #define __roken_rename_h__
@@ -85,6 +85,12 @@
 #ifndef HAVE_STRDUP
 #define strdup _krb_strdup
 #endif
+#ifndef HAVE_STRLCAT
+#define strlcat _krb_strlcat
+#endif
+#ifndef HAVE_STRLCPY
+#define strlcpy _krb_strlcpy
+#endif
 #ifndef HAVE_STRNLEN
 #define strnlen _krb_strnlen
 #endif
@@ -95,4 +101,7 @@
 #define strtok_r _krb_strtok_r
 #endif
 
+#define dns_free_data _krb_dns_free_data
+#define dns_lookup _krb_dns_lookup
+
 #endif /* __roken_rename_h__ */
diff --git a/crypto/kerberosIV/lib/krb/rw.c b/crypto/kerberosIV/lib/krb/rw.c
index 88589c3..5064a6f 100644
--- a/crypto/kerberosIV/lib/krb/rw.c
+++ b/crypto/kerberosIV/lib/krb/rw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -38,7 +38,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: rw.c,v 1.12 1999/12/02 16:58:44 joda Exp $");
+RCSID("$Id: rw.c,v 1.12.2.1 2000/06/23 03:37:33 assar Exp $");
 
 int
 krb_get_int(void *f, u_int32_t *to, int size, int lsb)
@@ -109,14 +109,17 @@ krb_get_string(void *from, char *to, size_t to_size)
 }
 
 int
-krb_get_nir(void *from, char *name, char *instance, char *realm)
+krb_get_nir(void *from,
+	    char *name, size_t name_len,
+	    char *instance, size_t instance_len,
+	    char *realm, size_t realm_len)
 {
     char *p = (char *)from;
 
-    p += krb_get_string(p, name, ANAME_SZ);
-    p += krb_get_string(p, instance, INST_SZ);
+    p += krb_get_string(p, name, name_len);
+    p += krb_get_string(p, instance, instance_len);
     if(realm)
-	p += krb_get_string(p, realm, REALM_SZ);
+	p += krb_get_string(p, realm, realm_len);
     return p - (char *)from;
 }
 
diff --git a/crypto/kerberosIV/lib/krb/send_to_kdc.c b/crypto/kerberosIV/lib/krb/send_to_kdc.c
index 74ac1bb..4fc2c95 100644
--- a/crypto/kerberosIV/lib/krb/send_to_kdc.c
+++ b/crypto/kerberosIV/lib/krb/send_to_kdc.c
@@ -22,7 +22,7 @@ or implied warranty.
 #include "krb_locl.h"
 #include <base64.h>
 
-RCSID("$Id: send_to_kdc.c,v 1.71 1999/11/25 02:20:53 assar Exp $");
+RCSID("$Id: send_to_kdc.c,v 1.71.2.1 2000/10/10 12:47:21 assar Exp $");
 
 struct host {
     struct sockaddr_in addr;
@@ -488,6 +488,12 @@ send_recv(KTEXT pkt, KTEXT rpkt, struct host *host)
 	timeout.tv_sec = client_timeout;
 	timeout.tv_usec = 0;
 	FD_ZERO(&readfds);
+	if (s >= FD_SETSIZE) {
+	    if (krb_debug)
+		krb_warning("fd too large\n");
+	    close (s);
+	    return FALSE;
+	}
 	FD_SET(s, &readfds);
 	
 	/* select - either recv is ready, or timeout */
diff --git a/crypto/kerberosIV/lib/krb/tf_util.c b/crypto/kerberosIV/lib/krb/tf_util.c
index 5528c49..0d5361f 100644
--- a/crypto/kerberosIV/lib/krb/tf_util.c
+++ b/crypto/kerberosIV/lib/krb/tf_util.c
@@ -21,7 +21,7 @@ or implied warranty.
         
 #include "krb_locl.h"
 
-RCSID("$Id: tf_util.c,v 1.39 1999/12/02 18:03:16 assar Exp $");
+RCSID("$Id: tf_util.c,v 1.39.2.2 2000/06/23 04:03:58 assar Exp $");
 
 
 #define TOO_BIG -1
diff --git a/crypto/kerberosIV/lib/krb/verify_user.c b/crypto/kerberosIV/lib/krb/verify_user.c
index 36c64d7..24138e2 100644
--- a/crypto/kerberosIV/lib/krb/verify_user.c
+++ b/crypto/kerberosIV/lib/krb/verify_user.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,7 @@
 
 #include "krb_locl.h"
 
-RCSID("$Id: verify_user.c,v 1.17.2.1 1999/12/06 22:57:17 assar Exp $");
+RCSID("$Id: verify_user.c,v 1.17.2.2 2000/12/15 14:43:37 assar Exp $");
 
 /*
  * Verify user (name.instance@realm) with `password'.
@@ -78,6 +78,7 @@ krb_verify_user_srvtab_exact(char *name,
 	
 	KTEXT_ST ticket;
 	AUTH_DAT auth;
+	int n;
 
 	char lrealm[REALM_SZ];
 	char hostname[MaxHostNameLen];
@@ -94,33 +95,31 @@ krb_verify_user_srvtab_exact(char *name,
 	    return -1;
 	}
 	memcpy(&addr, hp->h_addr, sizeof(addr));
-
-	ret = krb_get_lrealm(lrealm, 1);
-	if(ret != KSUCCESS){
-	    dest_tkt();
-	    return ret;
-	}
 	phost = krb_get_phost(hostname);
-	
 	if (linstance == NULL)
 	    linstance = "rcmd";
 
-	if(secure == KRB_VERIFY_SECURE_FAIL) {
-	    des_cblock key;
-	    ret = read_service_key(linstance, phost, lrealm, 0, srvtab, &key);
-	    memset(key, 0, sizeof(key));
-	    if(ret == KFAILURE)
-		return 0;
+	ret = KFAILURE;
+
+	for (n = 1; krb_get_lrealm(lrealm, n) == KSUCCESS; ++n) {
+	    if(secure == KRB_VERIFY_SECURE_FAIL) {
+		des_cblock key;
+		ret = read_service_key(linstance, phost, lrealm, 0, srvtab,
+				       &key);
+		memset(key, 0, sizeof(key));
+		if(ret == KFAILURE)
+		    continue;
+	    }
+
+	    ret = krb_mk_req(&ticket, linstance, phost, lrealm, 0);
+	    if(ret == KSUCCESS) {
+		ret = krb_rd_req(&ticket, linstance, phost, addr, &auth,
+				 srvtab);
+		if (ret == KSUCCESS)
+		    break;
+	    }
 	}
-	
-	ret = krb_mk_req(&ticket, linstance, phost, lrealm, 33);
-	if(ret != KSUCCESS){
-	    dest_tkt();
-	    return ret;
-	}
-	
-	ret = krb_rd_req(&ticket, linstance, phost, addr, &auth, srvtab);
-	if(ret != KSUCCESS){
+	if (ret != KSUCCESS) {
 	    dest_tkt();
 	    return ret;
 	}
diff --git a/crypto/kerberosIV/lib/roken/Makefile.in b/crypto/kerberosIV/lib/roken/Makefile.in
index 70563e4..e3afbae 100644
--- a/crypto/kerberosIV/lib/roken/Makefile.in
+++ b/crypto/kerberosIV/lib/roken/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.73 1999/11/30 19:22:59 bg Exp $
+# $Id: Makefile.in,v 1.73.2.1 2000/06/23 04:37:43 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -94,6 +94,7 @@ SOURCES = \
 	snprintf.c \
 	socket.c \
 	strcasecmp.c \
+	strcollect.c \
 	strdup.c \
 	strerror.c \
 	strftime.c \
@@ -148,6 +149,7 @@ OBJECTS = \
 	simple_exec.o \
 	snprintf.o \
 	socket.o \
+	strcollect.o \
 	tm2time.o \
 	verify.o \
 	warnerr.o \
diff --git a/crypto/kerberosIV/lib/roken/mini_inetd.c b/crypto/kerberosIV/lib/roken/mini_inetd.c
index a0c6333..0d3b3b6 100644
--- a/crypto/kerberosIV/lib/roken/mini_inetd.c
+++ b/crypto/kerberosIV/lib/roken/mini_inetd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: mini_inetd.c,v 1.18 1999/12/02 16:58:51 joda Exp $");
+RCSID("$Id: mini_inetd.c,v 1.18.2.1 2000/10/10 13:22:33 assar Exp $");
 #endif
 
 #include <stdio.h>
@@ -162,12 +162,16 @@ mini_inetd (int port)
     sock_v4 = listen_v4 (port);
     if (sock_v4 >= 0) {
 	max_fd  = max(max_fd, sock_v4);
+	if (max_fd >= FD_SETSIZE)
+	    errx (1, "fd too large");
 	FD_SET(sock_v4, &orig_read_set);
     }
 #ifdef HAVE_IPV6
     sock_v6 = listen_v6 (port);
     if (sock_v6 >= 0) {
 	max_fd  = max(max_fd, sock_v6);
+	if (max_fd >= FD_SETSIZE)
+	    errx (1, "fd too large");
 	FD_SET(sock_v6, &orig_read_set);
     }
 #endif    
diff --git a/crypto/kerberosIV/lib/roken/print_version.c b/crypto/kerberosIV/lib/roken/print_version.c
index 809bbb3..57f6bd2 100644
--- a/crypto/kerberosIV/lib/roken/print_version.c
+++ b/crypto/kerberosIV/lib/roken/print_version.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: print_version.c,v 1.5 1999/12/02 16:58:51 joda Exp $");
+RCSID("$Id: print_version.c,v 1.5.2.1 2000/10/10 13:23:43 assar Exp $");
 #endif
 #include "roken.h"
 
@@ -72,7 +72,7 @@ print_version(const char *progname)
 	}
     }
     fprintf(stderr, "%s (%s)\n", progname, msg);
-    fprintf(stderr, "Copyright (c) 1999 Kungliga Tekniska Högskolan\n");
+    fprintf(stderr, "Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan\n");
     if(num_args != 0)
 	free(msg);
 }
diff --git a/crypto/kerberosIV/lib/roken/roken-common.h b/crypto/kerberosIV/lib/roken/roken-common.h
index 0bb648b..a57f54d 100644
--- a/crypto/kerberosIV/lib/roken/roken-common.h
+++ b/crypto/kerberosIV/lib/roken/roken-common.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: roken-common.h,v 1.19 1999/12/02 16:58:52 joda Exp $ */
+/* $Id: roken-common.h,v 1.19.2.2 2000/08/16 03:37:26 assar Exp $ */
 
 #ifndef __ROKEN_COMMON_H__
 #define __ROKEN_COMMON_H__
@@ -100,6 +100,10 @@
 #define O_ACCMODE	003
 #endif
 
+#ifndef _PATH_DEV
+#define _PATH_DEV "/dev/"
+#endif
+
 #ifndef _PATH_DEVNULL
 #define _PATH_DEVNULL "/dev/null"
 #endif
@@ -252,4 +256,10 @@ socket_set_tos (int sock, int tos);
 void
 socket_set_reuseaddr (int sock, int val);
 
+char **
+vstrcollect(va_list *ap);
+
+char **
+strcollect(char *first, ...);
+ 
 #endif /* __ROKEN_COMMON_H__ */
diff --git a/crypto/kerberosIV/lib/roken/roken.h.in b/crypto/kerberosIV/lib/roken/roken.h.in
index 65263ba..be0774e 100644
--- a/crypto/kerberosIV/lib/roken/roken.h.in
+++ b/crypto/kerberosIV/lib/roken/roken.h.in
@@ -1,6 +1,6 @@
 /* -*- C -*- */
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: roken.h.in,v 1.125 1999/12/02 16:58:52 joda Exp $ */
+/* $Id: roken.h.in,v 1.125.2.4 2000/03/12 20:32:51 assar Exp $ */
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -69,6 +69,9 @@
 #ifdef HAVE_NETINET6_IN6_H
 #include <netinet6/in6.h>
 #endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -427,40 +430,52 @@ struct hostent *
 copyhostent (const struct hostent *h);
 #endif
 
+#ifndef HAVE_SOCKLEN_T
+typedef int socklen_t;
+#endif
+
 #ifndef HAVE_STRUCT_SOCKADDR_STORAGE
 
 #ifndef HAVE_SA_FAMILY_T
 typedef unsigned short sa_family_t;
 #endif
 
+#ifdef HAVE_IPV6
+#define _SS_MAXSIZE sizeof(struct sockaddr_in6)
+#else
+#define _SS_MAXSIZE sizeof(struct sockaddr_in)
+#endif
+
+#define _SS_ALIGNSIZE	sizeof(unsigned long)
+
 #if HAVE_STRUCT_SOCKADDR_SA_LEN
 
+typedef unsigned char roken_sa_family_t;
+
+#define _SS_PAD1SIZE   ((2 * _SS_ALIGNSIZE - sizeof (roken_sa_family_t) - sizeof(unsigned char)) % _SS_ALIGNSIZE)
+#define _SS_PAD2SIZE   (_SS_MAXSIZE - (sizeof (roken_sa_family_t) + sizeof(unsigned char) + _SS_PAD1SIZE + _SS_ALIGNSIZE))
+
 struct sockaddr_storage {
     unsigned char	__ss_len;
-    sa_family_t		__ss_family;
-    char		pad[
-#ifdef HAVE_IPV6
-			    sizeof(struct sockaddr_in6)
-#else
-			    sizeof(struct sockaddr_in)
-#endif
-			   - sizeof(unsigned char) - sizeof(sa_family_t)];
+    roken_sa_family_t	__ss_family;
+    char		__ss_pad1[_SS_PAD1SIZE];
+    unsigned long	__ss_align[_SS_PAD2SIZE / sizeof(unsigned long) + 1];
 };
 
-#else
+#else /* !HAVE_STRUCT_SOCKADDR_SA_LEN */
+
+typedef unsigned short roken_sa_family_t;
+
+#define _SS_PAD1SIZE   ((2 * _SS_ALIGNSIZE - sizeof (roken_sa_family_t)) % _SS_ALIGNSIZE)
+#define _SS_PAD2SIZE   (_SS_MAXSIZE - (sizeof (roken_sa_family_t) + _SS_PAD1SIZE + _SS_ALIGNSIZE))
 
 struct sockaddr_storage {
-    sa_family_t		__ss_family;
-    char		pad[
-#ifdef HAVE_IPV6
-			    sizeof(struct sockaddr_in6)
-#else
-			    sizeof(struct sockaddr_in)
-#endif
-			    - sizeof(sa_family_t)];
+    roken_sa_family_t	__ss_family;
+    char		__ss_pad1[_SS_PAD1SIZE];
+    unsigned long	__ss_align[_SS_PAD2SIZE / sizeof(unsigned long) + 1];
 };
 
-#endif
+#endif /* HAVE_STRUCT_SOCKADDR_SA_LEN */
 
 #endif /* HAVE_STRUCT_SOCKADDR_STORAGE */
 
diff --git a/crypto/kerberosIV/lib/roken/signal.c b/crypto/kerberosIV/lib/roken/signal.c
index c26f72f..7f2ba29 100644
--- a/crypto/kerberosIV/lib/roken/signal.c
+++ b/crypto/kerberosIV/lib/roken/signal.c
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: signal.c,v 1.9 1999/12/02 16:58:52 joda Exp $");
+RCSID("$Id: signal.c,v 1.9.2.1 2000/03/12 19:36:16 assar Exp $");
 #endif
 
 #include <signal.h>
@@ -42,7 +42,7 @@ RCSID("$Id: signal.c,v 1.9 1999/12/02 16:58:52 joda Exp $");
  * We would like to always use this signal but there is a link error
  * on NEXTSTEP
  */
-#ifndef NeXT
+#if !defined(NeXT) && !defined(__APPLE__)
 /*
  * Bugs:
  *
diff --git a/crypto/kerberosIV/lib/roken/snprintf.c b/crypto/kerberosIV/lib/roken/snprintf.c
index 0333e87..8450e8b 100644
--- a/crypto/kerberosIV/lib/roken/snprintf.c
+++ b/crypto/kerberosIV/lib/roken/snprintf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995-1997, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995-2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: snprintf.c,v 1.24 1999/12/02 16:58:52 joda Exp $");
+RCSID("$Id: snprintf.c,v 1.24.2.1 2000/06/14 07:26:49 joda Exp $");
 #endif
 #include <stdio.h>
 #include <stdarg.h>
@@ -265,7 +265,7 @@ append_char(struct state *state,
 if (long_flag) \
      res = (unsig long)va_arg(arg, unsig long); \
 else if (short_flag) \
-     res = (unsig short)va_arg(arg, unsig short); \
+     res = (unsig short)va_arg(arg, unsig int); \
 else \
      res = (unsig int)va_arg(arg, unsig int)
 
diff --git a/crypto/kerberosIV/lib/roken/strcollect.c b/crypto/kerberosIV/lib/roken/strcollect.c
new file mode 100644
index 0000000..a42f904
--- /dev/null
+++ b/crypto/kerberosIV/lib/roken/strcollect.c
@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+RCSID("$Id: strcollect.c,v 1.1.8.1 2000/06/23 04:37:44 assar Exp $");
+#endif
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <roken.h>
+
+enum { initial = 10, increment = 5 };
+
+static char **
+sub (char **argv, int i, int argc, va_list *ap)
+{
+    do {
+	if(i == argc) {
+	    /* realloc argv */
+	    char **tmp = realloc(argv, (argc + increment) * sizeof(*argv));
+	    if(tmp == NULL) {
+		free(argv);
+		errno = ENOMEM;
+		return NULL;
+	    }
+	    argv  = tmp;
+	    argc += increment;
+	}
+	argv[i++] = va_arg(*ap, char*);
+    } while(argv[i - 1] != NULL);
+    return argv;
+}
+
+/*
+ * return a malloced vector of pointers to the strings in `ap'
+ * terminated by NULL.
+ */
+
+char **
+vstrcollect(va_list *ap)
+{
+    return sub (NULL, 0, 0, ap);
+}
+
+/*
+ *
+ */
+
+char **
+strcollect(char *first, ...)
+{
+    va_list ap;
+    char **ret = malloc (initial * sizeof(char *));
+
+    if (ret == NULL)
+	return ret;
+
+    ret[0] = first;
+    va_start(ap, first);
+    ret = sub (ret, 1, initial, &ap);
+    va_end(ap);
+    return ret;
+}
diff --git a/crypto/kerberosIV/lib/roken/xdbm.h b/crypto/kerberosIV/lib/roken/xdbm.h
index 83885b3..ebfb7d7 100644
--- a/crypto/kerberosIV/lib/roken/xdbm.h
+++ b/crypto/kerberosIV/lib/roken/xdbm.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: xdbm.h,v 1.6 1999/12/02 16:58:54 joda Exp $ */
+/* $Id: xdbm.h,v 1.6.2.1 2000/08/16 04:11:29 assar Exp $ */
 
 /* Generic *dbm include file */
 
@@ -40,6 +40,8 @@
 
 #ifdef HAVE_NDBM_H
 #include <ndbm.h>
+#elif defined(HAVE_GDBM_NDBM_H)
+#include <gdbm/ndbm.h>
 #elif defined(HAVE_DBM_H)
 #include <dbm.h>
 #elif defined(HAVE_RPCSVC_DBM_H)
diff --git a/crypto/kerberosIV/lib/sl/Makefile.in b/crypto/kerberosIV/lib/sl/Makefile.in
index 6cdb8a6..3d605b0 100644
--- a/crypto/kerberosIV/lib/sl/Makefile.in
+++ b/crypto/kerberosIV/lib/sl/Makefile.in
@@ -1,5 +1,5 @@
 #
-# $Id: Makefile.in,v 1.31 1999/03/10 19:01:17 joda Exp $
+# $Id: Makefile.in,v 1.31.16.2 2000/06/23 03:20:04 assar Exp $
 #
 
 SHELL = /bin/sh
@@ -31,6 +31,7 @@ libdir = @libdir@
 bindir = @bindir@
 includedir = @includedir@
 
+LIB_tgetent = @LIB_tgetent@
 LIB_DEPS = @lib_deps_yes@ @LIB_readline@ -lc
 build_symlink_command   = @build_symlink_command@
 install_symlink_command = @install_symlink_command@
@@ -52,11 +53,11 @@ LDSHARED = @LDSHARED@
 PROGS = mk_cmds$(EXECSUFFIX)
 
 LIB_SOURCES = sl.c ss.c
-EXTRA_SOURCES = strtok_r.c snprintf.c
+EXTRA_SOURCES = strtok_r.c snprintf.c strupr.c
 
 SOURCES = $(LIB_SOURCES) make_cmds.c $(EXTRA_SOURCES)
 
-LIBADD = strtok_r.o snprintf.o
+LIBADD = strtok_r.o snprintf.o strupr.o
 
 LIB_OBJECTS = sl.o ss.o $(LIBADD)
 
@@ -81,7 +82,7 @@ install: all
 	@install_symlink_command@
 	@install_symlink_command2@
 	$(MKINSTALLDIRS) $(DESTDIR)$(bindir)
-	$(INSTALL) -m 0555 $(PROGS) $(DESTDIR)$(bindir)/$(PROGS)
+	$(INSTALL)  $(PROGS) $(DESTDIR)$(bindir)/$(PROGS)
 
 uninstall:
 	rm -f $(DESTDIR)$(includedir)/ss/ss.h
@@ -135,5 +136,7 @@ strtok_r.c:
 	$(LN_S) $(srcdir)/../roken/strtok_r.c .
 snprintf.c:
 	$(LN_S) $(srcdir)/../roken/snprintf.c .
+strupr.c:
+	$(LN_S) $(srcdir)/../roken/strupr.c .
 
 .PHONY: all Wall install uninstall check clean mostlyclean distclean realclean